Exercise: Set up a web team

Set up a web team

• Create a group with a chosen GID and users with supplementary groups.
• Create a service account with nologin.
• Recover from replacing a user's groups by mistake.

Start the exercise

On workstation, start the exercise. It removes the accounts and the group of an earlier run from servera.

[student@workstation ~]$ lab start sa-accounts

Later tasks assume that you are logged in to the server they name: ssh student@servera from workstation, then sudo -i for a root shell.

Create the group

On servera, open a root shell with sudo -i, and create the group webteam with GID 40000.

[student@workstation ~]$ ssh student@servera
[student@servera ~]$ sudo -i
[root@servera ~]# groupadd -g 40000 webteam

Create alice and bob in the team

Create alice ("Alice Admin") directly in webteam. Create bob ("Bob Builder") first, then add him to webteam afterwards.

[root@servera ~]# useradd -c "Alice Admin" -G webteam alice
[root@servera ~]# useradd -c "Bob Builder" bob
[root@servera ~]# usermod -aG webteam bob
[root@servera ~]# id alice; id bob
uid=1001(alice) gid=1001(alice) groups=1001(alice),40000(webteam)
uid=1002(bob) gid=1002(bob) groups=1002(bob),40000(webteam)
[root@servera ~]# grep webteam /etc/group
webteam:x:40000:alice,bob

Each person keeps a private primary group; webteam is a supplementary group for both.

Create the service account

The application runs as webapp: UID 4000, primary group webteam, comment "Web application", and no interactive logins.

[root@servera ~]# useradd -u 4000 -g webteam -s /sbin/nologin -c "Web application" webapp
[root@servera ~]# grep webapp /etc/passwd
webapp:x:4000:40000:Web application:/home/webapp:/sbin/nologin
[root@servera ~]# su - webapp
This account is currently not available.

Even root can't get a shell as webapp: /sbin/nologin prints that message and exits. Files the application creates belong to webteam, so alice and bob can be given access to them.

Make the -G mistake, and fix it

Bob also needs wheel. Run usermod without -a and look at what happened:

[root@servera ~]# usermod -G wheel bob
[root@servera ~]# id bob
uid=1002(bob) gid=1002(bob) groups=1002(bob),10(wheel)

webteam is gone: -G replaced the list. Put it back:

[root@servera ~]# usermod -aG webteam bob
[root@servera ~]# id bob
uid=1002(bob) gid=1002(bob) groups=1002(bob),10(wheel),40000(webteam)

Look at the home directories

[root@servera ~]# ls -ld /home/alice /home/bob /home/webapp
drwx------. 2 alice  alice   4096 Oct  3 10:36 /home/alice
drwx------. 2 bob    bob     4096 Oct  3 10:36 /home/bob
drwx------. 2 webapp webteam 4096 Oct  3 10:36 /home/webapp

Mode 700 (drwx------): each owner, and nobody else, may enter their home. /home/webapp belongs to the group webteam because that is webapp's primary group.

Grade and finish

Check your work with lab grade sa-accounts, then put the exercise away with lab finish sa-accounts.