Securing Systems, Managing Access, and Enabling Controlled Privileges
Introduction
Day 3 focuses on one of the most critical responsibilities of a Linux administrator — User Management and Access Control.
In enterprise environments, improper user management can lead to:
Security breaches
Compliance violations
Unauthorized access
Data leaks
Production outages
Whether infrastructure runs on:
Amazon Web Services
Microsoft Azure
Google Cloud
Access governance remains fundamental.
Types of Users in Linux
1️⃣ Root User (Administrator)
2️⃣ System Users (apache, nginx, mysql)
3️⃣ Regular Users (Developers, Support Engineers, Analysts)
User Account Creation & Lifecycle
Creating a User
useradd -g devops -s /bin/bash -c "DevOps Engineer" -m john
Deleting a User
userdel -r john
🏢 Enterprise Scenario: Joiner-Mover-Leaver Process (JML)
In corporate environments:
New joiner → Account created, assigned groups
Role change → Group modified
Exit → Account locked immediately
This ensures compliance and prevents insider threats.
Group Management
groupadd developers
usermod -G developers john
Groups simplify permission management at scale.
🔐 SUDO – Controlled Administrative Access
Instead of sharing the root password, enterprises use sudo to delegate controlled administrative privileges.
Configuration file:
/etc/sudoers
Always edit using:
visudo
🧩 Understanding SUDO Groups
In enterprise Linux systems (especially on Red Hat Enterprise Linux and Ubuntu), administrative access is often managed through sudo groups instead of individual user entries.
Common SUDO Groups by Distribution
| Distribution | Sudo Group |
|---|---|
| RHEL / Rocky / CentOS | wheel |
| Ubuntu | sudo |
Granting SUDO Access via Group (Best Practice)
On RHEL / Rocky
Add user to wheel group:
usermod -aG wheel john
Verify:
id john
In /etc/sudoers:
%wheel ALL=(ALL) ALL
On Ubuntu
Add user to sudo group:
usermod -aG sudo john
In /etc/sudoers:
%sudo ALL=(ALL:ALL) ALL
🏢 Enterprise Scenario: Role-Based Administrative Access
In a production data center:
| Role | Group | Permissions |
|---|---|---|
| DevOps | wheel | Full admin |
| App Support | appadmin | Restart app only |
| DBA | dbadmin | Database control only |
| Security | secops | Log access only |
Instead of assigning sudo privileges per user, administrators assign them to groups.
Example custom sudo group:
%appadmin ALL=(ALL) /bin/systemctl restart app-service
Users in appadmin can restart only that service.
This follows the Principle of Least Privilege (PoLP).
🔎 SUDO with Command Aliases (Enterprise-Level Control)
Example:
Cmnd_Alias USERMGMT = /sbin/useradd, /sbin/usermod
%hrteam ALL=(ALL) USERMGMT
This allows HR automation team to create users but not delete system files.
🏢 Real-World Incident Prevention
Scenario: Preventing Privilege Escalation
An engineer attempts:
sudo iptables -F
Access denied because firewall commands are not permitted in sudo group policy.
Security breach avoided.
Password Aging & Compliance
Using chage:
chage -M 90 -W 10 john
Default settings in:
/etc/login.defs
Used to satisfy compliance frameworks like:
ISO 27001
PCI-DSS
SOC2
Understanding Critical User Files
Updated when useradd runs:
/etc/passwd/etc/shadow/etc/group/etc/gshadow
These files define identity, authentication, and authorization structure.
File Permissions & Ownership
chmod 750 /opt/app
chown appuser:developers /opt/app
🏢 Enterprise Scenario: Shared Application Deployment
Owner → appuser
Group → developers
Others → No access
Ensures controlled collaboration without compromising security.
SSH Passwordless Login (Automation Ready)
ssh-keygen -t rsa -b 4096
ssh-copy-id user@server
🏢 Enterprise DevOps Scenario
CI/CD server connects to 50+ production servers using:
SSH key authentication
Disabled password login
Disabled root SSH
This strengthens security posture.
Enterprise Cloud Security Model
In cloud VMs:
IAM (Cloud-level access control)
OS-level sudo groups
SSH key enforcement
Bastion host access
Root login disabled
This layered security ensures no single point of failure.
Real Enterprise Case Study
🚨 Unauthorized Access Attempt
Alert triggered:
User tried unauthorized sudo command
Audit logs reviewed
Admin checks:
sudo -l username
last
history
Sudo group properly restricted access. No damage occurred.
Day 3 Recap
We covered:
User lifecycle management
Group management
Password policies
/etc/passwd&/etc/shadowFile permissions
SUDO configuration
SUDO groups (wheel / sudo)
SSH passwordless authentication
Enterprise role-based access control
Conclusion
User management is not just technical administration — it is enterprise security governance.
Proper use of:
Groups
Sudo policies
Password aging
SSH key management
Ensures secure, compliant, and scalable infrastructure in both data centers and cloud environments.
No comments:
Post a Comment