菜单
Use when creating, revoking, or auditing Linux users, groups, SSH keys, sudo/wheel access, PAM settings, SELinux user mappings, or file permissions. Use linux-secrets for credential material and linux-server-hardening for broader host policy.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/peterbamuhigire/linux-skills --skill linux-access-control命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | linux-access-control |
| description | Use when creating, revoking, or auditing Linux users, groups, SSH keys, sudo/wheel access, PAM settings, SELinux user mappings, or file permissions. Use linux-secrets for credential material and linux-server-hardening for broader host policy. |
| license | MIT |
| metadata | {"portable":true,"compatible_with":["claude-code","codex"],"author":"Peter Bamuhigire","author_url":"techguypeter.com","author_contact":"+256784464178"} |
Two-family skill. useradd/usermod/passwd, SSH keys, and /etc/sudoers.d/
work the same on both. The notable differences are the admin group and a
couple of RHEL-only auth/SELinux layers. Body uses Debian/Ubuntu; substitute
per this matrix.
| Concept | Debian/Ubuntu | RHEL family |
|---|---|---|
| Sudo admin group | sudo | wheel |
| Grant admin | usermod -aG sudo <u> | usermod -aG wheel <u> |
| User/group tools | useradd, usermod, passwd | identical |
| Sudoers drop-ins | /etc/sudoers.d/ | same |
| PAM config | /etc/pam.d/ | /etc/pam.d/ (managed via authselect on RHEL) |
| Password quality | libpam-pwquality | pam_pwquality (in pwquality.conf) |
| SELinux user mapping | n/a | semanage login maps Linux users → SELinux users |
RHEL-family note: the admin group is wheel, not sudo. RHEL manages the
PAM/nsswitch stack through authselect (don't hand-edit what it owns), and
SELinux can confine users (semanage login, semanage user). See
../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md
and docs/multi-distro/plan.md.
linux-firewall-ssl.linux-security-analysis or linux-server-hardening.| Artefact | Source | Required? | If absent |
|---|---|---|---|
| Target identities, groups, paths, keys, and requested privileges | Access request or system owner | required | Stay read-only and return the missing identity/scope. |
| Current account, group, sudoers, SSH, PAM, and file state | Target host | required | Do not mutate; provide inspection commands only. |
| Approval, expiry, owner, and recovery access | Authorised approver | required for mutation | Stop before granting or revoking access. |
chmod or chown without scoping the target. Fix: inspect boundaries and change only the named tree or files./etc/sudoers without validation. Fix: use a drop-in and validate with visudo before ending the recovery session.| Artefact | Consumer | Acceptance condition |
|---|---|---|
| Access decision/change record | System owner | Names identity, privilege, approver, expiry, files changed, and rationale. |
| Final-state verification | Operator | Login, group/sudo membership, key fingerprints, and affected permissions match the request. |
| Recovery note | On-call administrator | Preserves a tested alternate administrator and reversal steps. |
references/users-sudoers-pam.mdreferences/permissions-reference.md../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md — SELinux user confinement (RHEL family)| Artefact | Acceptance condition |
|---|---|
| Access-control evidence | Shows before/after identity state, key fingerprints, sudoers validation, affected modes, tested login/privilege behaviour, and approval. |
Audit requests default to read-only. Read access to account and permission state is required; editing users, groups, keys, PAM, sudoers, SELinux mappings, or files requires explicit authority. Never expose private keys or revoke the last tested administrator.
Without privileged access, report observable state and exact root-level checks as not assessed. Without a safe second login or console, stop before lockout-capable changes.
| Choice | Action | Failure or risk avoided |
|---|---|---|
| Temporary privileged task | Use narrow sudo command rules with expiry | Permanent broad administration. |
| Suspected compromised key | Disable that key, preserve evidence, rotate dependants | Continued unauthorised access. |
| Account departure | Disable, inventory ownership/jobs, transfer, then remove | Orphaned data and services. |
To offboard a deployment user, record current groups, keys, processes, cron jobs, and owned files; disable login; verify the replacement automation identity; transfer required ownership; remove authorised keys; then confirm the account cannot authenticate while the service still deploys.
This skill is self-contained. Every command below is a standard tool on
both families (Debian/Ubuntu and RHEL); substitute the admin group and
RHEL-only auth/SELinux layers per the Distro support matrix above. The
sk-* scripts in the Optional fast path section are convenience
wrappers — never required.
sudo adduser <username> # create (interactive)
sudo usermod -aG sudo <username> # grant sudo
sudo deluser <username> # remove user (keeps home)
sudo deluser --remove-home <username> # remove user + home
sudo passwd -l <username> # lock account
sudo passwd -u <username> # unlock account
# Audit
grep -v "nologin\|false" /etc/passwd | cut -d: -f1,3
grep ^sudo /etc/group # who has sudo
awk -F: '$3 == 0 {print $1}' /etc/passwd # UID-0 accounts
# Add a key for a user
mkdir -p /home/<username>/.ssh
chmod 700 /home/<username>/.ssh
echo "<public-key>" >> /home/<username>/.ssh/authorized_keys
chmod 600 /home/<username>/.ssh/authorized_keys
chown -R <username>:<username> /home/<username>/.ssh
# Audit all keys on the server
find /home /root -name authorized_keys 2>/dev/null | \
while read f; do echo "=== $f ==="; cat "$f"; done
# Revoke: edit the file, delete the key line
sudo nano /home/<username>/.ssh/authorized_keys
# Test before restarting SSH (keep existing session open!)
sudo sshd -t && sudo systemctl restart sshd
# Web root standard
sudo find /var/www -type d -exec chmod 755 {} \;
sudo find /var/www -type f -exec chmod 644 {} \;
sudo chown -R www-data:www-data /var/www/html/
sudo find /var/www -type f -perm -0002 -exec chmod o-w {} \; # remove world-write
# Critical system files
sudo chmod 640 /etc/shadow /etc/gshadow
sudo chmod 644 /etc/passwd /etc/group
# Backup credentials (must be 600)
chmod 600 ~/.mysql-backup.cnf ~/.backup-encryption-key
chmod 600 ~/.config/rclone/rclone.conf
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
Full permission patterns and audit commands: references/permissions-reference.md
Running sudo install-skills-bin linux-access-control installs:
| Task | Fast-path script |
|---|---|
| All users, UID, lock state, sudo, password age | sudo sk-user-audit |
| All authorized_keys across users | sudo sk-ssh-key-audit |
| Create user + SSH key + sudo in one step | sudo sk-new-sudoer --user <u> --key <file> |
| Lock or unlock a user account | sudo sk-user-suspend --user <u> --lock|--unlock |
These are optional wrappers. The manual commands above are the source of truth.
This skill installs the following scripts to /usr/local/bin/. To install:
sudo install-skills-bin linux-access-control
| Script | Source | Core? | Purpose |
|---|---|---|---|
| sk-user-audit | scripts/sk-user-audit.sh | yes | All users, UID/GID, lock state, password age, last login, sudoers. |
| sk-ssh-key-audit | scripts/sk-ssh-key-audit.sh | yes | All authorized_keys across users, key type/age/comment, orphaned keys. |
| sk-new-sudoer | scripts/sk-new-sudoer.sh | no | Create user, deploy SSH key, add to sudo group, verify with sudo -l. |
| sk-user-suspend | scripts/sk-user-suspend.sh | no | Lock or unlock a user account (passwd -l, usermod -s /usr/sbin/nologin), with audit log. |