Exercise: Secure a web folder

Secure a web folder

• Change owner and group recursively with chown -R.
• Set modes with symbols, octal numbers and the capital X.
• Verify access by acting as different users.

Start the exercise

On workstation, start the exercise. It creates the group webteam (4600), the users maria and john, and the tree /srv/site with an empty index.html and deploy.sh, all owned by root.

[student@workstation ~]$ lab start sa-changing

Later tasks assume that you are logged in to the server they name: ssh student@servera from workstation, then sudo -i for a root shell.

Give it to maria and webteam

Make maria the owner and webteam the group of the whole tree, in one command.

[root@servera ~]# chown -R maria:webteam /srv/site
[root@servera ~]# ls -ld /srv/site /srv/site/html/index.html
drwxr-xr-x. 4 maria webteam 4096 Oct  3 16:12 /srv/site
-rw-r--r--. 1 maria webteam    0 Oct  3 16:12 /srv/site/html/index.html

Restrict it with X

One recursive command should give the owner read and write, the group read-only, others nothing, and keep directories enterable. Which letter protects the directories? Run it and check that the files did not become executable.

[root@servera ~]# chmod -R u=rwX,g=rX,o= /srv/site
[root@servera ~]# ls -lR /srv/site
/srv/site:
total 8
drwxr-x---. 2 maria webteam 4096 Oct  3 16:12 bin
drwxr-x---. 2 maria webteam 4096 Oct  3 16:12 html

/srv/site/bin:
total 0
-rw-r-----. 1 maria webteam 0 Oct  3 16:12 deploy.sh

/srv/site/html:
total 0
-rw-r-----. 1 maria webteam 0 Oct  3 16:12 index.html

Directories got x (so rwx for the owner, r-x for the group); the plain files did not.

Make the script runnable and the page public

Set the script to mode 750 and index.html to 644, with numbers. Check with stat -c '%a %U:%G %n'. Put a line of text in the script, such as echo deployed, and run it as maria.

[root@servera ~]# chmod 750 /srv/site/bin/deploy.sh
[root@servera ~]# chmod 644 /srv/site/html/index.html
[root@servera ~]# stat -c '%a %U:%G %n' /srv/site/html/index.html /srv/site/bin/deploy.sh
644 maria:webteam /srv/site/html/index.html
750 maria:webteam /srv/site/bin/deploy.sh
[root@servera ~]# echo 'echo deployed' > /srv/site/bin/deploy.sh
[root@servera ~]# su - maria -c /srv/site/bin/deploy.sh
deployed

Writing into an existing file with > keeps its mode. The script ran because maria, the owner, has x.

Act as john

john is not in webteam. Predict what he can do, then try to list /srv/site and run the deploy script as him. After that, let others traverse /srv/site and /srv/site/html and read index.html (with o+rX and o+r), and test john again.

[root@servera ~]# su - john -c 'ls /srv/site'
ls: cannot open directory '/srv/site': Permission denied
[root@servera ~]# chmod o+rX /srv/site /srv/site/html
[root@servera ~]# chmod o+r /srv/site/html/index.html
[root@servera ~]# su - john -c 'cat /srv/site/html/index.html && echo ok'
ok
[root@servera ~]# su - john -c /srv/site/bin/deploy.sh
-bash: line 1: /srv/site/bin/deploy.sh: Permission denied

john can read the page now because each directory on the path gives him r-x. The script is still blocked: /srv/site/bin and the script itself give "other" nothing.

Let the group edit the page

Add write permission for the group on index.html only, without touching anything else, then check the mode.

[root@servera ~]# chmod g+w /srv/site/html/index.html
[root@servera ~]# ls -l /srv/site/html/index.html
-rw-rw-r--. 1 maria webteam 0 Oct  3 16:12 /srv/site/html/index.html

Grade and finish

Check your work with lab grade sa-changing, then put the exercise away with lab finish sa-changing.