3.2 User Accounts, Groups & Access Control

User Accounts, Groups & Access Control

In modern multi-user enterprise computing environments, controlling access to files, processes, and system configurations is critical to maintaining data confidentiality, system integrity, and availability. System administrators must ensure that authenticated users have the exact level of access necessary to perform their roles—and no more. This chapter explores identity management, privilege elevation, and filesystem access control mechanics across both Linux and Windows operating systems.

---

1. User & Group Security Foundations

The Principle of Least Privilege (PoLP)

The Principle of Least Privilege (PoLP) is a fundamental security concept stating that every user account, process, service, and program must operate using only the minimal set of privileges necessary to accomplish its legitimate purpose.

• Prevents accidental system-wide damage caused by administrative human error.
• Restricts the blast radius of malware infections and compromised application vulnerabilities.
• Ensures regulatory compliance with enterprise security frameworks (e.g., ISO 27001, SOC 2, NIST 800-53).

Account Classifications

1. Superuser Accounts: Possess unrestricted, god-mode authority over the operating system.
   • Linux: The root account (User ID 0). root can modify any file, kill any process, load kernel modules, and bypass all standard permission checks.
   • Windows: The built-in Administrator account and the NT AUTHORITY\SYSTEM account (used by the operating system kernel and background core services).
2. Standard User Accounts: Created for human employees. Standard accounts have read/write access to their personal profile directories (/home/username or C:\Users\Username), but cannot install system-wide software, modify OS files, or alter other users' private data.
3. Service / Daemon Accounts: Non-interactive accounts utilized by background services and server software (e.g., www-data, nginx, mysql, sshd in Linux; NETWORK SERVICE, LOCAL SERVICE in Windows). These accounts are configured without interactive login shells to prevent unauthorized interactive access if the service is compromised.

Role-Based Access Control (RBAC) via Groups

A Group is a collection of user accounts managed as a single security principal. Instead of assigning individual file permissions to dozens of separate users, permissions are assigned directly to a group (e.g., developers, accounting, sysadmins). Adding or removing a user from the group automatically updates their effective access rights, streamlining enterprise lifecycle management.

---

2. Linux User & Group Administration

Linux systems maintain user and group identity information across three core plaintext configuration files in the /etc directory.

+-----------------------------------------------------------------------------+
|                   LINUX IDENTITY CONFIGURATION FILES                        |
|                                                                             |
|   /etc/passwd (World-readable: 0644 / -rw-r--r--)                           |
|   +---------------------------------------------------------------------+   |
|   | username:x:1001:1001:Alice Smith,Room 402:/home/alice:/bin/bash     |   |
|   |    [1]   [2] [3]  [4]          [5]              [6]        [7]      |   |
|   +---------------------------------------------------------------------+   |
|   [1] Username [2] Password Placeholder ('x') [3] User ID (UID)             |
|   [4] Primary Group ID (GID) [5] GECOS/Comment [6] Home Directory [7] Shell |
|                                                                             |
|   /etc/shadow (Restricted Read: 0640 or 0600 - root / shadow group only)    |
|   +---------------------------------------------------------------------+   |
|   | alice:$6$salt$hashed_str:19750:0:90:7:::                            |   |
|   |   [1]         [2]          [3]  [4][5][6][7][8][9]                  |   |
|   +---------------------------------------------------------------------+   |
|   [1] Username [2] Salted Cryptographic Hash ($6$ = SHA-512)                |
|   [3] Days since epoch of last password change [4] Min days between changes |
|   [5] Max days password valid [6] Warn days before expiry [7] Inactive days |
|   [8] Account expiration date [9] Reserved flag                             |
|                                                                             |
|   /etc/group (World-readable: 0644 / -rw-r--r--)                            |
|   +---------------------------------------------------------------------+   |
|   | developers:x:1002:alice,bob,carol                                   |   |
|   |    [1]     [2] [3]      [4]                                         |   |
|   +---------------------------------------------------------------------+   |
|   [1] Group Name [2] Group Password Placeholder [3] Group ID (GID)          |
|   [4] Comma-separated list of secondary/supplementary group members         |
+-----------------------------------------------------------------------------+

Linux Account Management Commands

• useradd: Creates a new user account.
  • sudo useradd -m -s /bin/bash -c "Alice Smith" -g developers -G sudo alice
    • -m: Generates the home directory (/home/alice).
    • -s /bin/bash: Sets the default interactive login shell.
    • -c "...": Sets the comment/GECOS full name.
    • -g developers: Assigns the primary GID.
    • -G sudo: Appends supplementary groups (e.g., administrative sudo group).
• usermod: Modifies an existing user account.
  • sudo usermod -aG docker bob: Appends (-a) the user bob to the supplementary (-G) docker group. (Omitting -a when using -G will accidentally overwrite and remove the user from all other supplementary groups!)
  • sudo usermod -L alice: Locks an account (prepends ! to password hash in /etc/shadow).
  • sudo usermod -U alice: Unlocks a locked account.
• userdel: Deletes a user account.
  • sudo userdel -r alice: Deletes the user alice and recursively purges (-r) their home directory and mail spool.
• groupadd & groupdel: Creates (groupadd developers) or deletes (groupdel developers) group entries.
• passwd: Changes account passwords.
  • passwd: Allows standard users to change their own password.
  • sudo passwd alice: Allows administrators to reset a user's password.
  • sudo passwd -e alice: Forces alice to change her password immediately upon next login.

Privilege Escalation: su vs. sudo & visudo

1. su (Switch User): Switches the current terminal session to another user account (defaulting to root if no username is provided).
   • su: Retains the original user's environment variables and working directory.
   • su - (or su -l): Starts a full login shell, completely clearing the environment and loading root's $PATH, environment variables, and home directory (/root).
   • Drawback: Requires sharing the central root password among multiple administrators, violating non-repudiation and auditability.
2. sudo (Superuser Do): Allows authorized users to execute specific administrative commands using their own personal password.
   • Maintains granular audit logs in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/Rocky).
   • Access is controlled via /etc/sudoers.
3. visudo: The mandatory utility used to edit /etc/sudoers. visudo locks the sudoers file against concurrent edits and validates syntax before saving, preventing syntax errors that would lock all administrators out of sudo access.

# /etc/sudoers rule syntax:
# User/Group   Hosts=(RunAs_Users:RunAs_Groups)   Commands
alice          ALL=(ALL:ALL)                      ALL
%sudo          ALL=(ALL:ALL)                      ALL
%webadmins     ALL=(ALL)                          NOPASSWD: /usr/bin/systemctl restart nginx

---

3. Linux File Permissions & Ownership

Every file and directory in Linux is bound to an Owner (User) and an owning Group. The operating system evaluates permissions using a 3x3 security matrix: User (u), Group (g), and Others (o).

+-----------------------------------------------------------------------------+
|                      LINUX FILE PERMISSION MATRIX                           |
|                                                                             |
|   -  r w x  r - x  r - -    1  alice  developers  4096  Aug 21 14:00  app.sh|
|   |  \_____/  \_____/  \_____/    |    |      |         |                 |   |
|  [1]   [2]     [3]     [4]     [5]  [6]    [7]       [8]               [9]  |
|                                                                             |
|   [1] File Type: '-' (Regular File), 'd' (Directory), 'l' (Symlink)         |
|   [2] Owner Permissions (rwx = 4+2+1 = 7)                                   |
|   [3] Group Permissions (r-x = 4+0+1 = 5)                                   |
|   [4] Others Permissions (r-- = 4+0+0 = 4)                                  |
|   [5] Hard Link Count                                                       |
|   [6] User Owner ('alice')                                                  |
|   [7] Group Owner ('developers')                                            |
|   [8] File Size in Bytes                                                    |
|   [9] File Name                                                             |
+-----------------------------------------------------------------------------+

Permission Bit Values

[!IMPORTANT] Directory Execute Bit Rule: Having Read (r) permission on a directory allows you to view file names, but without Execute (x) permission, you cannot cd into the directory, read file metadata, or open files within it!

Changing Modes: chmod

• Octal (Numeric) Mode: Combines octal values (4+2+1=7, 4+0+1=5, etc.).
  • chmod 755 script.sh (rwxr-xr-x): Owner has full control; Group and Others can read and execute.
  • chmod 644 document.txt (rw-r--r--): Owner can read/write; Group and Others can read only.
  • chmod 600 id_rsa (rw-------): Owner can read/write; Group and Others have zero access (required for SSH private keys).
  • chmod 700 private_dir/ (rwx------): Only the owner can access and traverse the directory.
• Symbolic Mode: Targets specific classes (u=user, g=group, o=others, a=all) with operators (+ add, - remove, = set).
  • chmod u+x deploy.sh (Adds execute permission for user owner)
  • chmod g-w,o-r secret.txt (Removes write from group, removes read from others)
  • chmod a+r public.html (Grants read access to everyone)

Changing Ownership: chown & chgrp

• sudo chown alice file.txt: Changes user owner to alice.
• sudo chown alice:developers file.txt: Changes user owner to alice and group to developers.
• sudo chown -R www-data:www-data /var/www/html: Recursively (-R) updates ownership across an entire directory tree.
• sudo chgrp developers file.txt: Changes group ownership only.

Special Permissions (SUID, SGID, Sticky Bit)

Beyond standard read/write/execute bits, Linux provides three specialized permission modes:

+-----------------------------------------------------------------------------+
|                       SPECIAL PERMISSION BITS                               |
|                                                                             |
|   [SUID: Set Owner User ID] (Octal 4000)                                    |
|   - Applied to: Executable Binaries (e.g., /usr/bin/passwd)                 |
|   - Mode Display: -rwsr-xr-x (User execute bit displays 's' or 'S')         |
|   - Function: Process executes with privileges of the FILE OWNER (root),    |
|     rather than the calling user, allowing safe privileged tasks.          |
|                                                                             |
|   [SGID: Set Group ID] (Octal 2000)                                         |
|   - Applied to: Directories (collaborative team shared folders)             |
|   - Mode Display: drwxr-sr-x (Group execute bit displays 's' or 'S')        |
|   - Function: Newly created files inherit the PARENT DIRECTORY'S group,     |
|     rather than the creator's primary group.                                |
|                                                                             |
|   [STICKY BIT] (Octal 1000)                                                 |
|   - Applied to: Shared World-Writable Directories (e.g., /tmp, /var/tmp)    |
|   - Mode Display: drwxrwxrwt (Others execute bit displays 't' or 'T')       |
|   - Function: Only the FILE OWNER or root can delete or rename a file,      |
|     preventing users from deleting each other's temporary files.            |
+-----------------------------------------------------------------------------+

• Setting SUID: sudo chmod 4755 /usr/local/bin/custom_tool or chmod u+s file
• Setting SGID: sudo chmod 2775 /var/shared/devs/ or chmod g+s dir/
• Setting Sticky Bit: sudo chmod 1777 /tmp or chmod +t /tmp

---

4. Windows User Management & Security Architecture

Windows stores local user security accounts in the Security Accounts Manager (SAM) database registry hive (C:\Windows\System32\config\SAM).

+-----------------------------------------------------------------------------+
|                   WINDOWS USER ACCOUNT CONTROL (UAC)                        |
|                                                                             |
|   [INTERACTIVE ADMINISTRATOR LOGON]                                         |
|                 |                                                           |
|                 v                                                           |
|   [LOCAL SECURITY AUTHORITY (LSASS.EXE)]                                    |
|   - Generates Full Administrator Access Token                               |
|   - Filters Token: Strips administrative privileges & RID 500 rights        |
|                 |                                                           |
|                 v                                                           |
|   +---------------------------------------------------------------------+   |
|   | STANDARD USER TOKEN (Default Explorer.exe & Child Application Shell)|   |
|   | - Can browse web, write to User Profile, read shared files          |   |
|   | - CANNOT write to C:\Windows, modify registry HKLM, or install apps  |   |
|   +---------------------------------+-----------------------------------+   |
|                                     |                                       |
|                 APPLICATION REQUESTS PRIVILEGED ACTION                      |
|                                     v                                       |
|   +---------------------------------------------------------------------+   |
|   | USER ACCOUNT CONTROL (UAC) CONSENT PROMPT (Secure Desktop Switch)   |   |
|   | - Dimmed screen isolated from malware keystroke logging             |   |
|   | - Click [YES] to elevate -> Application spawned with FULL ADMIN TOKEN|   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

Windows Administration Consoles & PowerShell

• lusrmgr.msc: The Microsoft Management Console (MMC) snap-in for managing Local Users and Groups on Windows Pro/Enterprise editions.
• PowerShell Local User Management Cmdlets:

  # Create a new local user with password
  $Password = Read-Host -AsSecureString "Enter password"
  New-LocalUser -Name "Alice" -Password $Password -FullName "Alice Smith" -Description "Developer Account"
  
  # Add user to the local Administrators group
  Add-LocalGroupMember -Group "Administrators" -Member "Alice"
  
  # View local user accounts and status
  Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordRequired
  
  # Disable a compromised account
  Disable-LocalUser -Name "Bob"
  

User Account Control (UAC) Mechanics

User Account Control (UAC) mitigates the risk of malware executing unauthorized administrative actions. Even when an account belongs to the Administrators group, Windows logs the user in with a filtered standard user token by default.

• When a program requires elevated privileges (e.g., modifying system files in C:\Windows\System32 or installing device drivers), Windows invokes the Application Information Service (appinfo.dll).
• The system transitions to the Secure Desktop (an isolated session immune to window messaging tampering) and presents a prompt:
  • Consent Prompt: For administrators (clicking Yes attaches the elevated administrative token).
  • Credential Prompt: For standard users (requires entering an administrator's credentials to elevate).

---

5. Windows NTFS Permissions & Share Access Control

Windows NT File System (NTFS) provides granular access control via Access Control Lists (ACLs) comprised of individual Access Control Entries (ACEs).

NTFS Permission Hierarchy

NTFS Inheritance & Conflict Resolution Rules

When evaluating access requests across multiple group memberships and inheritance chains, Windows applies strict precedence rules:

1. Explicit Deny (Configured directly on the object) overrides everything.
2. Explicit Allow (Configured directly on the object).
3. Inherited Deny (Inherited from a parent folder).
4. Inherited Allow (Inherited from a parent folder).
5. Cumulative Allow: If a user belongs to Finance (Read) and Auditors (Modify), their effective NTFS permission is Modify (the union of all Allow permissions).

+-----------------------------------------------------------------------------+
|                SHARE PERMISSIONS VS. NTFS PERMISSIONS                       |
|                                                                             |
|   [REMOTE CLIENT OVER NETWORK (SMB / CIFS)]                                 |
|                       |                                                     |
|                       v                                                     |
|   +-------------------------------------------------------+                 |
|   | NETWORK SHARE PERMISSIONS (Read, Change, Full Control)|                 |
|   | Example: Share Permission = CHANGE                    |                 |
|   +---------------------------+---------------------------+                 |
|                               |                                             |
|                               v                                             |
|   +-------------------------------------------------------+                 |
|   | LOCAL NTFS PERMISSIONS (Read, Modify, Full Control)   |                 |
|   | Example: Local NTFS Permission = READ                 |                 |
|   +---------------------------+---------------------------+                 |
|                               |                                             |
|                               v                                             |
|   +-------------------------------------------------------+                 |
|   | EFFECTIVE ACCESS = MOST RESTRICTIVE WINS              |                 |
|   | Result: READ ONLY (Change INTERSECT Read = Read)      |                 |
|   +-------------------------------------------------------+                 |
+-----------------------------------------------------------------------------+

Network Share Permissions vs. NTFS Permissions

• Share Permissions: Applied only when accessing resources over the network via Server Message Block (SMB/Shared Folders). Configurable options: Read, Change, and Full Control.
• NTFS Permissions: Applied consistently whether the user logs in locally at the console or connects remotely over the network.
• Effective Permission Calculation Rule: When accessing a shared folder over the network, Windows evaluates both sets of permissions independently. The Most Restrictive Permission Wins (the intersection of Share and NTFS rights).