Unit 2: Permissions, Processes, Services, SSH, and Logs - Subjective Questions

Linux file system permissions control who can access files and directories and what operations they can perform.

Permissions are assigned to three categories:

• Owner (u): The user who owns the file or directory.
• Group (g): Users belonging to the group associated with the file.
• Others (o): All other users on the system.

The three basic permissions are:

• Read (r):
  • For a file, permits viewing its contents.
  • For a directory, permits listing its entries.
• Write (w):
  • For a file, permits modifying its contents.
  • For a directory, permits creating, deleting, or renaming entries, normally when execute permission is also present.
• Execute (x):
  • For a file, permits running it as a program or script.
  • For a directory, permits entering or traversing it and accessing known entries.

For example, -rwxr-xr-- means:

• The owner has read, write, and execute permissions.
• The group has read and execute permissions.
• Others have read permission only.

Linux checks the applicable permission class based on the effective user ID and group membership of the process requesting access.

The ls -l command displays detailed information about files and directories. A typical entry is:

-rwxr-x--- 1 alice developers 4096 Jun 10 10:30 deploy.sh

Its fields are interpreted as follows:

• File type and permissions (-rwxr-x---):
  • The first character indicates the file type.
  • - means regular file, d means directory, l means symbolic link, b means block device, and c means character device.
  • The next three characters are owner permissions.
  • The following three are group permissions.
  • The final three are permissions for others.
• Link count (1): Number of hard links to the inode.
• Owner (alice): User that owns the file.
• Group (developers): Group associated with the file.
• Size (4096): File size in bytes.
• Timestamp (Jun 10 10:30): Normally the last modification time.
• Name (deploy.sh): File or directory name.

In this example, the owner has rwx, the group has r-x, and others have no permissions.

The chmod command changes file or directory permissions using either symbolic notation or octal notation.

Symbolic notation

Symbolic notation uses:

• u for owner
• g for group
• o for others
• a for all classes
• + to add permission
• - to remove permission
• = to set an exact permission

Examples:

• chmod u+x script.sh adds execute permission for the owner.
• chmod g-w report.txt removes group write permission.
• chmod o=r file.txt gives others read permission only.
• chmod a+r document.txt adds read permission for everyone.

Octal notation

Each permission has a numeric value:

• Read = 4
• Write = 2
• Execute = 1

The values are added for each permission class. For example:

• 7 = 4 + 2 + 1, meaning rwx
• 6 = 4 + 2, meaning rw-
• 5 = 4 + 1, meaning r-x
• 0 means ---

Thus, chmod 754 script.sh sets:

• Owner: 7, or rwx
• Group: 5, or r-x
• Others: 4, or r--

Symbolic notation is convenient for changing selected permissions, whereas octal notation is concise when setting the complete permission mode.

Every Linux file has a user owner and a group owner. Ownership determines which owner and group permission bits apply.

Using chown

The chown command changes the user owner, group owner, or both:

• chown alice file.txt changes the owner to alice.
• chown alice:developers file.txt changes the owner to alice and group to developers.
• chown :developers file.txt changes only the group.

Using chgrp

The chgrp command changes only group ownership:

• chgrp developers file.txt

Recursive changes

The -R option applies ownership changes recursively:

• chown -R alice:developers /project

This affects the directory and its contents, so it must be used carefully.

Important considerations

• The superuser can normally assign files to any user or group.
• An ordinary user can usually change the group of a file only to a group of which that user is a member.
• Symbolic links require careful handling; options such as -h may be used when ownership of the link itself must be changed.
• Ownership can be verified using ls -l, stat, or find.

Linux provides three special permissions in addition to read, write, and execute permissions.

Set-user-ID or SUID

• Applied to executable files.
• The process runs with the effective user ID of the file owner rather than that of the user who started it.
• It appears as s in the owner's execute position.
• It is set using chmod u+s file or an octal mode beginning with 4, such as chmod 4755 file.
• SUID programs must be secured carefully because defects may allow privilege escalation.

Set-group-ID or SGID

• On an executable file, the process runs with the effective group ID of the file's group.
• On a directory, newly created entries normally inherit the directory's group, which is useful for shared project directories.
• It appears as s in the group execute position.
• It is set using chmod g+s directory or a mode such as chmod 2770 directory.

Sticky bit

• Commonly applied to shared writable directories.
• Users can delete or rename only entries they own, unless they own the directory or have suitable administrative privileges.
• It appears as t in the others execute position.
• It is set using chmod +t directory or a mode such as chmod 1777 directory.
• /tmp is a standard example.

An uppercase S or T indicates that the special bit is set while the corresponding execute permission is absent.

umask, or user file-creation mode mask, removes selected permission bits from the application's requested mode when a new file or directory is created.

Common initial permission sets are:

• Regular files: 666, representing rw-rw-rw-
• Directories: 777, representing rwxrwxrwx

The final mode is obtained by clearing the bits specified by the mask. Conceptually:

final mode = requested mode with umask bits removed

For a umask of 022:

• Files normally become 644, or rw-r--r--.
• Directories normally become 755, or rwxr-xr-x.

For a umask of 027:

• Files normally become 640, or rw-r-----.
• Directories normally become 750, or rwxr-x---.

Useful commands include:

• umask to display the current mask in octal form.
• umask -S to display it symbolically.
• umask 027 to set it for the current shell and its child processes.

Persistent values may be configured in shell startup files or system authentication configuration. The umask does not add permissions that the creating application did not request.

Traditional permissions provide only one owner entry, one group entry, and one entry for others. POSIX Access Control Lists, or ACLs, allow permissions to be assigned to additional named users and groups.

Viewing ACLs

The getfacl command displays the ACL of a file:

• getfacl report.txt

The output can include the owner, owning group, named-user entries, named-group entries, a mask, and permissions for others.

Setting ACLs

Examples include:

• setfacl -m u:bob:rw report.txt grants bob read and write access.
• setfacl -m g:auditors:r report.txt grants the auditors group read access.
• setfacl -x u:bob report.txt removes the ACL entry for bob.
• setfacl -b report.txt removes extended ACL entries.

ACL mask

The ACL mask limits the effective permissions of named users, named groups, and the owning group. Therefore, an ACL entry may display more permissions than are effectively available if the mask is restrictive.

Default ACLs

A directory can have a default ACL that is inherited by newly created entries:

• setfacl -m d:g:developers:rwx /project

ACLs are particularly useful for shared directories where multiple users and groups need different access levels.

A process is a running instance of a program. It has allocated resources, a security context, open files, environment variables, and scheduling information.

Important process attributes include:

• PID: A unique process identifier.
• PPID: The PID of the process that created the process.
• UID and GID: User and group identities under which the process operates.
• Command: The executable and arguments associated with the process.
• Priority and nice value: Values that influence CPU scheduling.

Common process states include:

• R: Running or runnable.
• S: Interruptible sleep.
• D: Uninterruptible sleep, often waiting for I/O.
• T: Stopped or traced.
• Z: Zombie, meaning the process has exited but its parent has not yet collected its status.

Most processes are created by another process, producing a parent-child relationship. Modern Linux systems typically use systemd as PID 1, which starts and supervises many system processes.

The nice value generally ranges from -20 to 19. A lower value indicates a higher scheduling priority. Commands such as nice and renice adjust this value, subject to privilege restrictions.

Job control is a shell feature used to manage multiple commands started from the same interactive shell.

Foreground jobs

A foreground job has control of the terminal and receives keyboard input. Normally, the shell waits until it finishes.

Background jobs

A command can be started in the background by appending &:

• long_command &

The shell returns a job number and process ID and displays a new prompt.

Suspending and resuming jobs

• Ctrl+Z sends a terminal stop signal and suspends the foreground job.
• jobs lists jobs known to the current shell.
• bg %1 resumes job 1 in the background.
• fg %1 brings job 1 to the foreground.

Job specifications such as %1 refer to shell job numbers, not necessarily process IDs.

Continuing after logout

A process may receive SIGHUP when its terminal session closes. nohup makes a command ignore this signal:

• nohup long_command >output.log 2>&1 &

For long-running administrative work, terminal multiplexers or properly defined systemd services may provide stronger session and supervision capabilities than basic job control.

Linux controls processes by sending them signals. Despite its name, kill can send any specified signal.

Commands

• kill PID sends SIGTERM to a process by PID.
• kill -SIGNAL PID sends a selected signal.
• pkill pattern signals processes whose names or attributes match a pattern.
• killall name signals processes with the specified command name.
• kill -l lists available signals.

Important signals

• SIGTERM or signal 15:
  • Requests orderly termination.
  • Can be caught or handled by the process.
  • Allows cleanup of files and resources.
  • Should normally be attempted first.
• SIGKILL or signal 9:
  • Terminates a process immediately.
  • Cannot be caught, blocked, or ignored.
  • May cause incomplete writes or leave application data inconsistent.
• SIGHUP or signal 1:
  • Historically indicates terminal disconnection.
  • Many daemons interpret it as a request to reload configuration.
• SIGINT or signal 2:
  • Usually sent by Ctrl+C to interrupt a foreground process.

A safe termination sequence is to identify the correct process, send SIGTERM, wait and verify, and use SIGKILL only if the process does not stop.

Process monitoring combines snapshot commands, interactive tools, and system information interfaces.

Important tools

• ps aux displays processes in a BSD-style format.
• ps -ef displays processes in a full-format listing.
• top provides an interactive, continuously updated view.
• pgrep name finds process IDs matching a name or criteria.
• pidof program finds PIDs of a program.
• pstree displays parent-child relationships.
• free -h summarizes memory usage.
• uptime reports load averages.
• /proc/PID/ contains process-specific kernel information.

Investigation procedure

1. Run uptime or top to examine system load.
2. Sort processes by CPU or memory consumption in top, or use commands such as ps aux --sort=-%cpu and ps aux --sort=-%mem.
3. Verify the PID, owner, state, runtime, and command arguments.
4. Examine process relationships with pstree or ps PPID fields.
5. Inspect relevant application and system logs.
6. Determine whether the issue is CPU saturation, memory pressure, I/O waiting, or a blocked process.
7. Correct the underlying problem, adjust priority if appropriate, or terminate the process safely.

Load average is not identical to CPU percentage; it reflects runnable tasks and tasks in certain uninterruptible states over time.

systemd is the service and system manager used by many Linux distributions. It runs as PID 1 and manages system startup, services, dependencies, and system state.

Units

A unit is a resource managed by systemd. Common unit types include:

• .service for services and daemons
• .socket for socket-based activation
• .target for grouping units and representing system states
• .timer for scheduled activation
• .mount for file-system mount points
• .path for path-based activation

Targets

Targets group related units. For example, multi-user.target commonly represents a non-graphical multi-user environment, while graphical.target adds graphical services.

Dependencies and ordering

Unit directives can express:

• Requirement relationships, such as Requires= and Wants=
• Ordering relationships, such as After= and Before=

Requirement and ordering are distinct: a unit may be ordered after another without requiring it.

Enablement

• systemctl enable unit creates the links required for a unit to be started through its target or another activation mechanism.
• systemctl disable unit removes those enablement links.
• systemctl is-enabled unit reports its enablement state.

Enabled does not necessarily mean currently running, and a running service is not necessarily enabled for future boots. Automatically started processes can be investigated with systemctl list-unit-files, systemctl list-dependencies, and systemctl status.

The systemctl command manages services and other systemd units.

Runtime control

• systemctl start service starts a service in the current boot.
• systemctl stop service stops it.
• systemctl restart service stops and starts it again.
• systemctl reload service asks it to reread configuration without a full restart, if supported.
• systemctl reload-or-restart service reloads when possible and otherwise restarts.

Boot-time control

• systemctl enable service configures the service to start through its defined boot dependencies or activation mechanism.
• systemctl disable service removes that enablement.
• systemctl enable --now service both enables and immediately starts it.
• systemctl disable --now service disables and stops it.

Masking

• systemctl mask service prevents the unit from being started manually or as a dependency by linking it to /dev/null.
• systemctl unmask service removes the mask.

Inspection

• systemctl status service shows state, PID, recent logs, and failure information.
• systemctl is-active service checks runtime state.
• systemctl is-enabled service checks enablement.
• systemctl list-units --type=service lists loaded service units.
• systemctl daemon-reload rereads unit files after they have been modified; it does not itself restart the service.

Secure Shell, or SSH, provides encrypted remote login, command execution, and file-transfer capabilities.

Basic connection

• ssh server.example.com connects using the local username.
• ssh alice@server.example.com connects as user alice.
• ssh -p 2222 alice@server.example.com uses TCP port 2222 instead of the default port 22.

Host verification

On the first connection, the client displays the server's host-key fingerprint. The user should verify this fingerprint through a trusted channel before accepting it. Accepted host keys are normally stored in ~/.ssh/known_hosts.

If a known host key unexpectedly changes, SSH warns about a possible server rebuild, address reuse, or man-in-the-middle attack. The warning should be investigated rather than bypassed blindly.

Remote command execution

A single command can be run without opening an interactive shell:

• ssh alice@server.example.com hostname

Secure file transfer

• scp file.txt alice@server:/home/alice/ copies a file over SSH.
• sftp alice@server starts an interactive secure file-transfer session.
• rsync -e ssh can efficiently synchronize files over an SSH transport.

The SSH client can also use options stored in ~/.ssh/config to define aliases, usernames, ports, and identity files.

SSH key-based authentication uses an asymmetric key pair instead of, or in addition to, a password.

1. Generate a key pair

A user can create a modern key pair with:

• ssh-keygen -t ed25519

The command creates:

• A private key, such as ~/.ssh/id_ed25519
• A public key, such as ~/.ssh/id_ed25519.pub

A strong passphrase should normally protect the private key.

2. Install the public key

The public key can be copied to the remote account with:

• ssh-copy-id alice@server.example.com

It is placed in the remote user's ~/.ssh/authorized_keys file.

3. Set secure permissions

Typical permissions are:

• chmod 700 ~/.ssh
• chmod 600 ~/.ssh/authorized_keys
• chmod 600 ~/.ssh/id_ed25519

Ownership must also belong to the correct user.

4. Test authentication

Connect with:

• ssh alice@server.example.com

If a nondefault key is used, specify it with ssh -i path/to/key or configure IdentityFile in the SSH client configuration.

Security roles

• The private key remains secret on the client and must never be distributed.
• The public key may be copied to remote systems.
• The server verifies that the client possesses the matching private key.
• ssh-agent can securely cache decrypted private keys during a login session.

Password authentication should be disabled only after key authentication has been tested in a separate active session.

The OpenSSH server is configured primarily through /etc/ssh/sshd_config and, on some systems, included configuration fragments.

Important security directives

• PermitRootLogin no prevents direct root login.
• PasswordAuthentication no disables password authentication after key authentication is confirmed.
• PubkeyAuthentication yes permits public-key authentication.
• AllowUsers alice admin restricts login to listed users.
• AllowGroups sshusers restricts login to selected groups.
• MaxAuthTries limits authentication attempts per connection.
• PermitEmptyPasswords no rejects empty passwords.
• X11Forwarding no disables X11 forwarding if it is not required.
• AllowTcpForwarding no can disable TCP forwarding when unnecessary.
• ClientAliveInterval and ClientAliveCountMax can detect inactive or unresponsive sessions.

Changing the listening port can reduce automated noise but is not a substitute for strong authentication and firewall controls.

Safe configuration procedure

1. Back up the current configuration.
2. Keep an existing administrative SSH session open.
3. Edit the configuration carefully.
4. Validate syntax with sshd -t.
5. Reload or restart the SSH service using systemctl.
6. Test a new connection in a separate terminal.
7. Review service status and authentication logs.
8. Configure the firewall and security controls to allow the selected SSH port.

Access restrictions, key-based authentication, timely updates, and log monitoring provide stronger protection than relying on a port change alone.

Linux logging collects messages from the kernel, services, applications, and authentication components so that administrators can troubleshoot and audit the system.

Message sources

Log records may originate from:

• The Linux kernel
• System services and daemons
• Applications
• Authentication and authorization components
• The systemd service manager
• Standard output and standard error of systemd services

systemd-journald

systemd-journald collects structured journal records. It stores metadata such as unit name, process ID, user ID, priority, boot ID, and executable path. The journal is queried with journalctl.

Syslog services

A syslog daemon such as rsyslog can:

• Receive messages from local facilities and priorities.
• Filter and route records.
• Write messages to traditional text files.
• Forward logs to a remote log server.

Depending on configuration, messages collected by journald may also be made available to a syslog daemon.

Traditional log files

Text logs are commonly stored below /var/log. Exact file names vary by distribution. Examples may include general system messages, authentication events, mail logs, and cron logs.

A complete architecture may therefore include applications sending messages to journald or syslog, journald storing structured records, rsyslog writing selected messages to text files or remote destinations, and logrotate managing file size and retention.

Traditional syslog records are generally stored as text files under /var/log, although exact locations depend on the distribution and configuration.

Reviewing logs

Useful commands include:

• less /var/log/messages or less /var/log/syslog
• tail -f logfile to follow new records
• grep pattern logfile to search for matching records
• zgrep pattern logfile.gz to search compressed rotated logs

Authentication events may be stored in files such as /var/log/secure or /var/log/auth.log.

Facilities and priorities

A syslog selector commonly combines:

• A facility, such as auth, cron, daemon, kern, mail, or local0
• A priority, such as debug, info, notice, warning, err, crit, alert, or emerg

Rules route selected messages to files, devices, users, or remote servers.

Rotation

logrotate prevents log files from growing without limit. It can:

• Rotate logs by time or size
• Retain a specified number of old files
• Compress older files
• Create replacement files with defined ownership and permissions
• Run commands after rotation when a service must reopen its log file

Remote logging

Centralized logging sends records to a remote server, improving monitoring and reducing the risk that an attacker can erase all evidence from a compromised host. Transport security, access control, time synchronization, and retention policies should be considered.

journalctl queries records stored by systemd-journald.

General inspection

• journalctl displays available journal records.
• journalctl -r shows newest records first.
• journalctl -f follows new messages in real time.
• journalctl -n 50 displays the most recent 50 records.

Filtering by service or process

• journalctl -u sshd.service shows records for the SSH service.
• journalctl _PID=1234 filters by process ID.
• journalctl _UID=1000 filters by user ID.

Filtering by boot

• journalctl -b shows the current boot.
• journalctl -b -1 shows the previous boot when retained.
• journalctl --list-boots lists recorded boots.

Filtering by time

• journalctl --since today
• journalctl --since "2025-01-10 08:00:00" --until "2025-01-10 10:00:00"

Filtering by priority

• journalctl -p err shows error and more severe messages.
• Priority names include emerg, alert, crit, err, warning, notice, info, and debug.

Additional useful forms

• journalctl -k shows kernel messages.
• journalctl -xe displays recent records with explanatory information when available.
• journalctl -o verbose displays extensive structured metadata.

Multiple filters can be combined, for example journalctl -u sshd.service -b --since today.

The systemd journal may use volatile storage under /run/log/journal, which is lost at reboot, or persistent storage under /var/log/journal.

Enabling persistent storage

A common procedure is:

1. Create the persistent journal directory if it does not exist:
   • mkdir -p /var/log/journal
2. Apply appropriate systemd temporary-file rules where required:
   • systemd-tmpfiles --create --prefix /var/log/journal
3. Configure /etc/systemd/journald.conf with:
   • Storage=persistent
4. Restart systemd-journald or reboot, following distribution guidance.

With Storage=auto, persistence is commonly used when /var/log/journal exists; otherwise, volatile storage may be used.

Size and retention management

Relevant settings may include:

• SystemMaxUse= to limit total persistent journal usage.
• SystemKeepFree= to reserve free disk space.
• SystemMaxFileSize= to limit individual journal files.
• MaxRetentionSec= to limit retention by age.

Administrative commands include:

• journalctl --disk-usage to view journal disk use.
• journalctl --vacuum-size=500M to reduce archived usage to approximately the specified size.
• journalctl --vacuum-time=30d to remove archived records older than the specified period.
• journalctl --verify to check journal file consistency.

Persistence can be confirmed after a reboot using journalctl --list-boots and journalctl -b -1.