ls -la /etc/passwd
# -rw-r--r-- 1 root root 2847 Jan 15 10:23 /etc/passwd
# │││││││││
# │││││││└── other: r-- (4)
# ││││││└─── group: r-- (4)
# │││││└──── owner: rw- (6)
# ││││└───── sticky/SGID/SUID bits
# │││└────── directory (d), file (-), link (l), etc.
# ││└─────── number of hard links
# │└──────── owner (root)
# └───────── group (root)

rwxrwxrwx = 777 (owner=7, group=7, others=7)
rw-r--r-- = 644 (owner=6, group=4, others=4)
rwxr-xr-x = 755 (owner=7, group=5, others=5)
rw------- = 600 (owner=6, group=0, others=0)

# Octal notation (most common)
chmod 755 script.sh        # rwxr-xr-x
chmod 644 config.txt       # rw-r--r--
chmod 600 ~/.ssh/id_rsa    # rw------- (private key — must be this)
chmod 700 ~/.ssh           # rwx------ (SSH dir)

# Symbolic notation
chmod u+x script.sh        # add execute for owner (user)
chmod g-w file.txt         # remove write from group
chmod o= file.txt          # remove ALL permissions from others
chmod a+r file.txt         # add read for all (a = u+g+o)
chmod u=rwx,g=rx,o= dir/   # set exact permissions symbolically

# Recursive
chmod -R 755 public/       # apply recursively to directory

# Change owner
chown alice file.txt

# Change owner and group
chown alice:developers file.txt

# Change group only
chgrp developers file.txt

# Recursive
chown -R www-data:www-data /var/www/html/

# SUID example — passwd runs as root
ls -la /usr/bin/passwd
# -rwsr-xr-x  (the 's' in owner = SUID)

# Sticky bit example — /tmp is world-writable but protected
ls -la /
# drwxrwxrwt  tmp   (the 't' = sticky bit)

umask           # show current umask (e.g., 022)
umask 027       # set new umask for session

# umask subtracts from maximum:
# Files max:  666 - 022 = 644
# Dirs max:   777 - 022 = 755

# Secure umask
umask 027       # files: 640, dirs: 750

# Add user
useradd -m -s /bin/bash alice          # -m creates home dir
adduser alice                           # interactive (Debian/Ubuntu)

# Set password
passwd alice

# Modify user
usermod -aG sudo alice                 # add to sudo group
usermod -aG docker,developers alice    # add to multiple groups
usermod -s /bin/zsh alice              # change shell
usermod -l newname alice               # rename user

# Delete user
userdel alice                          # keep home dir
userdel -r alice                       # remove home dir too

# Lock/unlock account
passwd -l alice                        # lock (prepends ! to password hash)
passwd -u alice                        # unlock
usermod -e 2025-12-31 alice            # set expiry date

# Create group
groupadd developers

# Delete group
groupdel developers

# Add user to group
usermod -aG developers alice           # -a = append (don't remove existing)
gpasswd -a alice developers

# Remove user from group
gpasswd -d alice developers

# Show user's groups
groups alice
id alice

# /etc/passwd — user accounts (world-readable)
# username:x:UID:GID:comment:home_dir:shell
cat /etc/passwd | grep alice
# alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash

# /etc/shadow — password hashes (root only)
# username:hash:last_change:min:max:warn:inactive:expire
sudo cat /etc/shadow | grep alice

# /etc/group — group definitions
# group_name:x:GID:member_list
cat /etc/group | grep developers
# developers:x:1002:alice,bob

# Run single command as root
sudo apt update
sudo -u postgres psql           # run as specific user

# Switch to root shell
sudo -i                         # login shell
sudo su -                       # same

# Switch to another user
su - alice                      # login shell as alice
su alice                        # non-login shell

# /etc/sudoers — grant sudo privileges
visudo                          # safe way to edit sudoers
# alice ALL=(ALL:ALL) ALL       # full sudo access
# alice ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx   # no-password specific command

# View ACL
getfacl file.txt

# Grant alice read+write to a file you own
setfacl -m u:alice:rw file.txt

# Grant developers group execute
setfacl -m g:developers:rx script.sh

# Remove ACL entry
setfacl -x u:alice file.txt

# Remove all ACL entries
setfacl -b file.txt