Access Control and Permissions

One of the ways that we can keep our data safe is by practicing good access control. That is, we can set up users on our system and only allow certain users to gain access to certain data. We set up what's called permissions.

Let's say we have a folder that has some sensitive data inside of it. Well, what we can do is practice access control: only allow certain people to access this particular folder. And so we do that by setting up users and giving those users permissions to be able to access that data. There are two different ways that we could set this up. One of them is by user: we would set up a user on the system and then give the user permissions into this folder, therefore giving them permissions to everything inside of that folder.

Creating a user

I'm on my demo machine here, and what we're going to do is play around first of all with seeing what these users look like on this machine, and then we're going to give them permissions into a folder. So let's first of all take a look at the users. What I'm going to do is click on the start button right here and type in computer management and hit enter. What will pop up here is a bunch of different tools that I can manage the computer with. Now, there are different ways I can add accounts to this computer, but this is the way that I like to do it. So I'm going to click on this users folder right here, and you can see that I've already created this demo user account right here, and then I've also created this example.

If I wanted to create another account, I could just right-click on here and say new user. So a new user pops up. What is the username for this? Maybe I'm going to give this as example two for this user. Give it a full name - I'm just going to say example two - and then a password, and then we would come up with some sort of password that we could remember for this, or that we give them. And then it says user must change password at next logon. I'm going to just uncheck that, and we're just going to keep this all by the defaults beyond that. And then I'm going to create this user. So now I've got this example two that's created on here. I can close this out and we can see example two right there. So that's how to create a user on this computer.

Giving a user permissions to a folder

Next, we're going to go to this test folder right here. I'm going to right-click on this, and let's say I just want to give access to certain people on here. So I'm going to go into the properties of here, and I see this security tab. So I can click on the security tab, and here I've got the demo user. Let's say I want to add one of those examples now. So I click on edit to edit this, I'm going to add, and I'm going to add one of those users, so maybe I'm going to do example two. I will check the name here and it finds that account. So now we have that account. I'll click on OK, and then I can select what level do I want them to have access.

I can read and execute, I can list folder contents, I can read. So the read would be that they could just open up a document. The read and execute means they could actually be able to execute some sort of program. Or here's the list folder contents, to open up the folder and see. So at this point in time they can't really do much with this unless I click on write. Now they can start adding documents to that folder. If I click on modify, now they can modify other documents that are already in that folder. Or if I click on full control, now they can actually change the permissions of this folder.

So then I'm going to click OK and then we have implemented that. There are advanced settings that I can go in here, but for now you can see that I've just given pretty much full control to this example two. I'm going to click on OK, and now when that user logs into the system they have access to this folder, versus example, the other account that I had, would not have access to this. So example two does have access now; example one does not have access to this test folder.

Using groups instead

Now imagine you had a hundred users that you had to grant access into that folder. That could be really problematic. So we do have something called groups too, and there's a lot of advantages to using groups. What we can do instead is add users to a group and then the group to that folder as well. So that would be another way that we could go about doing this.

If I wanted to add a group to this, what I could do is click on the start menu and type in computer management. I'm going to go to that same location where I manage the users. Once again, there are different ways that I can manage this, but we're going to go to here - this gives us a great visual on how this looks. There's this groups right here. I can see that there's already quite a few groups on here by default, but I'm going to create a new one. So, a new group, and I'm going to just give them access to this test folder, so I called this test folder access, and that is the name of this group. And then I can add members to it. So maybe I want to add example and hit enter, and I'm also going to add example two. Now I'm going to click on create, and now that group is in the system.

Now if I wanted to give that group access to this test folder, I would just get into the permissions of this. I'll go to the security tab, I'll hit edit - I'm going through the same process - but what I'm going to do is add this test folder access. I'll do test folder access, try that out, and there, now we can give them access. And what level do I want? Well, maybe I want them to be able to write and modify, but I don't want to give them full control, so they don't have access to change the permissions here. So then we're going to click on OK, and I'll click OK again, and now this group, everybody part of this group, has access to this test folder.

NTFS permissions and Linux permissions

Now what I've shown you is the way that Microsoft gives access to files and folders. They're called NTFS permissions, and there's a lot of different ways that we can set this up. In fact, I really love how NTFS sets up their permissions. It gives us a lot of flexibility in the ways that we can give access to certain files and folders, and we can do it also on a per file basis, so it doesn't necessarily have to be just on the folder level, it can be on the file level as well.

Linux permissions are much more basic in how they operate. From two different levels: you can't add multiple users or groups, it's just one user or one group. The other thing is the level of permissions is very high level. I mean, you can either read, write or execute, so there's only three levels of permissions that you can really add to the user - a single user, a single group, or other, which would be everyone else.

And so what we do is we would allow the user, which would be the owner of this file: do we want them to read? Well, probably. Do we want them to write? Maybe. And do we want them to execute? So then we would turn all of those on. For the group, maybe we want them just to be able to read and write, and for the rest of the world maybe we want them to just read. So we give this level of permissions to those users, groups and the rest of the world.

Reading Linux permissions

I'm on a Linux box here. So what I'm going to do is just say ls, which is list, so it's going to list the contents of the directory. And I'll just do a present working directory to see where I'm at. I'm in the home and then the administrator account here. So I'm going to do an ls to list what's inside of here, and we'll do -l to see what some of the additional information is.

One of the additional pieces of information that it shows us is the permissions here. The first set of rwx here is the user, the second one is the group, and the third one is going to be everyone else. So whatever user is assigned to this folder, which is administrator right here, we see this is the administrator, so the administrator has read, write and execute permissions. And then whoever is part of the administrator group - so we see a group right here - has the rights to read and execute, and then everyone else has the rights just to read and execute.

So we look further down here, we have this folder snap right here, and just the user administrator has the read, write and execute level on this. And the group, whoever's part of the administrator group, doesn't have really any permissions at all, and same thing with the rest of the world, it doesn't have permissions into that folder. So that's how we would take a look at the permissions of these different directories, these different folders that we see right here.

I do have a visual of here's a folder right here, and what I can do is right-click on this folder and go to properties. We can see the permissions from a visual perspective. Here's the permissions. I'm going to click on there, and we can see the owner is administrator, so that's the user, and the group right here, and the level of permission here is the group level administrator and the access that the group has, and then everyone else, and so they can just access files. So what I want to maybe do is change the group to be a different group. And so I'm going to choose one of the groups here. We'll just say the users, and then the users, what do I want them to be able to do? Maybe I just want them to be able to list files only. So there, I've changed the permissions now.