In this video, you'll learn all about groups and how they
are managed inside Linux.
Our plan is to learn some Basics about groups. You will create
a new group called engineering for use on your Linux host. You
will add a Kira from the last video to this new group.
You would change the group permissions of this directory
and test group access using the career user.
Okay, let's get started.
Okay. So here we are back in the terminal and
we're gonna go ahead and create a new group called engineering and
we're gonna do some management and
access control with this group. But before
we dive into that when you're doing any kind of group management on
Linux, there are definitely a few commands that you're going
to use the most so I'm gonna give you a few of them
this obviously some more but these are the most important. So the
First Command you're going to use is called group AD and this
does exactly what it says. It adds a group. The next
one is group delete. So does the
opposite of that it removes a group?
And there's the group mod which will allow you
to modify groups. So this will basically allow to change the group ID,
or maybe if you mistyped the name and you get
to redo it, we will not be demoing this command
in this video, but just to know it's there in case you do actually
have a typo when you create the group.
The other one of the group commands we're going to use is called group mems and
this allows you to adjust the
membership of a group meaning ad and
removing users and actually being able to view them in the
last command that we're going to use is called the change
group command or chtrp and this
allows you to change the group of a filer directory.
Okay, so just like with creating
users creating groups requires elevated permissions.
So we'll be using sudo with a lot of our commands here.
So if some reason you're going through this tutorial and
you get a permission denied most likely
is because when you're running the group command you weren't
prefacing with sudo. All right, so let's get started. So
we're gonna create our Engineering Group and we're gonna use
sudo of course and we're gonna use the group AD command.
Followed by the name of the group. We want to create and this one
is called engineering.
So as with the password as
with users that were kept in a password file under
the Etsy directory groups are the
same thing and they are kept under a file called
ET slash Etc slash group. And so
let's go ahead and look at that now.
And as you see way down here at the bottom.
We could see our new group called engineering and so
not not unlike the
password file. There's a format here that is called colon separated.
And if you go in the first field here, it's the name of
the group, which is engineering. The second field here. Is this
x which is if there was a password it's not
really used but it's still here to denote and then that
X is there for a placeholder. The next field is
the unique group ID and as you can see there Auto
incrementing, so if we added another group, maybe 10003 and
then this last field which you can't see
is the comma separated list of
its members and as you can see up here, this is what
it looks like. If you look at the system D Journal group, you can
see that ec2 is a member of that group, okay.
So we have an idea of what that looks like. So let's
go ahead and let's add our first member to
our new group. So we're going to use the pseudo command once
again.
And in this case we're going to use the group mems command
and the group mems command is takes a
dash a flag with the name of the user and then
a dash G flag of the group name.
So there's no error, but let's still validate our work and we
can scroll back up and use the same command. But instead
of using a dash a Akira we can do a dash L which
lists the members of the group and as
you can see here, the member is now Akira of
this group. We can further validate this
by looking in our slash Etc slash group file,
and we could come down here.
And as you can see Akira is now a member
of this Engineering Group. Okay, so let me
clear the screen. And now that we have our group and
the user social group. The next thing to do is we need to apply it
to something. So what we're going to do is we're gonna reuse the engineering directory
that is in the home of ec2 user
that we already created. And so what we're going to do is we're gonna
move that to a place where a lot
of common shared executables and other data is
stored and that is under slash user slash local.
And so once again, we're gonna need elevated privileges. So
we need to use sudo we're going to use the MV command
again.
And what we're going to do is we're going to use tell it
the
Source, which is a file directory that we want to
move and then now we need a destination. And
in this case, it is slash user slash local so
I didn't return.
and
no errors, but let's double check that
it is actually there. So we'll go
ahead and look under our user local again. And so as you
can see it moved it here.
this time though it carried the permissions that it already had
from it, which was the group was ec2 user and the
owner was ec2 user and
as you remember
By looking here the permissions on User Group
means that they have full permissions. They can read right next cute
for user and group. So that is
a good start. But obviously we want to lock this
directory down. So one things we're gonna do is we're gonna
change the user and we're gonna change the group
of this directory. So
we'll change the group first. I'm gonna show you two ways to
do this we could do with just one command, but I'll show you two is
so the first thing we're gonna do is we're gonna use the CH grp
command which is change group.
We give it the group name. We want to
what we want to change to and then we give it a path to
the file or directory.
And we do that.
And if we turn we have no errors and so
let's go ahead and look again. And as you can see now engineering
is now the group of the
engineering directory. So this basically
means anybody in the engineering directory can now read write
or execute any files in there. But we still have a
problem ec2 user is still a owner of this
directory is still the user and we want it to be a little bit
more locked down. We want the Akira user to be able to be able
to read right and execute this directory, but not the ec2 user.
So to do that we're going to use this command called change
ownership or Chown chowm and
what this does is it takes a user and
then a group with the colon separated
between them and then a path to
a file or directory in our case. It'd be the engineering.
and so what we want to do here is we want
to change everything that
this also takes a flag.
That is worth doing and this is the capital r and this is
recursive. So not only will it change all the
permissions of the directory, but it'll change
all the permissions the ownership. Sorry the ownership and group
of the file under the files inside
the directory.
So we'll go ahead and do that. And so let's
go ahead and look at it now and as you
can see
root is now the user of this directory engineering
is the group of this directory and Engineering itself.
And so if I tried to peek into the
directory itself, let's see the files and
if you remember we had the config Dot yaml and the contributors file
now, they're both owned by root and group
engineering.
So if to test this out, we
would want to see you know, clear the screen really quick. We'd want
to see if the ec2 user could actually create a file in there. And so
what we're gonna do is we're gonna just try to touch a file touch
a file inside engineering and I'm
gonna just call this one ec2 user.
for a lack of imagination
and what you see here is a permission denied and that
makes sense because
Are engineering directory?
Is now gated by a user and
a group. So if you're not that user or that group, you can't
do much but read or list the
files basically inside that directory. That's the rnx right
there.
Okay, so to test this out that we've fully made
this gated we'll need to log back in as
the carry user and test that this works and we're
gonna back we'll have to use the sudo and we'll use the SE. I mean,
sorry, we're gonna use the Su command and make sure you have the password handy.
Okay, so clear the screen.
And then we are going to say Akira.
We're gonna use the Su command Dash secure and then
prompted for our password for Kira and to
that in and of course I mistyped it.
So we'll try it one more time.
And here I am there I am
logged back in a secure. And so what we're going to try to
do is we're gonna touch a file inside the engineering directory called
Akira.
And as you see we don't get the permission denied because
Akira is a member of the Engineering Group.
Okay. So let me log back out
of the Akira user. I'll clear the screen once
again and there we have it. So we have our our crash
course on group management inside Lenox. So let's
jump back over and we'll do a quick recap of what we did.
Okay, so we did quite a bit
in this video you learned about groups and how
you can manage them inside Linux you use different commands
like group AD change ownership change
group and then the group
mod command we didn't use but you could use that to modify and we
didn't use the group to lead as well because obviously we wanted to
keep the group around you added the Akira user to
the engineering group and you change permissions on a directory to
test access.
In the next video, you will learn about software management
inside Linux. See you soon.