Export translations

Settings

Group

Language

Format

Export for off-line translation

Export in native format

<languages/>
__TOC__

<div lang="en" dir="ltr" class="mw-content-ltr">
=Overview=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
System security is a complicated topic that individuals study for many years.  It would be impractical to impart even a fraction of that knowledge in a Wiki article.  What this page will attempt to do is provide a primer in the most basic elements of Linux security and identify common pitfalls for beginners
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=Users=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
User accounts are used to log into the system and provide one of the basic building blocks for permissions.  You could loosely categorize users into a few categories:
* Regular user accounts like the one created for you during install.
* Accounts used to run specific processes.  These users are often named after the service they run.  For example the {{ic|dbus}} users is user to run the master dbus process.
* The {{ic|root}} account.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
The root account is an administrator or superuser account.  This account to everything in the system and be used with extreme care.  In most cases, it shouldn't be used at all.  Instead use {{ic|sudo}}.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
The command {{ic|sudo}} lets you run a command as the root user without actually switching to the root user.  In many cases this is safer than using the root user directly as only a single command is being run as root.  For example, your normal user account would not be able the file {{ic|/etc/fstab}} because it is owned by root.  However, you can edit it with sudo like this:
 sudo nano /etc/fstab
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
When you run this command, you will be asked for a password, this will be the password of your normal user account.<br />
For more information about editing configuration files owned as root see [[Viewing_and_editing_configuration_files|this article on configuration files]].
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
While {{ic|sudo}} and {{ic|su}} look similar and both involve root access they are very different.  {{ic|sudo}} runs a single command as another user and requests the password of your normal user account.  {{ic|su}} lets you *become* root and requests the password of the root user.  In general, it is usually safer to use sudo than to use su.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
{{BoxWarning|Warning|Never run a graphical program as root or with sudo, it should only be used with command line programs}}
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
==Why am I Asked for a Password==
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Sometimes you will take an action in the terminal or through a GUI application and will get prompted for your password.  This is because the action you are trying to take cannot be completed by you user and requires elevated rights.  Whenever you get a password prompt like this it is important to pause and think if the action you are taking *should* be asking for elevated rights before entering your password.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
{{BoxInfo|Note|Usually these password prompts will be looking for the password of your normal user account but occasionally they will need the password of the root account}}
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=Changing Passwords=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
To change the password of the user account you are logged in as you can use the command:
 passwd
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
To change the password of a different user on the same system you can use sudo:
 sudo passwd USERNAME
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=Groups=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Users on a Linux system are commonly arranged in groups. A user group is a convenient way of assigning more users access to a common task like sound, media, printing and mounting of removable drives etc.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
A list of the current groups can be seen on the system with the command:
 getent group | awk -F : '{print $1}'
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
To see which groups a given user belongs to use the command
 groups USERNAME
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
==Primary Groups==
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
A user can be a member of any number of groups but they have only one primary group.  The primary group is the group used when files are created.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=File Permissions=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
At the most basic level, files are designated as '''r'''ead, '''w'''rite or e'''x'''ecute to the '''u'''ser(owner), the '''g'''roup and '''o'''ther.  To understand how this works let's look at a real world example.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
To get the permissions on the file we can use the command {{ic|ls -l}}.
 ls -l /etc/fstab
 -rw-r--r-- 1 root root 539 Dec 26 23:07 /etc/fstab
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
That first group of letters and dashes indicate the permissions.  It is 10 characters long and the dashes indicate a lack of permissions.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
* The first character "-", represents the file type, "-" indicates that it is a normal files.
* The next three characters "rw-" indicate the permissions for the user or owner of the file.  In this case reading and writing are allowed but not executing.
* The next three characters "rw-" indicate the permissions for members of the group who owns the file.  In this case reading and writing are allowed but not executing.
* The next three characters "r--" indicate the permissions for other users.  In this case reading is allowed but not writing or executing.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
From more detailed information on how file permissions are broken down take a look at [https://en.wikipedia.org/wiki/File_system_permissions#Traditional_Unix_permissions this Wikipedia article]
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
==Changing File Permissions==
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
The command {{ic|chmod}} can be used to change permissions on a file or directory.  It is probably easier to demonstrate than explain.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Add read rights to the user(owner) of the file
 chmod u+r filename
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Remove execute rights to members of the group owner of filename
 chmod g-x filename
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Set the rights for the other group to read only
 chmod o=r filename
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Of course, in normal use you would combine everything like this:
 chmod u+rw,g=r,o-rwx filename
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
This adds read and write to the owner, set the group as read only and remove read, write and execute from other users
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
The chmod command can do a lot more than that.  For more information take a look at [https://en.wikipedia.org/wiki/Chmod Wikipedia's chmod reference]
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=Firewalls=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
The [[Firewalls]] article has a full description of the Firewall solutions available on Manjaro.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=File Integrity Monitoring=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
Your first line of defense should always be security practices that prevent an intrusion such as firewalls, intrusion prevention systems and keeping your system patched and up-to-date.  However, it is also useful to try to ensure that your system has not been compromised.  One way to help with this is by using a file integrity monitoring solution.  These solutions work by comparing the checksums or the files on your system to their previous versions and alerting about changes.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
An open source tool which provides this service is [https://aide.github.io/ AIDE](Advanced Intrusion Detection Environment.  You can install it with the command:
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
pamac install aide
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
=Sandboxing=
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
A '''Sandbox''' is a security mechanism for separating running programs, usually in an effort to mitigate system failures or software vulnerabilities from spreading.
</div>

<div lang="en" dir="ltr" class="mw-content-ltr">
One method of sandboxing is using Firejail.  Please the [[Firejail|Firejail Wiki page]] for more information on installing and configuring Firejail.
</div>

[[Category:Contents Page{{#translation:}}]]