Lion Cipher Lab
Role-based access control with Linux groups
- Identity & Access Management
- Beginner
- ~45 min
- Free · no account required
Why it matters
Granting access one person at a time does not survive contact with a real team: people join, change roles, and leave, and per-user grants quietly rot into a mess nobody can audit. RBAC is the fix everyone converges on — decide what each role may do once, then move people in and out of roles. Linux groups are the oldest, most universal form of it on the box, and getting them right is the everyday, defensive skill behind sharing files safely, passing an access-control audit, and shrinking the blast radius when one account is compromised.
What you'll learn
- Role-based access control (RBAC)
- Linux groups
- least privilege
- shared-directory permissions
- the setgid bit
- auditing group membership
Steps in this lab
- The idea: give access to roles, not to people
- Create groups for your roles (groupadd)
- Create the people who will fill the roles (useradd)
- Assign people to roles (usermod -aG)
- Build the shared resource and give it to a role (chgrp, chmod)
- Make new files inherit the role (the setgid bit)
- Prove the boundary, then revoke by removing from the role
- The honest limits — and the mindset to carry