Authentication and discretionary access

1.

Fundamentals of computer system
security
Authentication and discretionary access
16 march 2026

2.

Training questions
1) Authentication Basics
2) Discretionary access (DAC)
3) Practice: Access rights and ACL

3.

Identification, authentication, authorization
IDENTIFICATION
AUTHENTICATION
authorization
Who are you?
Prove it
What can I do?
user1, UID=1001
•••••••
rights rwx

4.

Authentication factors
knowledge
OWNERSHIP
INHERITED
PROPERTY
Password, PIN-code
Smart card, token
Fingerprint, retina
Two-factor authentication (2FA) – combination of factors

5.

Storing passwords in Linux
/etc/passwd
/etc/shadow
user:x:1001:1001:User:/home/user:/bin/b
ash
user:$6$salt$hash:18934:0:99999:7:::
Password hashes, access root
There are NO passwords! Only xash
$6$ = SHA-512, $5$ = SHA-256, $1$ = MD5, $y$ = yescrypt
Salt - random addition for hash uniqueness

6.

PAM (Pluggable Authentication Modules)
The app (login, sshd)
/etc/pam.d/login, common-password
auth
account
password
session
pam_unix.so
pam_unix.so
pam_cracklib.so
pam_limits.so

7.

Managing users and groups
useradd
-m -s /bin/bash
username
# create a user
passwd
username
# set a password
userdel
-r username
# delete a user
groupadd groupname
# create a group
usermod
-aG groupname username
# add to group
groups
username
# show groups
id
username
# information
cat /etc/passwd | grep username
# find a user

8.

Discretionary access (DAC) – rights rwx
-rw-r--r--
1 user
group
1st character: file type (-, d, l)
2-4: owner's rights (u)
5-7: group rights (g)
8-10: rights of others (o)
r (reading)
viewing content
w (recording)
changing the content
x (execution)
launching the program
1024
file.txt

9.

Numeric representation of rights (chmod)
r = 4, w = 2, x = 1
0
---
no rights
1
--x
execution only
2
-w-
recording only
3
-wx
recording + execution
4
r--
read only
5
r-x
read + execute
6
rw-
read + write
7
rwx
full access
chmod 755 script.sh
?
rwxr-xr-x

10.

Special attributes: SUID, SGID, Sticky-bit
SUID (4)
SGID (2)
Sticky-bit (1)
The program works from
the owner
Files inherit the group
Only the owner can
delete
drwxrws---rwsr-xr-x
Examples:
/usr/bin/passwd – has SUID (a regular user can change the password)
/tmp – has Sticky-bit (protection from deleting other people's files)
drwxrwxrwt

11.

Extended Access Lists (ACL)
Grant access to a specific user without changing the owner or creating new groups
getfacl file
# viewing ACL
setfacl -m u:user:rwx file
# grant rights to the user
setfacl -m g:group:rx file
# grant rights to a group
setfacl -x u:user file
# delete user rights
setfacl -b file
# delete all ACL
setfacl -m d:u:user:rw dir
# ACL by default for the folder

12.

Practical tasks
1. Create users user1, user2, user3
2. Create a group developers, add user1 and user2
3. Set up a password policy (minlen=8, numbers, special characters)
4. Set up blocking after 3 failed attempts
5. Create /home/projects/project_a with 750 user rights
6. Create a shared folder /home/shared with SGID
7. Create a folder /home/temp with Sticky-bit
8. Configure ACL: to give user3 file access user1

13.

Key findings
✅ Passwords are stored in /etc/shadow as hashes with salt
✅ PAM allows you to flexibly configure authentication
✅ Access rights rwx – the basis of the discretionary model
✅ SUID, SGID, Sticky-bit solve special tasks
✅ ACL they give you precise control without creating groups
✅ The file owner manages access itself (DAC)