I85PREP
⌘ K
OLE study materials
OLE study resources

OLE: User and Group Administration, Permissions, and Access Control

OLE · Work through your exam, one topic at a time.

All guide sections

User and Group Administration, Permissions, and Access Control

This domain tests account lifecycle management, the Unix permission model including special bits and ACLs, and privilege escalation with sudo.

Accounts and groups

  • useradd -m -G wheel -s /bin/bash alice, usermod -aG dev alice, userdel -r alice, passwd alice, chage -l alice, chage -M 90 alice.
  • Defaults come from /etc/default/useradd, /etc/login.defs, and the skeleton copied by -m from /etc/skel.
  • Password quality is governed by /etc/security/pwquality.conf; lockouts by faillock settings under /etc/security/.

Permissions

  • Modes are rwx for user, group, other; umask 022 yields 755 directories and 644 files, umask 002 yields 775/664.
  • Special bits: SUID (4) runs as the file owner, SGID (2) on a directory makes new files inherit the group, sticky (1) on a shared directory prevents deleting others' files.
  • ACLs: setfacl -m u:bob:rw file, setfacl -m g:dev:rwx dir, setfacl -d -m g:dev:rwx dir for a default ACL, inspected with getfacl. The ACL mask caps effective permissions for named users, groups, and the owning group.
  • Immutability: chattr +i and lsattr.

sudo

  • Edit with visudo or a file in /etc/sudoers.d/; entries look like %dev ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd.
  • sudo -l shows the invoking user's rights; su - alice starts a login shell with the target user's environment.

Worked example

A team needs a shared directory where every file stays group-owned by dev and members can write. Do: groupadd dev, usermod -aG dev alice, mkdir /srv/dev, chgrp dev /srv/dev, chmod 2770 /srv/dev, setfacl -d -m g:dev:rwx /srv/dev. Reasoning: 2770 sets SGID so new files inherit group dev, and the default ACL guarantees group dev keeps rwx regardless of the creator's umask.

Traps

  • usermod -G dev alice replaces supplementary groups; always use -aG.
  • Directory mode 2770 without the group's execute bit would block traversal.
  • A restrictive ACL mask silently strips effective permissions; getfacl prints #effective: lines.
  • A syntax error in /etc/sudoers can remove all sudo access - always use visudo.