Everyone can open payroll
A new volunteer joins a charity. On day one they open the payroll folder by accident and see what everybody earns.
Nobody did anything wrong. The folder was open to everyone, and an unneeded service ran on the server. Good set-up closes these doors before the first day.
By the end of this lesson
Note
I can give people roles with the right permissions and close what a system does not need.
Key words
| Word | What it means |
|---|---|
| Network | computers and devices joined together so they can share data |
| Role | a job a person has, such as finance or help desk, which decides their access |
| Group | a list of accounts that share the same permissions |
| Permission | what an account is allowed to read, change or run |
| Hardening | making a system harder to attack by removing what it does not need |
| Air gap | keeping a system with no network link at all, so no attack can reach it from outside |
| Anti-malware | software that finds and removes harmful programs |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
This is practice
Important
The real Task 4a has its own devices and settings screens, and the exam board sets how roles and permissions are shown. Here you run real commands in a Linux lab. Only change the lab. Ask your teacher what the real task lets you configure.
Roles become groups, groups get permissions
Do not give permissions to each person. Make a group for each role. Put people in the groups. Give the groups the permissions.
When Amina joins the finance team, she joins the finance group. One step gives her everything that role needs and nothing more.
Make two groups
sudo groupadd -f finance; sudo groupadd -f helpdeskA command for the lesson’s lab terminal. It is shown here and not run.
Make two people and put them in groups
sudo useradd -m -G finance amina; sudo useradd -m -G helpdesk bilalA command for the lesson’s lab terminal. It is shown here and not run.
If the users already exist
Tip
The last command says the user exists if you have run it before. That is fine. Carry on with the next command.