Access control and least privilege
Cyber security Lesson 15 1:51 English narration · English + 中文 subtitles burned in
Chapters
Transcript
Least privilege says: give every person and every program only the access they need, and no more.
最小权限说的是： 给每个人、每个程序"只给他需要的那点权限"，多一点都不给。
The reason is not tidiness — it is what happens after something goes wrong.
理由不是为了整洁——而是为了出事之后会怎样。
Break into an administrator account and an attacker reaches every file, every user, and can install whatever they like.
攻破一个管理员账号，攻击者就能碰到每一个文件、每一个用户， 想装什么就装什么。
Break into a limited account and they reach less: one user's own files, and the damage stops there.
攻破一个受限账号，他能碰到的就少得多： 一个用户自己的文件，损失到此为止。
On Linux you can see access control directly — you met these in the Linux course.
在 Linux 上，访问控制是你能直接看见的—— 你在 Linux 课里见过它们。
Run l s minus l and the first ten characters tell you everything.
运行 ls -l，开头那十个字符就把一切说清楚了。
The first says what kind of thing it is.
第一个字符说明这是什么类型的东西。
The other nine are three groups of three: read, write, execute, for the owner, then the group, then everyone else.
剩下九个是三组三个： 读、写、执行，先是属主，然后是同组，最后是其他所有人。
Now lock something down.
现在来把一个东西锁上。
A file holding a password or a key should be readable by its owner and nobody else, and chmod six zero zero does exactly that.
一个装着密码或密钥的文件，应该只有属主读得到，别人都不行， 而 chmod 600 干的正是这件事。
Look at the three digits: six is read plus write, for the owner.
看那三个数字：6 是"读加写"，给属主。
The two zeros give the group and everyone else no access at all.
两个 0 让同组和其他所有人完全没有权限。
Run l s minus l again and the six characters on the right have gone.
再跑一次 ls -l，右边那六个字符就消失了。
Four things to take with you.
带走四点。
One: give every person and program only what it needs.
第一：给每个人、每个程序只给它需要的那点权限。
Two: do not use an administrator account for daily work.
第二：不要用管理员账号做日常工作。
Three: file permissions are access control you can see.
第三：文件权限就是你看得见的访问控制。
Four: chmod six zero zero leaves a secret readable by its owner only.
第四：chmod 600 让一个秘密只有属主读得到。
Now lock down the file in the task below.
现在去下面的题里把那个文件锁上。