How to Restrict Access to Authorized Users

[silverfisk]

How to Restrict Access to Authorized Users

To restrict access to luks-keeper and prevent unauthorized local accounts from running privileged operations, you should use a standard Linux file permission model based on group ownership.

Step-by-Step Implementation:

1. Create a Dedicated System Group:
   First, create a new system group specifically for users who are authorized to use luks-keeper. This isolates permissions from default user groups.

   sudo groupadd --system luks-keeper-users

2. Set Secure File Ownership and Permissions:
   The luks-keeper executable must be owned by root and the new luks-keeper-users group. The file permissions should be configured to only allow execution by the owner (root) and members of that group.

   Assuming luks-keeper is installed at /usr/local/bin/luks-keeper:

   # Set the ownership to root and the dedicated group
   sudo chown root:luks-keeper-users /usr/local/bin/luks-keeper
   
   # Set file permissions:
   # - rwx (read, write, execute) for the owner (root)
   # - r-x (read, execute) for the group (luks-keeper-users)
   # - --- (no permissions) for all other users
   sudo chmod 750 /usr/local/bin/luks-keeper

   This configuration effectively blocks any user who is not in the luks-keeper-users group from executing the tool.

3. Authorize Users:
   To grant a user the ability to run luks-keeper, add their account to the dedicated group:

   sudo usermod -aG luks-keeper-users <username>

This strategy ensures that access is explicitly granted and managed to prevent unauthorized use.