Account and Security Administration, and Access Control note, prepared by Hussien M , WU,

KIoT, Computer Science

Chapter 2

Account and Security Administration, and Access Control

(DAC, RBAC)

2.1 Account and Security Administration

Account and security administration refer to the processes, policies, and technologies used to
manage and safeguard user access to resources and services within a system or network. The
goal of account and security administration is to ensure that only authorized users can access the
appropriate resources while maintaining the integrity and confidentiality of the system. This
includes creating, modifying, and deleting user accounts, implementing security policies, and
enforcing access controls to prevent unauthorized access.

In any IT environment, effective account and security management is essential for safeguarding
sensitive information and ensuring the system operates securely. It involves a variety of
administrative tasks, such as:

 Creating and managing user accounts: Defining user roles, permissions, and
responsibilities, assigning specific access rights, and ensuring users can only perform
actions within their granted scope.
 User authentication: Ensuring users can prove their identity when accessing a system,
usually via usernames and passwords, multifactor authentication (MFA), or other
biometric methods.
 Password management: Enforcing policies for password strength, expiration, and
recovery to enhance security.
 Auditing and monitoring: Tracking user activity to detect unauthorized or suspicious
behavior, ensuring compliance with security policies, and maintaining logs for forensic
analysis.
 Enforcing security policies: Implementing rules and guidelines for users to follow, such
as password complexity, access restrictions, and role-based limitations.

Chapter2: Account and Security Administration, and Access Control Note [Date] 1
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

A key aspect of this process is access control, which determines what authenticated users are
allowed to do within a system. Access control is generally enforced via Discretionary Access
Control (DAC) or Role-Based Access Control (RBAC) mechanisms.

2.1.1 User and Group Concepts, and User Private Group Scheme

In any multi-user system, managing user access to resources efficiently requires understanding
both individual user identities and groups of users. The user and group concepts help
administrators organize, manage, and enforce policies for who can access specific resources and
what actions they can perform.

User Concepts:

A user is an individual or system account that has been granted access to a computing
environment. In most systems, a user is identified by a unique username (or user ID), which is
associated with various attributes that define the user’s identity, rights, and privileges.

Key attributes for a user account typically include:

 Username (UID): A unique identifier assigned to a user.

 Home Directory: The directory where user-specific files and configuration settings are
stored.
 Group Memberships: A user can be a member of one or more groups.
 Permissions: The rights a user has to access specific resources (e.g., read, write,
execute).
 Password: The authentication credential used to verify the user's identity.

Group Concepts:

A group is a collection of users who share common access rights to certain resources. Groups
allow for easier management of user permissions because rather than assigning permissions to
individual users, administrators can assign permissions to the entire group. Users within the same
group will automatically inherit the group’s permissions.

Chapter2: Account and Security Administration, and Access Control Note [Date] 2
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

Key elements of group concepts include:

 Group ID (GID): A unique identifier for a group.

 Group Name: The name that identifies the group.
 Group Membership: The list of users who are members of the group.
 Group Permissions: The access rights that are granted to all users in the group for
shared resources.

User Private Group (UPG) Scheme:

The User Private Group (UPG) scheme is a method used in some Unix-like operating systems
(e.g., Linux) to simplify the management of user groups and permissions. In this scheme, each
user is assigned their own private group that is named after their username (e.g., user1 would
belong to a group also named user1).

The UPG scheme works by creating a unique group for each user, and this group is used
primarily for file ownership, ensuring that the user has exclusive rights to their files. Here are the
key features of the UPG:

1. User-Specific Groups: Each user is assigned a unique private group that they own. The
group name matches the user's username.
2. Simplified Group Management: The UPG scheme simplifies group management
because users only belong to their own private group, and no additional groups need to be
manually created or maintained for the individual user. The system administrator doesn’t
need to assign users to multiple groups.
3. File Permissions and Security: Under the UPG scheme, when a user creates files, those
files are automatically assigned to the user's private group. This helps ensure that the user
has the ability to modify their own files without accidentally sharing them with other
users unless specifically granted. This mechanism reduces the risks of unauthorized
access and ensures more fine-grained control over file permissions.

Chapter2: Account and Security Administration, and Access Control Note [Date] 3
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

4. Group Membership and Shared Resources: If users need access to shared resources,
additional groups (often referred to as "secondary groups") can be created, and users can
be added to these groups. However, their private group remains as their primary group.
5. File Access: By default, users can access their files, as well as files within other groups,
depending on the permissions granted. For example, if a user has a file within their
private group and sets the appropriate permissions, only users in that group may be able
to access it.

Example of the UPG Scheme in Action:

In a typical system, a user might have a username like john. When John creates a file, the file's
group ownership will automatically be set to john's private group. This means only John has full
control over his files by default, but if additional users need access, they would need to be given
explicit permissions.

For instance:

 File Created by User john: [Link]

o Owner: john
o Group: john (private group)
o Permissions: rwxr-xr-x (Owner has full access, others have read/execute access)

This system helps ensure that users' private files remain secure and reduces the complexity of
managing groups, especially in large systems with many users.

Benefits of the User Private Group Scheme:

 Security: It isolates user files, making it less likely that unauthorized users will have
access to sensitive data.
 Simplicity: It simplifies group management, especially in large organizations, because
there is no need to create and manage multiple groups for individual users.
 Access Control: It makes file permissions more intuitive, as each user is responsible for
their own files and has clear, limited access to other users’ files.

Chapter2: Account and Security Administration, and Access Control Note [Date] 4
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

Challenges of the UPG Scheme:

 Limited Sharing: It may not be ideal in environments where users frequently need to
share files with others outside their private group.
 Administrative Overhead: In large systems, there may be a large number of groups to
manage, although each is specific to a user.

In conclusion, account and security administration, as well as the understanding of user and
group concepts, plays a crucial role in securing IT systems. The User Private Group scheme is
one effective way to manage user groups and file permissions, simplifying user management
while enhancing security by isolating user-specific resources. When combined with other access
control mechanisms like DAC (Discretionary Access Control) and RBAC (Role-Based Access
Control), administrators can implement fine-grained control over who can access what within a
system.

2.1.2 User Administration, Modifying Accounts and Group Administration

User Administration refers to the process of creating, modifying, and managing user accounts
within an operating system or network. It includes tasks such as adding new users, updating user
information, assigning or modifying permissions, and deleting user accounts when they are no
longer needed. Proper user administration ensures that only authorized individuals have access to
specific resources and that each user has the appropriate level of access.

Group Administration is the process of managing user groups, which are collections of users
who share common permissions or access rights. By grouping users based on their role or
responsibilities, administrators can more efficiently manage access control and assign
permissions to users in bulk.

User Administration Tasks:

1. Creating User Accounts:

Chapter2: Account and Security Administration, and Access Control Note [Date] 5
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

o When an organization hires a new employee or requires a new user account, the
system administrator creates an account using a command or through a system
management tool.
o For example, in Linux, the useradd command is used to create a user account.
The administrator specifies various parameters, such as:
 Username: A unique identifier for the user.
 Password: An initial password, which may require the user to change
upon first login.
 Home Directory: A location on the filesystem that will store the user’s
personal files and settings.
 Group Membership: Assigning the user to one or more groups (including
their private group, if using the UPG scheme).
 Shell: The user’s login shell (e.g., /bin/bash).
 Expiration Date: Optionally, an account can be set to expire after a
certain date.
2. Modifying User Accounts:
o Administrators may need to modify user accounts for various reasons, such as a
change in the user's role, department, or permissions. This can include updating
account information such as the user's full name, password, group memberships,
or home directory.
o In Unix-based systems, the usermod command is used to modify a user’s account.
Common modifications include:
 Changing the username or user ID (UID).
 Updating the user’s primary group or adding/removing secondary groups.
 Modifying the user’s home directory or login shell.
 Locking or unlocking user accounts (e.g., in cases where an employee
leaves the company but the account is temporarily kept disabled).
3. Deleting User Accounts:
o When a user leaves the organization or no longer requires access, their account
needs to be removed to prevent unauthorized access.

Chapter2: Account and Security Administration, and Access Control Note [Date] 6
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

o The userdel command is used to delete a user account, and administrators have
the option to remove the user’s home directory and files as well (e.g., with the -r
option in Linux). It is crucial to consider whether the user’s files should be
preserved, archived, or removed upon deletion.

Group Administration Tasks:

1. Creating Groups:
o Groups allow administrators to assign permissions to collections of users,
streamlining the process of managing access. For instance, a system may have a
group for the IT department, one for marketing, and one for finance, each with
different access to resources.
o Groups can be created with the groupadd command in Unix-like systems. Like
user accounts, groups have unique identifiers (GIDs) and group names.
2. Assigning Users to Groups:
o Users can be assigned to one or more groups, and in systems like Linux, this can
be done using the usermod command or by editing the /etc/group file directly.
For example, adding a user to the admins group grants them administrative
privileges.
3. Modifying Groups:
o An administrator can modify groups by changing their name, GID, or members.
This can be done using the groupmod command in Unix/Linux systems.
4. Deleting Groups:
o Groups that are no longer needed should be deleted to avoid unnecessary clutter
and ensure that permissions remain manageable. The groupdel command
removes a group, but it is important to check if there are any users still associated
with the group.
5. Group Permissions:
o Groups are used to manage permissions for shared resources. For example, a
group might have read/write access to a directory, while other users may have

Chapter2: Account and Security Administration, and Access Control Note [Date] 7
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

only read access. By managing groups effectively, administrators can assign

permissions efficiently across many users.

Example Command for User and Group Administration:

 To create a new user and assign a home directory:

sudo useradd -m -d /home/johndoe johndoe

 To modify a user’s group membership:

sudo usermod -aG admin johndoe

 To delete a user and their home directory:

sudo userdel -r johndoe

2.1.3 Password Aging and Default User Files

Password aging is a feature used to enforce security policies related to the duration of time that
a password remains valid before it must be changed. Password aging helps to reduce the risks
associated with compromised passwords by requiring users to periodically change their
passwords. In addition to password aging, default user files are pre-configured files or settings
that help users set up their environment and maintain security standards.

Password Aging:

Password aging is typically controlled through system settings that determine how often users
must change their passwords, how long before passwords expire, and whether users are notified
in advance of an impending expiration. This is particularly important in environments that need
to comply with security standards or regulations.

1. Password Expiration:

Chapter2: Account and Security Administration, and Access Control Note [Date] 8
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

o In many systems, passwords are set to expire after a certain period. This ensures
that even if a password is compromised, the attacker will not have unlimited
access.
o On Linux systems, password expiration can be controlled using the chage
command or by directly editing the /etc/shadow file. For example,
administrators can set the maximum age of a password (in days), after which the
user will be required to change their password.
2. Password Inactivity:
o If a user does not change their password within the required period, the account
may be locked or disabled until the user resets their password. Administrators can
configure inactivity periods based on security needs.
3. Password Aging Parameters:
o Maximum Age: The maximum number of days a password can be used before it
must be changed.
o Minimum Age: The minimum number of days between password changes to
prevent users from changing their password too frequently (e.g., to bypass
expiration).
o Warning Period: The number of days before a password expires during which
the user is warned to change their password.
o Inactive Period: The number of days after a password expires before the account
is locked.

Example using chage to set a maximum password age:

sudo chage -M 30 johndoe

This command ensures that the user "johndoe" will be required to change their password
every 30 days.

4. Enforcing Strong Password Policies:

o In addition to password aging, administrators can enforce strong password
policies, such as requiring a mix of upper- and lower-case letters, numbers, and

Chapter2: Account and Security Administration, and Access Control Note [Date] 9
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

special characters. Tools like pam_pwquality (Pluggable Authentication Module)

on Linux can be configured to enforce these policies.
5. Locking and Unlocking Accounts:
o As part of password aging, users may have their accounts locked if they fail to
change their password within the specified period. Accounts can be manually
unlocked by administrators using the passwd -u command or similar.

Default User Files:

Default user files provide the initial configuration for a user's environment upon first login.
These files are typically created in the user’s home directory and can include configuration
settings for various tools, utilities, and environment variables. Common default user files
include:

1. .bash_profile, .bashrc (or equivalent for other shells):

o These files define the user’s environment settings, such as the shell prompt,
system paths, aliases, and other configurations.
o When a user logs in for the first time, these files are used to customize the
environment according to the system administrator's preferences.
2. .profile:
o A general shell initialization file used by the Bourne shell and compatible shells
like Bash. It can define environment variables, PATH settings, and startup
commands that should be executed upon login.
3. .ssh/authorized_keys:
o For users who authenticate via SSH, the .ssh/authorized_keys file contains
public SSH keys that allow remote login without requiring a password. Default
files can be created to simplify key management.
4. Skeleton Files (/etc/skel):
o In Unix-like systems, the /etc/skel directory contains template files that are
copied to the home directory of a user when their account is created. These files
include configuration files like .bashrc, .profile, .bash_profile, etc.

Chapter2: Account and Security Administration, and Access Control Note [Date] 10
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

o This allows system administrators to set default configurations for all new users,
ensuring consistency across the system.

Example:

o /etc/skel/.bashrc: A default .bashrc file for newly created users.

o /etc/skel/.profile: A default .profile file for new users’ shell
configurations.

Configuring Default User Files:

System administrators can modify the files in /etc/skel to ensure that newly created users have
the correct environment settings. For example, if all users should have the same aliases and
environment variables, these settings would be placed in the skeleton files.

Summary:

 User Administration involves creating, modifying, and deleting user accounts, while
Group Administration involves managing user groups and assigning permissions to
streamline access control.
 Password Aging helps to enforce security policies by ensuring passwords are changed
regularly, while Default User Files provide initial configuration settings for a user’s
environment. Both password aging and default user files are important for system
security, user management, and ensuring a consistent user experience across the system.

2.2 Managing Files and Folder Permissions

File and folder permissions are a core component of a system's security model, determining
which users or groups can access files and directories and what actions they can perform on
them. The process of managing file and folder permissions ensures that sensitive data is
protected from unauthorized access, modification, and deletion. This is achieved by defining
ownership and permissions, which control the interaction between users, groups, and system
resources.

Chapter2: Account and Security Administration, and Access Control Note [Date] 11
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

Permissions can be managed using different access control mechanisms like Discretionary
Access Control (DAC), where the owner of a file or directory has control over its permissions,
and Role-Based Access Control (RBAC), where permissions are assigned based on roles rather
than individual users.

File Permissions Basics:

In most operating systems, especially Unix-based systems (Linux, macOS), files and folders are
subject to three primary types of permissions:

1. Read (r): Allows the user to read the content of a file or list the contents of a directory.
2. Write (w): Allows the user to modify or delete the file, or add/remove files in the
directory.
3. Execute (x): Allows the user to execute a file (if it’s a program or script), or access a
directory and perform operations such as changing into that directory.

These permissions are typically set for three different entities:

 Owner (user): The individual who owns the file or folder.

 Group: Users who are part of the same group as the file’s owner.
 Others: All other users on the system who are not the owner or part of the owner's group.

Permissions are typically displayed as a string of characters, like this: -rwxr-xr--

Where:

 The first character represents the file type (e.g., - for a file, d for a directory).
 The next three characters represent the owner's permissions (read, write, and execute).
 The next three characters represent the group's permissions.
 The final three characters represent others' permissions.

Managing File and Folder Permissions:

Chapter2: Account and Security Administration, and Access Control Note [Date] 12
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

Permissions can be managed and modified using different commands, such as chmod, chown, and
chgrp in Unix-like systems.

2.2.1 Managing File Ownership

File ownership plays a critical role in managing file access. It determines who has control over a
file, including who can change its permissions. The ownership model is based on the user and
the group associated with a file. A user (the owner) is the person who has full control over a
file, while a group (the group owner) is a set of users who share common access rights to the
file.

In Unix-like operating systems, file ownership is defined by two key attributes:

1. User (Owner) Ownership: The user who created the file or who has been assigned
ownership can perform operations on the file, such as changing permissions, deleting, or
modifying the content.
2. Group Ownership: Each file is also assigned to a group. Users who are members of this
group may have permissions to read, write, or execute the file, depending on the
permissions set.

Ownership of files can be viewed using the ls -l command, which lists files in a directory
along with their owner and group.

Example:

$ ls -l [Link]
-rwxr-xr-- 1 john admin 2048 Mar 20 10:00 [Link]

In this example:

 john is the file's owner.

 admin is the group associated with the file.
 rwxr-xr-- represents the permissions.

Chapter2: Account and Security Administration, and Access Control Note [Date] 13
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

Changing Ownership:

The chown command is used to change the ownership of files and directories. This command
allows administrators to modify both the user (owner) and group associated with a file.

1. Changing the Owner: The syntax for changing the owner of a file or directory is:

sudo chown new_owner file_name

Example:

sudo chown jane [Link]

This changes the owner of the file [Link] to jane.

2. Changing the Group: The syntax for changing the group ownership of a file is:

sudo chown :new_group file_name

Example:

sudo chown :staff [Link]

This changes the group of [Link] to staff.

3. Changing Both the Owner and Group: To change both the owner and the group at the
same time, use:
sudo chown new_owner:new_group file_name

Example:
sudo chown jane:staff [Link]

This change both the owner of [Link] to jane and the group to staff.

Using the chgrp Command:

Chapter2: Account and Security Administration, and Access Control Note [Date] 14
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

The chgrp command is specifically used to change the group ownership of a file or directory
without changing the owner. This command is useful if you need to update the group ownership
but maintain the original file owner.

The syntax for using the chgrp command is:

sudo chgrp new_group file_name
Example:
sudo chgrp developers [Link]
This changes the group associated with [Link] to developers.

Viewing Ownership Information:

To view the ownership of a file, you can use the ls -l command, which displays the file's
permissions, owner, group, and other metadata.
Example:
$ ls -l [Link]
-rw-r--r-- 1 jane staff 1024 Mar 20 11:00 [Link]

This output shows that:

 The owner is jane.

 The group is staff.
 The permissions for the file are rw-r--r--, meaning jane can read and write the file,
while members of the staff group and others can only read it.

Changing Ownership for Directories:

Ownership management applies not only to files but also to directories. When the ownership of a
directory is changed, it can affect access rights to all files and subdirectories within that
directory, depending on the permissions set.

To recursively change the ownership of a directory and all its contents, you can use the -R
(recursive) option with chown.

Chapter2: Account and Security Administration, and Access Control Note [Date] 15
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

Example:
sudo chown -R jane:staff /home/jane

This command changes the ownership of the /home/jane directory and all files and
subdirectories under it, assigning jane as the owner and staff as the group.

Implications of File Ownership:

 Security: Ownership helps define who can modify, read, or delete a file, ensuring that
only authorized users can make changes. Properly setting ownership prevents
unauthorized users from tampering with critical files.
 Collaboration: Group ownership allows a group of users to share access to a file or
directory. For example, a project team might be given group ownership of a shared
directory to collaborate on files.
 Auditability: Ownership is a key component of file auditing. In case of an incident, file
ownership records can help track who created, modified, or deleted files.

Best Practices for Managing Ownership:

1. Minimal Ownership Assignment: Only assign ownership of files and directories to

users who truly need it. This reduces the risk of accidental or malicious changes.
2. Group Ownership for Collaboration: For team collaboration, ensure that the
appropriate group is given ownership to limit access to a smaller set of users who need it.
3. Review Ownership Regularly: Periodically review file ownership to ensure it aligns
with current roles and responsibilities. This helps maintain security as personnel change
over time.
4. Avoid Giving Ownership to Root: It’s generally best to avoid giving the root user
ownership of files unless absolutely necessary, as it could expose the system to greater
risk if the root account is compromised.

Summary:

Chapter2: Account and Security Administration, and Access Control Note [Date] 16
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

File ownership plays an essential role in managing access control in a system. It defines who has
the ability to modify permissions and interact with files and directories. The chown and chgrp
commands in Unix-based systems enable system administrators to manage file ownership, both
for individual files and recursively for directories. By understanding and properly configuring
file ownership, administrators can ensure security and collaborative efficiency while minimizing
unauthorized access.

2.2.2 Controlling Access to Files

Controlling access to files is a crucial aspect of system security, ensuring that sensitive
information is protected from unauthorized users or malicious actors. In most operating systems,
especially Unix-like systems (Linux, macOS), access to files is controlled through file
permissions and access control lists (ACLs). These mechanisms allow system administrators to
define which users or groups can perform specific actions on a file, such as reading, writing, or
executing it.

File Permissions Overview:

Access control on files is typically enforced through three main types of file permissions: Read
(r), Write (w), and Execute (x). These permissions can be applied to the owner, group, and
others, which are the three categories of users who interact with a file.

 Read (r): Allows a user to view the contents of a file.

 Write (w): Allows a user to modify or delete the file.
 Execute (x): Allows a user to execute the file (if it's a program or script) or enter a
directory.

In addition to the standard permissions, Access Control Lists (ACLs) provide a more fine-
grained method of controlling file access by allowing administrators to set permissions for
individual users or groups beyond just the file owner, group, and others.

Managing File Permissions:

Chapter2: Account and Security Administration, and Access Control Note [Date] 17
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

File permissions can be managed using commands like chmod, chown, and setfacl in Unix-like
systems.

1. chmod (Change Mode): The chmod command is used to change the permissions of a file
or directory. Permissions can be set either using symbolic notation (letters) or numeric
notation (numbers).
o Symbolic Notation: This method uses letters to represent the permissions and
assigns them to the file owner, group, or others.
 r = read
 w = write
 x = execute
 + adds permission, - removes permission, and = sets the permission
explicitly.

Example: To add execute permission for the owner:

chmod u+x [Link]

o Numeric Notation: In this method, permissions are represented by a three-digit

number, where each digit corresponds to the permissions for the owner, group,
and others. The permissions are represented by the sum of the values:
 r = 4, w = 2, x = 1

 Example: 7 = rwx, 6 = rw-, 5 = r-x

Example: To set permissions for [Link] so that the owner has full
permissions, the group has read and write permissions, and others have read
permissions:
chmod 764 [Link]

2. Access Control Lists (ACLs): ACLs provide more granular control over file access,
allowing administrators to specify permissions for multiple users and groups on a single
file or directory. ACLs extend the basic file permission model, enabling the specification
of different permissions for different users beyond the file owner, group, and others.

Chapter2: Account and Security Administration, and Access Control Note [Date] 18
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

o Setting ACLs: Use the setfacl command to set or modify ACLs on a file or
directory. Example:
setfacl -m u:john:rwx [Link]
This command grants the user john full read, write, and execute permissions on
[Link].

o Viewing ACLs: To view the ACLs set on a file, use the getfacl command.
Example:
getfacl [Link]

o Removing ACLs: Use the setfacl command with the -x option to remove
ACLs. Example:
setfacl -x u:john [Link]

3. ACLs offer significant flexibility by allowing specific permissions to be granted to users

or groups that do not fit into the traditional owner/group/others model.
4. Restricting File Access Using umask: The umask command sets the default file
permissions when a new file is created. It works by determining which permissions are
not set for a new file. For example, a umask of 022 means that new files will be created
with 755 permissions (rwxr-xr-x) by default, with the owner having full permissions and
others having read and execute permissions.

Example:
umask 027

This ensures that new files will be created with permissions of 750 (rwxr-x---), giving the
owner full permissions, the group read and execute permissions, and others no
permissions.

Best Practices for Controlling File Access:

Chapter2: Account and Security Administration, and Access Control Note [Date] 19
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

1. Principle of Least Privilege: Users should be granted the least amount of access
necessary for them to perform their tasks. This minimizes the risk of accidental or
intentional misuse.
2. Regularly Review File Permissions: File permissions should be reviewed regularly,
especially for sensitive files, to ensure that only authorized users have the necessary
access.
3. Use ACLs for Fine-Grained Control: In situations where, standard file permissions are
insufficient, ACLs provide a powerful mechanism to manage file access on a per-user or
per-group basis.
4. Audit File Access: Use auditing tools to monitor file access, especially for sensitive files.
Monitoring access patterns can help detect unauthorized access or suspicious activities.

2.2.3 Managing Disk Quotas

Disk quotas are a system administration tool used to limit the amount of disk space and the
number of files a user or group can use on a system. This feature helps prevent individual users
from consuming all available disk space, which could negatively affect other users or the overall
performance of the system. Disk quotas are especially important in multi-user environments,
where many users share system resources.

Types of Disk Quotas:

1. Block Quotas: Block quotas limit the total amount of disk space (in terms of data blocks)
a user or group can consume. The system tracks the number of disk blocks a user or
group has used, and once the limit is reached, the user is prevented from writing
additional data to disk.
2. Inode Quotas: Inode quotas limit the number of files a user or group can create on the
system. Inodes are data structures used by the filesystem to store metadata about files.
This type of quota is important because even if a user has available disk space, they may
be unable to create more files if they exceed their inode quota.

Setting Up Disk Quotas:

Chapter2: Account and Security Administration, and Access Control Note [Date] 20
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

1. Enabling Quotas: Quotas need to be enabled on the filesystem level before they can be
enforced. This often involves modifying the /etc/fstab file to include the usrquota or
grpquota options, which enable user or group quotas, respectively.

Example:
/dev/sda1 /home ext4 defaults,usrquota 0 2

2. Creating Quotas: To create and enforce quotas on a filesystem, the following steps are
typically followed:
o First, the system administrator runs the quotacheck utility to scan the filesystem
for usage information.
o The administrator then uses the edquota command to set limits for users or
groups.

Example:
quotacheck -cug /home

This command scans the /home directory for user and group disk usage and creates quota
files.

3. Setting Quotas for Users: The edquota command is used to edit disk quotas for users.
The system administrator can define soft and hard limits:
o Soft Limit: The amount of space or files the user can use before receiving a
warning. If the user exceeds the soft limit, they can still write data but will be
warned.
o Hard Limit: The absolute maximum amount of disk space or files the user can
consume. Once this limit is reached, the user cannot write additional data.

Example:
sudo edquota -u johndoe

This command opens an editor where the administrator can set both the soft and hard
limits for the user johndoe.

Chapter2: Account and Security Administration, and Access Control Note [Date] 21
 Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

4. Viewing Quotas: The quota command can be used to check disk usage and the limits for
a user or group.
Example:
quota -u johndoe
5. Disabling Quotas: To disable quotas, the system administrator can remove the quota
options from the /etc/fstab file and then run the quotaoff command.

Example:
sudo quotaoff /home

Best Practices for Managing Disk Quotas:

1. Set Reasonable Limits: Carefully assess the storage needs of users and set quotas that
allow for adequate disk space while preventing any user or group from monopolizing
resources.
2. Monitor Quotas: Regularly monitor disk usage to ensure that users are not approaching
or exceeding their quotas. Some systems provide automatic alerts when a user is close to
reaching their quota.
3. Use Inode Quotas for File-Heavy Users: For users who work with many small files,
inode quotas are just as important as block quotas to ensure the user does not consume all
available inodes.
4. Apply Group Quotas: If multiple users need similar storage space, consider applying
group quotas, which allows you to set limits on a group of users collectively.

Summary:

 Controlling Access to Files involves managing file permissions through mechanisms

like chmod, Access Control Lists (ACLs), and default permission settings using umask.
These tools allow system administrators to regulate who can read, write, or execute files
and directories, ensuring system security.
 Managing Disk Quotas involves setting limits on the amount of disk space and the
number of files users can consume. By enabling and configuring user and group quotas,

Chapter2: Account and Security Administration, and Access Control Note [Date] 22
Account and Security Administration, and Access Control note, prepared by Hussien M , WU,
KIoT, Computer Science

administrators can prevent users from consuming excessive resources, protecting system
performance and ensuring fair resource distribution.

Chapter2: Account and Security Administration, and Access Control Note [Date] 23