I have many users and two groups. Some of them are member of group1 and others are member of group2. I want to allow group1 to access all directories, and I want to allow group2 to access to specific directories. I did some research but I could not fix it. How can I do that?
Thanks.
I will explain the basics of Ubuntu permissions and how they are used with ACLs:
If you go to a directory /folder and make an "ls -l" it shows you something like:
-rwxrwxrwx 1 36K 2009-08-14 13:35 Ichneumonidae.jpg
The letters rwx are the permissions that you have to understand that:
r: they are read permissions (4)
w: are the write permissions (2)
x: are the execution permissions (1)
The first three letters are the permits for the owner, the next 3 for the group and the last 3 for others. Why did I put the numbers 4,2,1? Those are the values that each permit has, adding up to 7 that are the total permits and with these you can play with the values.
Example: I will give all permissions to owner 7, read and execute permissions to groups 5 and no permission for others 0. (With the -R I tell you that the permissions are the same for all the contents of the directory) Keep in mind that the order of permits does not change: the first number will be for the owner, the second for the group and the third for others.
chmod 750 /home/user/test/ -R
In my opinion this method is easier than using:
chmod u + r /home/user/test/ -R
Because you have to give permissions one by one when you can do it all together.
Now understanding the basics of permissions I will explain a little the difference with ACLs. The Chmod command allows the permissions to be for a single owner, group and others. Instead ACL allows you to have more than one owner in a file or directory.
If you have any questions with the basic permissions and the chmod tell me and I will try to answer you. In case you don't have it installed run:
sudo apt-get install acl
Apart I recommend you install tree that lists all the contents of a directory showing all its interior. For cases of order of folders and files. Command to install:
sudo apt-get install tree
It is used as follows:
tree /folder
What does setfacl and getfacl do?. The getfacl shows the acl created in a file or directory. The setfacl is used to create, delete or clean. Before creating an ACL I like to clean and remove all previous permissions:
setfacl -b -k -R /folder
If you do a "getfacl --help" and a "setfacl --help" it will show you all the options with its explanation.
With -b I delete all extended ACLs. With the -k I delete the default ACL. With the -R I go through the directory and subdirectories.
ACLs have a different format that separates the fields with ":"
The first field is optional but it is important and very useful, the value "d" means by default, when you create an acl and add this value, the created file will have added by default the acls created with this value. The second field is the values: "u" owner, "g" group, "o" other The third field will depend on the second field. If you are going to create the ACL for the groups you will put the name of the group here, if it is for a user you will put the name of the user The last field is the rwx permissions.
Example: If I want to give permission to the business group to all directories.
setfacl -R -m d:g:entrepreneurs:rwx /
There will be some directories or files that will not allow you such permissions because they are from the system. If you only want to enter certain directories.
setfacl -R -m d:g:entrepreneurs:rwx /var/www/
If you have sub-directories and do not want them to access the others and remain only in that folder:
setfacl -m d:g:entrepreneurs:rwx /var/www/
You will understand that explaining everything is crazy, because it involves many things and if you search online you will find what you need. Finally to create the script you create a file with extension .sh and add the following:
# /bin/bash
here after creating the ACLs and proving that they work, you add them here.
You have to give this file permission to execute "x" "1" and preferably you can only open it and edit it as root or as you like.
Then to execute it you will edit the file /etc/cron At the end of the whole you add the following:
* * * * * /path/file.sh
Where /path/fichero.sh is the path where your created file is.
You can use the tools setfacl and getfacl. And with a bash script go running it from the cron. And simply and adding or removing permissions from the script.
