1 1 00:00:00,270 --> 00:00:02,460 File system permissions. 2 2 00:00:02,460 --> 00:00:05,700 In this lesson, we're going to explore file system permissions 3 3 00:00:05,700 --> 00:00:07,800 both in Windows and Linux. 4 4 00:00:07,800 --> 00:00:09,720 Now, when you deal with file system permissions, 5 5 00:00:09,720 --> 00:00:11,700 incorrect permissions that can be allocated 6 6 00:00:11,700 --> 00:00:13,290 to a resource can be the cause 7 7 00:00:13,290 --> 00:00:15,180 of many of your data breaches. 8 8 00:00:15,180 --> 00:00:16,800 For example, if I have a web server 9 9 00:00:16,800 --> 00:00:17,880 and a particular folder 10 10 00:00:17,880 --> 00:00:19,950 is not supposed to be publicly visible, 11 11 00:00:19,950 --> 00:00:21,960 but somebody incorrectly sets up permission 12 12 00:00:21,960 --> 00:00:23,610 and makes it publicly visible, 13 13 00:00:23,610 --> 00:00:26,160 everyone in the world can see that information. 14 14 00:00:26,160 --> 00:00:28,170 And so incorrect permissions are a big source 15 15 00:00:28,170 --> 00:00:29,370 of pain for us. 16 16 00:00:29,370 --> 00:00:30,203 Now, as I said, 17 17 00:00:30,203 --> 00:00:32,280 we are going to cover two different types of permission sets. 18 18 00:00:32,280 --> 00:00:33,900 We're going to talk about Windows permissions 19 19 00:00:33,900 --> 00:00:36,060 and Linux permissions 'cause they are different 20 20 00:00:36,060 --> 00:00:38,010 on those different operating systems. 21 21 00:00:38,010 --> 00:00:42,750 Now, inside of Windows, we're going to use the icacls tool. 22 22 00:00:42,750 --> 00:00:44,220 Now this is a command-line tool 23 23 00:00:44,220 --> 00:00:46,710 for showing and modifying file permissions. 24 24 00:00:46,710 --> 00:00:47,880 When you look at this, 25 25 00:00:47,880 --> 00:00:49,050 you're going to be able to see permissions 26 26 00:00:49,050 --> 00:00:52,200 in different categories such as N for no access, 27 27 00:00:52,200 --> 00:00:57,200 F for full access, R for read-only, RX for read and execute, 28 28 00:00:57,270 --> 00:01:02,010 M for modify, W for write, and D for delete. 29 29 00:01:02,010 --> 00:01:03,420 These are all the different permissions 30 30 00:01:03,420 --> 00:01:05,400 that you can have inside of Windows 31 31 00:01:05,400 --> 00:01:07,650 on a particular file or directory. 32 32 00:01:07,650 --> 00:01:10,170 Now when you're using icacls, 33 33 00:01:10,170 --> 00:01:11,640 you can use it by actually adding 34 34 00:01:11,640 --> 00:01:13,230 individual permissions themself, 35 35 00:01:13,230 --> 00:01:16,290 or you can use a comma separated list of permissions 36 36 00:01:16,290 --> 00:01:18,840 that's used for more complex permission types. 37 37 00:01:18,840 --> 00:01:20,160 Most of you should be familiar 38 38 00:01:20,160 --> 00:01:21,660 with Windows file system permissions 39 39 00:01:21,660 --> 00:01:23,460 because this was covered all the way back 40 40 00:01:23,460 --> 00:01:25,050 in your A+ studies. 41 41 00:01:25,050 --> 00:01:27,030 If you're not familiar with this concept, 42 42 00:01:27,030 --> 00:01:29,160 grab a Windows machine, go into it, 43 43 00:01:29,160 --> 00:01:30,630 right click on a file or folder 44 44 00:01:30,630 --> 00:01:31,920 and play around with the permissions 45 45 00:01:31,920 --> 00:01:33,750 just to get comfortable with it. 46 46 00:01:33,750 --> 00:01:35,490 Next, we need to talk about Linux, 47 47 00:01:35,490 --> 00:01:38,040 and Linux, we're going to cover in a little bit more depth 48 48 00:01:38,040 --> 00:01:40,680 because if it's been a while since you've done your A+, 49 49 00:01:40,680 --> 00:01:42,750 Linux wasn't covered that frequently. 50 50 00:01:42,750 --> 00:01:45,570 If you were on the 801 or the 901 version of A+, 51 51 00:01:45,570 --> 00:01:47,250 they didn't really go into Linux at all 52 52 00:01:47,250 --> 00:01:49,200 and they left that for Linux+. 53 53 00:01:49,200 --> 00:01:50,910 Now, in the newer versions of A+, 54 54 00:01:50,910 --> 00:01:52,290 they do cover Linux permissions, 55 55 00:01:52,290 --> 00:01:54,120 but because I have a lot of students 56 56 00:01:54,120 --> 00:01:56,400 who didn't go through that version of the course, 57 57 00:01:56,400 --> 00:01:59,040 I am going to cover Linux in a little bit more detail. 58 58 00:01:59,040 --> 00:02:02,310 Now, everything inside of Linux is treated as a file. 59 59 00:02:02,310 --> 00:02:06,180 It doesn't matter if it's a file, a directory, memory space, 60 60 00:02:06,180 --> 00:02:08,880 or even the processor or an input/output device. 61 61 00:02:08,880 --> 00:02:11,220 Everything in Linux is treated like a file. 62 62 00:02:11,220 --> 00:02:13,500 So permissions are really important. 63 63 00:02:13,500 --> 00:02:15,930 Now, in Linux, there are three permissions: 64 64 00:02:15,930 --> 00:02:17,910 read, write, and execute. 65 65 00:02:17,910 --> 00:02:21,180 And this is symbolized by r, w, and x. 66 66 00:02:21,180 --> 00:02:22,920 Now, when we talk about read permissions, 67 67 00:02:22,920 --> 00:02:24,480 this is the ability to access 68 68 00:02:24,480 --> 00:02:26,280 and view the contents of a file 69 69 00:02:26,280 --> 00:02:28,230 or list the contents of a directory. 70 70 00:02:28,230 --> 00:02:29,880 Essentially, you want to be able to look at it, 71 71 00:02:29,880 --> 00:02:31,320 you want to be able to read it. 72 72 00:02:31,320 --> 00:02:32,700 Now, when you deal with writing, 73 73 00:02:32,700 --> 00:02:34,020 you're going to be dealing with the ability 74 74 00:02:34,020 --> 00:02:36,420 to save changes to a file. So you want to be able to write it, 75 75 00:02:36,420 --> 00:02:39,120 or you want to be able to create a file or rename a file 76 76 00:02:39,120 --> 00:02:41,550 or delete files within a different directory. 77 77 00:02:41,550 --> 00:02:44,070 All of this can be done if you have the write permission. 78 78 00:02:44,070 --> 00:02:45,840 Now, if you want to be able to delete something, 79 79 00:02:45,840 --> 00:02:49,140 you need permissions of both write and execute. 80 80 00:02:49,140 --> 00:02:51,270 Now, when we talk about execute, 81 81 00:02:51,270 --> 00:02:53,670 this is the ability to run a script, a program, 82 82 00:02:53,670 --> 00:02:55,020 or other software file, 83 83 00:02:55,020 --> 00:02:57,660 or it's the ability to access a directory, 84 84 00:02:57,660 --> 00:02:59,430 execute a file from that directory, 85 85 00:02:59,430 --> 00:03:01,470 or perform a task on that directory. 86 86 00:03:01,470 --> 00:03:03,300 Basically, you want to do something. 87 87 00:03:03,300 --> 00:03:05,400 That's what execute is all about. 88 88 00:03:05,400 --> 00:03:07,110 Now, this sounds like it's pretty easy, right? 89 89 00:03:07,110 --> 00:03:08,280 There's only three permissions 90 90 00:03:08,280 --> 00:03:10,320 where Windows had a whole bunch more. 91 91 00:03:10,320 --> 00:03:12,630 Well, it gets a little bit more complicated though, 92 92 00:03:12,630 --> 00:03:14,820 because when you look at the permissions for a file, 93 93 00:03:14,820 --> 00:03:17,670 such as here, you're going to see that it looks like this. 94 94 00:03:17,670 --> 00:03:19,290 You're going to have a dash at the beginning, 95 95 00:03:19,290 --> 00:03:20,700 and this means it's a file. 96 96 00:03:20,700 --> 00:03:24,450 If it was a directory, that dash would be a D for directory. 97 97 00:03:24,450 --> 00:03:26,610 Then we have three sets of permissions. 98 98 00:03:26,610 --> 00:03:29,310 Here you can see read, write, execute, 99 99 00:03:29,310 --> 00:03:32,820 read, dash, execute, read, dash, execute. 100 100 00:03:32,820 --> 00:03:34,410 Those are three sets. 101 101 00:03:34,410 --> 00:03:36,510 Now, as you start understanding this, 102 102 00:03:36,510 --> 00:03:38,340 why are there three sets? 103 103 00:03:38,340 --> 00:03:41,730 Well, this is because the first set represents the owner. 104 104 00:03:41,730 --> 00:03:43,830 The second set represents the group, 105 105 00:03:43,830 --> 00:03:46,650 and the third represents others or world. 106 106 00:03:46,650 --> 00:03:48,390 Let's talk about that for a second. 107 107 00:03:48,390 --> 00:03:50,220 When we talk about an owner's permission, 108 108 00:03:50,220 --> 00:03:51,150 these are the permissions 109 109 00:03:51,150 --> 00:03:53,610 that determine what the file owner can do with that file. 110 110 00:03:53,610 --> 00:03:56,760 So if I created a file and I own that file, 111 111 00:03:56,760 --> 00:03:58,800 I can do these things. 112 112 00:03:58,800 --> 00:04:01,890 Then I have group permissions, that's the second set. 113 113 00:04:01,890 --> 00:04:03,600 These permissions determine what members 114 114 00:04:03,600 --> 00:04:05,490 of the file's group who are not the owner 115 115 00:04:05,490 --> 00:04:07,170 can actually do with that file. 116 116 00:04:07,170 --> 00:04:08,370 And then we have the third one, 117 117 00:04:08,370 --> 00:04:10,770 which is world or other, which is everybody else. 118 118 00:04:10,770 --> 00:04:12,600 They're not the owner, they're not the group, 119 119 00:04:12,600 --> 00:04:14,460 they're just somebody on the system. 120 120 00:04:14,460 --> 00:04:15,390 And these are permissions 121 121 00:04:15,390 --> 00:04:17,580 that determine what users who are not the file's owner 122 122 00:04:17,580 --> 00:04:19,860 or members of the group can do with that file. 123 123 00:04:19,860 --> 00:04:21,510 So we have these three basic sets. 124 124 00:04:21,510 --> 00:04:23,640 So again, when I look at this and I look at it, 125 125 00:04:23,640 --> 00:04:25,380 I can see that the user has the ability 126 126 00:04:25,380 --> 00:04:27,000 to read, write, and execute. 127 127 00:04:27,000 --> 00:04:29,220 They can pretty much do whatever they want to that file, 128 128 00:04:29,220 --> 00:04:32,370 but group members can only read it and execute it, 129 129 00:04:32,370 --> 00:04:33,780 but they can't write to it. 130 130 00:04:33,780 --> 00:04:35,460 And if they're another user on the system 131 131 00:04:35,460 --> 00:04:38,700 or that world group, they can again read and execute it, 132 132 00:04:38,700 --> 00:04:40,380 but they can't write to it. 133 133 00:04:40,380 --> 00:04:42,090 This might be a good set of permissions for something 134 134 00:04:42,090 --> 00:04:44,190 like a file on your website or a script 135 135 00:04:44,190 --> 00:04:46,170 because there's other people who need to be able to read it 136 136 00:04:46,170 --> 00:04:47,520 and execute that script, 137 137 00:04:47,520 --> 00:04:49,860 but they shouldn't be able to write it or delete it. 138 138 00:04:49,860 --> 00:04:51,480 Only you, the original author, 139 139 00:04:51,480 --> 00:04:53,280 should have those permissions. 140 140 00:04:53,280 --> 00:04:55,890 Now I know we just covered the basics of Linux permissions 141 141 00:04:55,890 --> 00:04:58,380 talking about the three groups in the read, write, execute, 142 142 00:04:58,380 --> 00:05:01,260 but Linux permissions get even more confusing 143 143 00:05:01,260 --> 00:05:03,180 because people also will abbreviate them 144 144 00:05:03,180 --> 00:05:06,840 using numbers instead of the r, the w, and the x. 145 145 00:05:06,840 --> 00:05:09,630 So when you look at it, an r is a four, 146 146 00:05:09,630 --> 00:05:12,030 a w is a two, and an x is a one. 147 147 00:05:12,030 --> 00:05:14,160 And this chart here will help you with that. 148 148 00:05:14,160 --> 00:05:17,310 So for example, if I have read, write, execute, 149 149 00:05:17,310 --> 00:05:19,500 like the user did in my previous example, 150 150 00:05:19,500 --> 00:05:21,510 this is symbolized by seven 151 151 00:05:21,510 --> 00:05:25,470 because read plus write plus execute equals seven. 152 152 00:05:25,470 --> 00:05:27,930 Now if I wanted to see what the other two groups had, 153 153 00:05:27,930 --> 00:05:30,060 they had read and execute only, right? 154 154 00:05:30,060 --> 00:05:31,830 What would that equal? 155 155 00:05:31,830 --> 00:05:33,360 That's right, it would equal five 156 156 00:05:33,360 --> 00:05:36,060 because read is four, execute is one, 157 157 00:05:36,060 --> 00:05:39,780 four plus one equals five, and that gives us the five. 158 158 00:05:39,780 --> 00:05:41,430 So the easiest way to write this, 159 159 00:05:41,430 --> 00:05:43,530 instead of writing read, write, execute, 160 160 00:05:43,530 --> 00:05:46,170 read, dash, execute, read, dash, execute, 161 161 00:05:46,170 --> 00:05:49,890 I could simply say this has the permissions of 755, 162 162 00:05:49,890 --> 00:05:52,020 which tells me the exact same thing. 163 163 00:05:52,020 --> 00:05:53,430 This is the way that we can understand 164 164 00:05:53,430 --> 00:05:54,540 Linux permission systems 165 165 00:05:54,540 --> 00:05:56,010 by breaking down those numbers 166 166 00:05:56,010 --> 00:05:58,260 based on read, write, and execute. 167 167 00:05:58,260 --> 00:06:01,560 So let's go through and do a couple of examples together. 168 168 00:06:01,560 --> 00:06:05,700 Now if I have read, write, execute, read, write, execute, 169 169 00:06:05,700 --> 00:06:08,790 read, write, execute, what would that be represented 170 170 00:06:08,790 --> 00:06:10,410 using three digits? 171 171 00:06:10,410 --> 00:06:13,710 That would be 777 because read, write, and execute 172 172 00:06:13,710 --> 00:06:16,650 is four plus two plus one, which gives you seven. 173 173 00:06:16,650 --> 00:06:19,500 And we had that three times, so 777. 174 174 00:06:19,500 --> 00:06:20,970 This means we have read, write, execute 175 175 00:06:20,970 --> 00:06:22,290 for the owner, the group, 176 176 00:06:22,290 --> 00:06:24,540 and every other user on the system. 177 177 00:06:24,540 --> 00:06:27,240 Now what if we had read, write, execute, 178 178 00:06:27,240 --> 00:06:30,780 read, dash, execute, dash, dash, dash? 179 179 00:06:30,780 --> 00:06:32,310 What would that be? 180 180 00:06:32,310 --> 00:06:35,190 Well, read, write, execute would be a seven. 181 181 00:06:35,190 --> 00:06:37,350 Read, dash, execute would be a five. 182 182 00:06:37,350 --> 00:06:39,270 And then dash, dash, dash would be zero 183 183 00:06:39,270 --> 00:06:40,680 because there are no permissions. 184 184 00:06:40,680 --> 00:06:43,140 So this says we have read, write, and execute 185 185 00:06:43,140 --> 00:06:44,370 for the owner of the file. 186 186 00:06:44,370 --> 00:06:46,620 We have read and execute for the group 187 187 00:06:46,620 --> 00:06:48,090 and no permissions for anybody 188 188 00:06:48,090 --> 00:06:50,610 who's not the owner and not the group. 189 189 00:06:50,610 --> 00:06:51,630 Let's take a look at the next one. 190 190 00:06:51,630 --> 00:06:55,830 We have read, write, dash, read, dash, dash, 191 191 00:06:55,830 --> 00:06:57,360 read, dash, dash. 192 192 00:06:57,360 --> 00:06:58,800 What would this be? 193 193 00:06:58,800 --> 00:07:01,890 Well, read, write, dash would be a six. 194 194 00:07:01,890 --> 00:07:04,680 And then we have read, dash, dash would be a four. 195 195 00:07:04,680 --> 00:07:06,450 And then read, dash, dash would be a four, 196 196 00:07:06,450 --> 00:07:08,610 so it becomes 644. 197 197 00:07:08,610 --> 00:07:10,920 This gives me read and write permissions for the owner 198 198 00:07:10,920 --> 00:07:12,240 and then read permissions 199 199 00:07:12,240 --> 00:07:15,300 for both the group and everybody else on the system. 200 200 00:07:15,300 --> 00:07:17,040 And the final one we're going to look at: 201 201 00:07:17,040 --> 00:07:21,393 read, dash, dash, dash, dash, dash, dash, dash, dash. 202 202 00:07:21,393 --> 00:07:23,310 What would this one be? 203 203 00:07:23,310 --> 00:07:24,720 This one should be pretty easy. 204 204 00:07:24,720 --> 00:07:26,790 It only has the one read, which is worth four. 205 205 00:07:26,790 --> 00:07:28,770 So it's 400. 206 206 00:07:28,770 --> 00:07:31,350 This means the owner can read it and nobody else, 207 207 00:07:31,350 --> 00:07:34,410 not the group and not the world can do anything with it. 208 208 00:07:34,410 --> 00:07:36,420 This is a very well protected file. 209 209 00:07:36,420 --> 00:07:38,940 So this is the way we can read these permissions. 210 210 00:07:38,940 --> 00:07:41,970 Now if you want to be able to modify permissions using Linux, 211 211 00:07:41,970 --> 00:07:46,230 you're going to use the command chmod, change mod. 212 212 00:07:46,230 --> 00:07:47,400 Now this is a Linux command 213 213 00:07:47,400 --> 00:07:49,620 that's used to modify permissions for files. 214 214 00:07:49,620 --> 00:07:51,960 So if I want to modify them, 215 215 00:07:51,960 --> 00:07:54,060 I can do this by using the letters 216 216 00:07:54,060 --> 00:07:59,040 and I can do change mod g plus x, comma, o minus r, 217 217 00:07:59,040 --> 00:08:01,170 and then the file or folder that I want to do it on, 218 218 00:08:01,170 --> 00:08:02,280 in this case home. 219 219 00:08:02,280 --> 00:08:03,990 What this says is that for the group, 220 220 00:08:03,990 --> 00:08:05,940 I want to add the execute permission, 221 221 00:08:05,940 --> 00:08:07,830 but for the other or world permission, 222 222 00:08:07,830 --> 00:08:09,930 I want to remove the reading ability. 223 223 00:08:09,930 --> 00:08:11,970 And so that would be adding some permissions 224 224 00:08:11,970 --> 00:08:14,670 and taking some away all at the same time. 225 225 00:08:14,670 --> 00:08:15,780 Now I can do this again. 226 226 00:08:15,780 --> 00:08:17,220 Let's say I wanted to do change mod 227 227 00:08:17,220 --> 00:08:18,270 and I wanted to say 228 228 00:08:18,270 --> 00:08:23,190 user equals rwx, comma, g equals rw, 229 229 00:08:23,190 --> 00:08:26,370 comma, o equals rx home. 230 230 00:08:26,370 --> 00:08:27,600 What is this saying? 231 231 00:08:27,600 --> 00:08:29,700 Well, this is being more explicit in what I want. 232 232 00:08:29,700 --> 00:08:32,370 Instead of adding or removing things one at a time, 233 233 00:08:32,370 --> 00:08:34,470 I'm saying just override all the permissions 234 234 00:08:34,470 --> 00:08:36,180 with this set of conditions. 235 235 00:08:36,180 --> 00:08:38,580 So the user is going to read, write, and execute. 236 236 00:08:38,580 --> 00:08:39,690 That's a seven. 237 237 00:08:39,690 --> 00:08:42,750 The group is going to read and write, that's a four. 238 238 00:08:42,750 --> 00:08:45,600 And then the others or world is going to read and execute, 239 239 00:08:45,600 --> 00:08:46,710 that's a five. 240 240 00:08:46,710 --> 00:08:49,260 So what this is saying is that for the user, 241 241 00:08:49,260 --> 00:08:51,900 the owner of this, we are going to read, write, and execute, 242 242 00:08:51,900 --> 00:08:53,670 which is equivalent to a seven. 243 243 00:08:53,670 --> 00:08:55,860 The group is going to have read and write, 244 244 00:08:55,860 --> 00:08:57,750 which is the equivalent of a six, 245 245 00:08:57,750 --> 00:08:58,830 and then we're going to have the other 246 246 00:08:58,830 --> 00:09:01,560 or the world permissions reading and executing, 247 247 00:09:01,560 --> 00:09:03,540 which would be the equivalent of a five. 248 248 00:09:03,540 --> 00:09:05,910 And so by writing out all these letters, 249 249 00:09:05,910 --> 00:09:10,740 essentially, I said I wanted to do 765. 250 250 00:09:10,740 --> 00:09:12,870 Now wouldn't it be easier if I could just use those numbers? 251 251 00:09:12,870 --> 00:09:15,180 Well, it would and the nice thing is change mod 252 252 00:09:15,180 --> 00:09:16,140 will let you. 253 253 00:09:16,140 --> 00:09:19,710 You can just type in something like change mod 755 home 254 254 00:09:19,710 --> 00:09:21,150 and this is going to change the permissions 255 255 00:09:21,150 --> 00:09:23,340 of the home directory into 755, 256 256 00:09:23,340 --> 00:09:26,010 which is read, write, execute for the owner, 257 257 00:09:26,010 --> 00:09:28,500 and read and execute for everybody else in the system, 258 258 00:09:28,500 --> 00:09:30,480 including the group and the world. 259 259 00:09:30,480 --> 00:09:32,310 So this is a nice easy way to do things 260 260 00:09:32,310 --> 00:09:34,080 and this is why people use the numbers 261 261 00:09:34,080 --> 00:09:36,030 inside of Linux so much. 262 262 00:09:36,030 --> 00:09:37,380 Now the final thing we need to talk about 263 263 00:09:37,380 --> 00:09:39,150 is ownership of the file. 264 264 00:09:39,150 --> 00:09:41,940 Now I said that the owner has that first set of permissions. 265 265 00:09:41,940 --> 00:09:43,650 Well, what if you want to change the owner? 266 266 00:09:43,650 --> 00:09:47,700 That's where change own comes into play, C-H-O-W-N. 267 267 00:09:47,700 --> 00:09:49,560 This is change owner, essentially. 268 268 00:09:49,560 --> 00:09:50,760 This is a Linux command 269 269 00:09:50,760 --> 00:09:52,980 that is used to modify the owner of a file. 270 270 00:09:52,980 --> 00:09:55,200 And so you basically would type in change own, 271 271 00:09:55,200 --> 00:09:58,110 the person you want to change, and then the file name. 272 272 00:09:58,110 --> 00:10:00,660 And so if I wanted to change the owner of the home to Jason, 273 273 00:10:00,660 --> 00:10:03,360 I would say change own Jason home. 274 274 00:10:03,360 --> 00:10:05,850 It's the command, the user of the group, 275 275 00:10:05,850 --> 00:10:07,900 and then the file you want to change it to.