General :: Understanding Ubuntu User / Group Permissions
May 20, 2010
I'm beginning to deal with more than one user on my system (it's a VPS serving some sites) and I need to make sure I understand how group permissions work. I have an account named "admin" .. it's basically the primary account that is used for serving most of the sites that I control myself. Now, I added a second account named "Ville" as one of my users wants to be able to administer that site. So, I can do this the easy way and just chown their domains folder under the ville user, they have permission to do whatever they need be and so forth. However, let's say I want to also give the admin user access to the files (modifying and all) .. how can I put both users into the same group and give them both permission?
I've tried doing:
sudo usermod -a -G admin ville
To add the ville into the admin group, but ville still cannot edit files by admin. Permissions for the primary directory for the ville user are read/write for both owner and group, and the current group for the files is admin:admin ..
But ville still can't write into the directory. So, what should I be doing here to get this right and secure at the same time?
I am doing rhce course but i am very confused to answer these user and group permissions.the questions are like this...the owner of the /data must be user tom.primary group of /data must be the group sysadmins.the members of the group test must be able to write and create files in the /data.the members of the group web have no access to these directory.the user jack not belong to any of these gropus must have to edit files created in /data.the user tim can only list the contents.
the questions are always like these..i am okay with sgid and sticky bit.but i dnt know where to set default acl and other permissions.
After I edit /etc/group and I add a user to groups it didn't belong to, the user will not be able to use it's newly acquired privileges unless it starts a new session. Is there a command to refresh user/group properties in an ongoing session?
My main account 'dave' runs as admin etc This was the output of 'groups dave': dave adm dialout cdrom plugdev lpadmin sambashare admin I was trying to add dave to the user group 'media-www' and i ran this command: 'usermod -G media-www dave' Then after another 'groups dave': dave : dave media-www It seems to have removed all the other groups! How do I restore this?
i want secondary users can able to change the files permissions of primary group?user MAC is having www as a primary and httpd as secondary group. But he want to change the file permissions (chmod) httpd group files. Is it possible or not? I think its not possible. If it`s possible then let me know how?
I am very new to linux. The first time i ran a linux machine was one Saturday. Anyway I am trying to set up an apache web server, all I want to do is play around with html and post it on my unbuntu server so it is available to the internet. I am also trying to install samba but I am having trouble with that so for now I am using winscp. Ok, so I made a folder in my home directory for webstuff, and set up apache to look in that folder.
mkdir /home/username/webstuff I put my index.html file into the /webstuff folder. But when I go to my website, it says 403 error unable to access "/"
Did I make the folder in the right place? I do not want people being able to access my / folder so maby I made the web stuff folder in the wrong place? Also I thought I would just put my inded.html file inside of the default one apache gives you, but when I tried to transfer index.html it said permission denied. How to set up permissions so I can use apache and transfer my html files from my remote desktop to my server would be great!
In my /var/www directory, I have everything set up with: user: www-data group: developers directories: chmod 570 files: chmod 460
Everything seems fine. Users from the developers group can edit files and all, but now we began using the Git repository, and whenever a user edits a file (ie. Joe who is a developer,) file permissions get screwed again. Now they're: user: Joe group: Joe directories: chmod 755 files: chmod 644 How can I fix this so permissions remain the same?
On Windows, you can go to a file's permissions and it's clearly stated who can do what. You can choose between individual users or groups such as 'everyone' or certain types of users such as 'domain users'. You could create a clear cut list of every single user/group on the system and what their permissions for a file are and have it neatly displayed in a list.On Unix, we have octal permissions and sticky bits. I understand the whole concept of rwxrwxrwx (777). The first three are what the file owner can do, the second is what the main group the user belongs to can do, and the third is what other users can do.
But, when you view a file's permissions you are only getting the permissions as they apply to the user that owns the file. For example, as I understand it, if I viewed a file that only the root user had rwx permissions on and everyone else could only read. The permissions would show up as rwxr--r-- (744). But, those same permissions would show up to any user as 744 as well. Since the last 3 characters are what applies to "other users" (pretty vague). How would someone know what users in particular those permissions apply to? There could be one "other user" that can rwx that file and another "other user" that can't.Also, why just stop with the main group? What about other groups? A the user Foo's main group he belongs to might be Foo. But he could also belong to the groups Boo and Zoo, which belong to other users and would give him full rwx permissions over Boo and Zoo's files just as if he were Boo or Zoo.
Then you have the whole sticky bit thing that makes it so that files can be owned by the same person and at the same time be made use of (to varying degrees) by other users. To chmod the UID you'd chmod 2777 or for GID 4777 (just an an example). I did this for a file and it allowed a standard user account who was previously unable to run the command to be able to run it. But, how can that work when I didn't anywhere specify what particular user (or groups of users) that sticky bit applies to?
I'm confused about this whole thing to the point that I'm not even sure exactly what questions I should be asking or even if my examples are even 100% correct. I just sort of ranted about some specific things that floated to the top of my head. Permissions are easy to understand when your running a Unix-like system on a single user desktop. Because the only users/groups you have are root, the single user, and various system users/groups that you don't really need to worry about. So a file with rwxr--r-- means that only the Root user (not even members of his group) can edit the file and you can't unless you use sudo. Because the "other user" in the last 3 characters always just means you. But, things seem to get a whole lot more complicated when you start adding in multiple users. Can someone explain this or link to a "for dummies" article that can explain all of this to me in a way that someone who's used to Windows style permissions can make a connection between the two OS families and their way of handling these things?
I need to assign permissions for ftp users. For that I need to create groups with different permissions like upload, download, rename, delete, rename and delete. And the users added to the group need to have that group permissions by default.
A colleague of mine has a Linux box (running Debian I believe) with an SVN repository on it. The repository directory and files 'owner' is my colleauge. We are both members of a group called 'users'. He manages several projects both Linux and Windows apps, while I have one Windows app. For the Windows apps, we both use TortoiseSVN via an SSH link to commit/update. Performing the command 'ls -l' shows the repository files and folders on the Linux box to have the following permissions:
-rwxrwx--- john users
However, when my colleauge commits to the repository, the permissions change to:
-rwxrwx--- john john
This then means I get 'Permission denied' when trying to access the repository myself as it appears that the group permissions have been overwritten with only 'owner' permissions. To fix this, a 'chown -R' command is applied to the files/folders to set the permissions back to owner/group, but each time he writes to the repository, the issue repeats.
I'm studying Linux and just started reading about permissions and ownership. My question is how would you have multiple users or groups given access to a certain directory? When doing an ls -l I see the owner, group and others that have permissions that have access to the file or directory. But what if I need multiple different groups access to a particular file or directory all with different permissions?
Im trying to change a group to have read write and execute permissions on everything in the system through command prompt, some people told me to edit the /etc/group file but i don't have a file that exists there under that name, but the group does already exist, i just don't know where its located. Anyone have a clue where i can check or what to do ?
I have a directory that needs to be owned by nginx user and I need to access it via other users in order to add/edit/delete files in it. So I created a group called www and added both then chgrp -R on the directory. However I am still getting a "unavailable to access no permissions" sort of error in my SSH/SCP/what ever you want to call Mac's Transmit. ls -a output drwxr----- 3 nginx www 4096 Jul 17 23:56 nginx
Sorry if this is the wrong section for this type of question. Anyway, I have two servers running Ubuntu 10.04. Server A has an NFS share that is mounted on server B, and the former has this share set up with specific permissions for a group called netusers. This group basically grants its users read/write permissions, and blocking all of files from anyone who's not part of the group.My question is this: how can I set up the permissions on server B, such that if I was to add a new user on server B, he would have read/write access to the share? I tried adding a counterpart group called netusers with the same permissions on B, but that didn't work.
A bit of an oddity that I've recently run into with my storage folder in my system; it's a newly installed drive that I've set to mount at /storage. When I first tried to use it, programs that I used that attempted to write to it tossed Access Denied errors at me in their own way. Checking the permissions (at the Terminal, ls -l / | grep storage) showed that /storage was set to 'rwxrwxr--'--Owner and Group were given full read/write/execute, but Others could only read. However, my logon to my system is a member of group root. Why, then, with the above bits set, would I not be able to write to it? Changing Others permissions to rwx (and presumably rw would have worked out for me since I don't leave anything executable there) allowed me to write to it, but I don't understand why that would have been necessary. So far as I'm aware, the prior drive that was in my system--mounted at the same location--did not need this treatment.
I have four users in my red hat linux 9. I want that all these four users should add in a group i.e "Marketing". please guide me that using terminal which command may i write so that the users should added in the group.I does't want to use GUI interface to do it.
im trying to implements mercurial repositories using ssh access.The problem is that if a login via ssh with the user "userA" all file upload vi that user are created with the owner: userA:userA and i need to use the group of the parent directory... is that posible ?For example:
repos ( root:repo) -> project1 ( root:repoPrj1 ) -> file1 ( userA:usearA ) -> here i want userA:repoPrj1
If user1's main group is genetics and one wants to add him/her to group biochem and to assign biochem as his/her secondary group will the following suffice ?
$ sudo usermod -G biochem user1
I would like for user1 to have genetics as the main group but also belong to biochem. When user1 creates a file, as he/she belongs to main group genetics, I assume the file will be owned by user1 and group owner will be genetics. Ideally files created by user1 should be accessible to users in group genetics(when permissions are tweaked) but not by individuals in group biochem. However, any files with group owner biochem should be accessible to user1 as he/she does belong to biochem as a secondary group. Would having user1 main group genetics, secondary group biochem fulfil this criteria ?
Does anyone know how to change the primary group on a user without changing the password? I've tried updating the /etc/passwd and running usermod -g group userBoth of those does change the group but somehow it messes up the password so the user cannot get in with the same password.