1
00:00:00,240 --> 00:00:02,310
In this lesson, we're going to be discussing

2
00:00:02,310 --> 00:00:05,070
how to troubleshoot user permission issues.

3
00:00:05,070 --> 00:00:07,050
One of the most important skills you'll need

4
00:00:07,050 --> 00:00:09,840
is the ability to troubleshoot the inevitable issues

5
00:00:09,840 --> 00:00:11,670
that'll arise in your systems.

6
00:00:11,670 --> 00:00:13,410
You should always follow a general model

7
00:00:13,410 --> 00:00:15,960
for troubleshooting any type of operating system problem

8
00:00:15,960 --> 00:00:17,400
that you may come across,

9
00:00:17,400 --> 00:00:19,710
such as using the seven-step troubleshooting method

10
00:00:19,710 --> 00:00:22,770
you learned about back in your CompTIA A+ studies.

11
00:00:22,770 --> 00:00:24,030
Often you're going to find

12
00:00:24,030 --> 00:00:25,740
that the reason something isn't working

13
00:00:25,740 --> 00:00:28,620
is because you're facing some sort of permission issue.

14
00:00:28,620 --> 00:00:29,760
When this occurs,

15
00:00:29,760 --> 00:00:32,070
you need to put your troubleshooting skills to work

16
00:00:32,070 --> 00:00:35,910
and diagnose and solve those issues related to permissions.

17
00:00:35,910 --> 00:00:37,560
Now, troubleshooting usually begins

18
00:00:37,560 --> 00:00:39,360
with the identification of a problem

19
00:00:39,360 --> 00:00:42,090
and it doesn't end until the services have been restored

20
00:00:42,090 --> 00:00:45,660
and the problem no longer adversely affects our end users.

21
00:00:45,660 --> 00:00:47,550
Troubleshooting can take many forms,

22
00:00:47,550 --> 00:00:49,770
but all approaches have the same goal,

23
00:00:49,770 --> 00:00:51,300
to solve a problem efficiently

24
00:00:51,300 --> 00:00:53,820
with a minimal interruption to services.

25
00:00:53,820 --> 00:00:55,380
Now, there are a lot of different strategies

26
00:00:55,380 --> 00:00:58,050
for troubleshooting and they can vary in their approach,

27
00:00:58,050 --> 00:01:00,780
but all of the troubleshooting models attempt to enable you

28
00:01:00,780 --> 00:01:03,660
to move in a methodical and repeatable pattern.

29
00:01:03,660 --> 00:01:07,200
The CompTIA troubleshooting model contains seven steps.

30
00:01:07,200 --> 00:01:09,450
First, we have identifying the problem.

31
00:01:09,450 --> 00:01:12,180
This includes things like gathering additional information,

32
00:01:12,180 --> 00:01:14,070
duplicating the problem if you can,

33
00:01:14,070 --> 00:01:16,830
questioning users to gain experiential information,

34
00:01:16,830 --> 00:01:18,450
identifying the symptoms,

35
00:01:18,450 --> 00:01:20,310
determining if anything has changed,

36
00:01:20,310 --> 00:01:23,610
and approaching multiple problems as individual problems.

37
00:01:23,610 --> 00:01:27,120
Second, we're going to establish a theory of probable cause.

38
00:01:27,120 --> 00:01:29,670
This is where the troubleshooter questions the obvious.

39
00:01:29,670 --> 00:01:31,320
They consider multiple approaches

40
00:01:31,320 --> 00:01:33,840
and they look for the root cause of the problem.

41
00:01:33,840 --> 00:01:37,830
Third, we want to test the theory to determine the cause.

42
00:01:37,830 --> 00:01:40,680
Fourth, we want to establish a plan of action

43
00:01:40,680 --> 00:01:42,090
to resolve the problem.

44
00:01:42,090 --> 00:01:43,500
We do this while identifying

45
00:01:43,500 --> 00:01:46,140
the potential effects of our plan.

46
00:01:46,140 --> 00:01:48,330
Fifth, we're going to implement the solution,

47
00:01:48,330 --> 00:01:50,250
meaning we're actually going to try what we think

48
00:01:50,250 --> 00:01:51,810
will solve the problem.

49
00:01:51,810 --> 00:01:54,810
Sixth, we'll verify full system functionality,

50
00:01:54,810 --> 00:01:56,310
verifying everything is working

51
00:01:56,310 --> 00:01:58,440
and we actually solve the problem.

52
00:01:58,440 --> 00:02:00,720
Seventh, we'll document our findings,

53
00:02:00,720 --> 00:02:03,120
our actions and the outcomes.

54
00:02:03,120 --> 00:02:06,030
As a general guideline, whenever you're denied permissions

55
00:02:06,030 --> 00:02:09,360
when you expect to have those permissions, or vice versa,

56
00:02:09,360 --> 00:02:12,030
you get permissions when you're expecting to be denied,

57
00:02:12,030 --> 00:02:13,710
you should always verify the permissions

58
00:02:13,710 --> 00:02:18,030
of the relevant object by using the ls -al command.

59
00:02:18,030 --> 00:02:21,120
This will often save you a lot of guesswork as many issues

60
00:02:21,120 --> 00:02:23,220
simply coming down to having the wrong permission

61
00:02:23,220 --> 00:02:25,230
being applied for a particular user

62
00:02:25,230 --> 00:02:28,740
or system administrator or a piece of software or a group.

63
00:02:28,740 --> 00:02:30,090
Just like with permissions,

64
00:02:30,090 --> 00:02:33,570
you should always use ls -al to verify the user

65
00:02:33,570 --> 00:02:36,030
and group ownership of a file or directory

66
00:02:36,030 --> 00:02:39,390
whenever you're experiencing ownership-related issues too.

67
00:02:39,390 --> 00:02:40,920
Despite having configure permissions

68
00:02:40,920 --> 00:02:43,920
and ownership correctly, some issues can still arise

69
00:02:43,920 --> 00:02:46,980
because users may not have been placed in the correct group.

70
00:02:46,980 --> 00:02:50,340
Use the groups command by typing groups username

71
00:02:50,340 --> 00:02:53,730
to be able to discover what groups a user is a member of.

72
00:02:53,730 --> 00:02:56,820
Another issue that can occur is when a user creates files

73
00:02:56,820 --> 00:03:00,090
and the default owning group is not what is expected.

74
00:03:00,090 --> 00:03:03,180
Make sure the expected group is the user's primary group

75
00:03:03,180 --> 00:03:05,160
rather than a secondary group.

76
00:03:05,160 --> 00:03:07,800
In either case, use the usermod command

77
00:03:07,800 --> 00:03:10,560
to change the group membership when applicable.

78
00:03:10,560 --> 00:03:11,880
It may also be beneficial

79
00:03:11,880 --> 00:03:13,650
to list all the members of a group

80
00:03:13,650 --> 00:03:15,060
so you can identify which accounts

81
00:03:15,060 --> 00:03:17,610
to add or remove as needed.

82
00:03:17,610 --> 00:03:19,050
Now to help with this process,

83
00:03:19,050 --> 00:03:20,730
there are two commands that are pre-installed

84
00:03:20,730 --> 00:03:22,230
on some distributions.

85
00:03:22,230 --> 00:03:25,560
This is known as lid and libuser-lid.

86
00:03:25,560 --> 00:03:27,390
These two commands can be used to retrieve

87
00:03:27,390 --> 00:03:28,710
all members of a group,

88
00:03:28,710 --> 00:03:30,510
including members whose primary group

89
00:03:30,510 --> 00:03:32,550
is the group being searched for.

90
00:03:32,550 --> 00:03:35,730
Another useful command is getent.

91
00:03:35,730 --> 00:03:37,080
The getent command,

92
00:03:37,080 --> 00:03:39,030
which is available on some distributions,

93
00:03:39,030 --> 00:03:40,800
will enable you to retrieve group members

94
00:03:40,800 --> 00:03:43,410
of nonstandard authentication methods.

95
00:03:43,410 --> 00:03:46,470
So remember, when troubleshooting permission issues,

96
00:03:46,470 --> 00:03:48,780
it's important to follow a few guidelines.

97
00:03:48,780 --> 00:03:51,600
First, follow an overall troubleshooting strategy

98
00:03:51,600 --> 00:03:53,910
for any kind of troubleshooting task.

99
00:03:53,910 --> 00:03:57,120
Always use a model that can produce repeatable results.

100
00:03:57,120 --> 00:04:00,390
Second, always start by verifying an object's permissions

101
00:04:00,390 --> 00:04:03,930
and ownership using the ls -al command.

102
00:04:03,930 --> 00:04:06,450
You're going to use this to ensure users have the permissions

103
00:04:06,450 --> 00:04:09,630
to work with a file if they're being denied access.

104
00:04:09,630 --> 00:04:11,700
Always ensure users do not have permissions

105
00:04:11,700 --> 00:04:13,260
that enable them to access files

106
00:04:13,260 --> 00:04:15,300
beyond what they should have because we want to make sure

107
00:04:15,300 --> 00:04:17,610
we're implementing lease privilege.

108
00:04:17,610 --> 00:04:20,370
Third, make sure you verify any special permissions

109
00:04:20,370 --> 00:04:22,890
that are needed are actually set properly.

110
00:04:22,890 --> 00:04:25,230
Ensure objects don't have a mutable flag set

111
00:04:25,230 --> 00:04:27,480
if you expect to modify those files.

112
00:04:27,480 --> 00:04:29,700
Make sure you set the set user ID permission

113
00:04:29,700 --> 00:04:32,730
on an executable if you need to run it with root permissions

114
00:04:32,730 --> 00:04:34,470
for it to function properly.

115
00:04:34,470 --> 00:04:35,910
Make sure you set the sticky bit

116
00:04:35,910 --> 00:04:38,160
if you only want the owner and the root user

117
00:04:38,160 --> 00:04:39,900
to be able to delete that object.

118
00:04:39,900 --> 00:04:41,340
These are the kind of things we're talking about

119
00:04:41,340 --> 00:04:43,680
with verifying special permissions.

120
00:04:43,680 --> 00:04:46,410
Fourth, ensure objects have the proper owner

121
00:04:46,410 --> 00:04:47,970
and owning group set.

122
00:04:47,970 --> 00:04:51,030
Set the set group ID permission on a directory

123
00:04:51,030 --> 00:04:52,380
whenever you want new files

124
00:04:52,380 --> 00:04:54,930
to take on that directory's group ownership.

125
00:04:54,930 --> 00:04:58,020
Use the groups command by typing groups username

126
00:04:58,020 --> 00:05:00,720
to verify the groups a user is a member of.

127
00:05:00,720 --> 00:05:03,900
Modify group membership if necessary to ensure access

128
00:05:03,900 --> 00:05:06,510
or lack thereof for specific users.

129
00:05:06,510 --> 00:05:09,060
If you're in doubt, you can always use tools like lid

130
00:05:09,060 --> 00:05:12,630
and getent to view members of a specific group.

131
00:05:12,630 --> 00:05:14,970
By keeping these troubleshooting guidelines in mind,

132
00:05:14,970 --> 00:05:17,730
you can quickly identify permission and ownership issues

133
00:05:17,730 --> 00:05:20,103
and get your users back up and running quickly.