What is access control?
Access control decides who may do what to which resource. Once a system knows who you are, it must still decide what you are allowed to do.
In a shop, an assistant may sell and a manager may change prices. A good rule set gives each person what the job needs and nothing more.
By the end of this lesson
Note
I can decide who may do what, giving each role only what it needs.
Key words
| Word | What it means |
|---|---|
| Access control | rules for who may do what |
| Role | a job that gets a fixed set of rights |
| Permission | the right to do one action on one resource |
| Least privilege | giving only the rights a job needs |
| Separation of duties | no one person can finish a risky job alone |
| Access review | a regular check that rights still fit |
The cells students fill in are left blank in this preview.
A permission has a role, resource and action
Every permission has three parts. A role is who asks. A resource is the thing asked for. An action is what they want to do, such as read, write or delete.
Grouping people into roles keeps the table short. You give rights to the role once. A new member of staff joins the role and gets them.
Worked example: a permission table for a shop
| Role | Orders | Customer list | Price list |
|---|---|---|---|
| Sales assistant | read, write | read | read |
| Manager | read, write, delete | read, write | read, write |
| Intern | read | nothing | nothing |
| Accountant | read | nothing | read |
The cells students fill in are left blank in this preview.
A role on this machine: the sudo group
getent group sudo | cut -d: -f1Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A closed resource: the root account's home folder
stat -c "%a %U %G" /rootShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Least privilege limits the damage of a mistake
Least privilege means each role gets only the rights its job needs. If an account is stolen or a person slips, the harm stops at that account's rights.
To apply it, write down what each role needs. Compare that with what the role has. Remove every right that is extra, and add any that is missing.
Worked example: needs against rights
| Role and resource | Needs | Has | Verdict |
|---|---|---|---|
| Assistant, price list | read | read, write, delete | Two rights too many |
| Manager, orders | read, write, delete | read, write, delete | Matches |
| Intern, customer list | read | nothing | One right missing |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think full access is safe because the staff are trusted. Trust is not the problem. A slip, a stolen password or a virus all act with the rights of the account they land on. The fewer rights the account has, the smaller the harm.
Judge a shared folder against a need
stat -c "%a %U %G" /srv/projectsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask what the folder's users really need
Suppose the folder is for a team who read and write the project files, and nobody else needs to see them.
On a fresh lab machine the Run prints 755 root root. Every user can read the folder and the team cannot write to it. That is too much for outsiders and too little for the team. If you have already changed the folder, judge what you see in the same way.
Duties and reviews keep rights honest
Separation of duties means no one person can finish a risky job alone. The person who asks for a payment is not the person who approves it.
Rights also drift. People change jobs and leave. An access review checks, on a set date, that every account still needs what it has.
Going further
Draw a permission table for a library with three roles: borrower, librarian and administrator. Choose three resources, such as the catalogue, the loans list and the member records.
Mark one pair of duties that no single role should hold together, and say why.