Setting Permissions - Best Practices?

Question

I have read through the permissions tutorial on ubuntu.com and still have a few questions.

1. i really dont understand the "group" part of the permission, what group, and how do i change the group as well as see what groups there are and what users have access to them.

2. is it bad practice to change the ownership of a secondary HDD to my user acccount instead of root.

3. is it bad to just set permissions for a drive to 777? i tried this and noticed terminal started highlighting it green in -ls

4. in general what are best practices for keeping computer secure but also allowing me to have permissions navigate and modify everything.

Answer 1

1. Groups are intended to provide a broader level of ownership than just per user, to allow multiple users to collaborate and share files without necessarily allowing every user on the system to edit them.

   The file /etc/group lists all groups on your system.

   The chgrp command allows you to change which group owns a file.

2. I think this is OK. In theory, it means that if your user account is compromised, the secondary drive would be vulnerable (whereas if root owns it, the attacker would need to know your password to su to affect the drive), but in practice your personal data is already in trouble if this happens anyway. Personally I think of my external drive as an extension of my home directory, since I just use it as an extra place to store large files.

3. In general, yes, you should avoid using permissions of 777 for anything. If you own the files, 755 or 644 give you just as much access and flexibility with less risk that another user (if you share the machine) or a compromised service (say if your httpd gets hacked) will corrupt your data.

4. A good rule of thumb is to use the lowest level of access that you can for whatever you're doing. This is why Ubuntu doesn't allow the root user to log in by default and instead encourages a model where you log in as a less powerful user and only elevate privileges when it's truly necessary for system maintenance. It means that if you accidentally run something that you shouldn't, the damage is limited based on that user's access.