Linux Access Control

Access Control

Distro support

Two-family skill. useradd/usermod/passwd, SSH keys, and /etc/sudoers.d/ work the same on both. The notable differences are the admin group and a couple of RHEL-only auth/SELinux layers. Body uses Debian/Ubuntu; substitute per this matrix.

RHEL-family note: the admin group is wheel, not sudo. RHEL manages the PAM/nsswitch stack through authselect (don't hand-edit what it owns), and SELinux can confine users (semanage login, semanage user). See ../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md and docs/multi-distro/plan.md.

Use when

• Managing Linux users, groups, sudo access, SSH keys, or file permissions.
• Auditing who can log in or who has elevated access on a server.
• Fixing ownership or permission problems in web roots, home directories, or credential files.

Do not use when

• The task is firewalling or TLS; use linux-firewall-ssl.
• The task is broader security analysis or hardening; use linux-security-analysis or linux-server-hardening.

Required inputs

Workflow

1. Identify the account or path being changed and inspect current state first.
2. Apply the least-privilege change with the manual commands below.
3. Re-check login access, sudo membership, and file ownership after the change.
4. Use optional scripts only when they are installed and clearly match the task.
5. Stop if the approver, target identity, recovery administrator, or ownership boundary is unresolved.
6. Recover a failed access change through the tested alternate session, restore the saved sudoers/key/file state, and verify login again.

Quality standards

• Prefer reversible, explicit changes over blanket permission fixes.
• Preserve SSH access and validate the impact before removing keys or users.
• Credential files must remain tightly permissioned.

Anti-patterns

• Running recursive chmod or chown without scoping the target. Fix: inspect boundaries and change only the named tree or files.
• Granting sudo or shell access without an approved need. Fix: use the least privilege and record the owner and expiry.
• Deleting an account before reviewing its files, processes, jobs, and keys. Fix: disable first, inventory dependencies, then remove deliberately.
• Editing /etc/sudoers without validation. Fix: use a drop-in and validate with visudo before ending the recovery session.
• Revoking the only working administrator or SSH key. Fix: prove an independent break-glass path first.

Outputs

References

• references/users-sudoers-pam.md
• references/permissions-reference.md
• ../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md — SELinux user confinement (RHEL family)

Evidence Produced

Capability contract

Audit requests default to read-only. Read access to account and permission state is required; editing users, groups, keys, PAM, sudoers, SELinux mappings, or files requires explicit authority. Never expose private keys or revoke the last tested administrator.

Degraded mode

Without privileged access, report observable state and exact root-level checks as not assessed. Without a safe second login or console, stop before lockout-capable changes.

Decision rules

Worked example

To offboard a deployment user, record current groups, keys, processes, cron jobs, and owned files; disable login; verify the replacement automation identity; transfer required ownership; remove authorised keys; then confirm the account cannot authenticate while the service still deploys.

This skill is self-contained. Every command below is a standard tool on both families (Debian/Ubuntu and RHEL); substitute the admin group and RHEL-only auth/SELinux layers per the Distro support matrix above. The sk-* scripts in the Optional fast path section are convenience wrappers — never required.

User Management

sudo adduser <username>                         # create (interactive)
sudo usermod -aG sudo <username>                # grant sudo
sudo deluser <username>                         # remove user (keeps home)
sudo deluser --remove-home <username>           # remove user + home
sudo passwd -l <username>                       # lock account
sudo passwd -u <username>                       # unlock account

# Audit
grep -v "nologin\|false" /etc/passwd | cut -d: -f1,3
grep ^sudo /etc/group                           # who has sudo
awk -F: '$3 == 0 {print $1}' /etc/passwd       # UID-0 accounts

SSH Key Management

# Add a key for a user
mkdir -p /home/<username>/.ssh
chmod 700 /home/<username>/.ssh
echo "<public-key>" >> /home/<username>/.ssh/authorized_keys
chmod 600 /home/<username>/.ssh/authorized_keys
chown -R <username>:<username> /home/<username>/.ssh

# Audit all keys on the server
find /home /root -name authorized_keys 2>/dev/null | \
    while read f; do echo "=== $f ==="; cat "$f"; done

# Revoke: edit the file, delete the key line
sudo nano /home/<username>/.ssh/authorized_keys

# Test before restarting SSH (keep existing session open!)
sudo sshd -t && sudo systemctl restart sshd

File Permissions — Quick Reference

# Web root standard
sudo find /var/www -type d -exec chmod 755 {} \;
sudo find /var/www -type f -exec chmod 644 {} \;
sudo chown -R www-data:www-data /var/www/html/
sudo find /var/www -type f -perm -0002 -exec chmod o-w {} \;   # remove world-write

# Critical system files
sudo chmod 640 /etc/shadow /etc/gshadow
sudo chmod 644 /etc/passwd /etc/group

# Backup credentials (must be 600)
chmod 600 ~/.mysql-backup.cnf ~/.backup-encryption-key
chmod 600 ~/.config/rclone/rclone.conf
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

Full permission patterns and audit commands: references/permissions-reference.md

Optional fast path (when sk-* scripts are installed)

Running sudo install-skills-bin linux-access-control installs:

These are optional wrappers. The manual commands above are the source of truth.

Scripts

This skill installs the following scripts to /usr/local/bin/. To install:

sudo install-skills-bin linux-access-control