Linux: フェーズ2ミニプロジェクト — マルチユーザー開発環境の設定

# 1. Each person has their own account and home directory
sudo useradd -m -s /bin/bash alice
sudo useradd -m -s /bin/bash bob
sudo useradd -m -s /bin/bash charlie

# 2. Shared project directory (SGID ensures group inheritance)
sudo mkdir -p /srv/project
sudo chgrp developers /srv/project
sudo chmod 2775 /srv/project

# /srv/project is the shared directory
sudo chown root:developers /srv/project
sudo chmod 2775 /srv/project
# 2 = SGID (new files inherit group)
# 775 = Owner and group can read/write/execute, others can read/execute

> ⚠️ 注意：`chmod 2775`の`2`はSGIDを表します — 共有ディレクトリにSGIDが設定されると、そこで作成される新規ファイルは自動的にディレクトリのグループを継承します（作成者のプライマリグループではなく）。これがチーム協業のキーメカニズムです。SGIDがなければ、新規ファイルは作成者のプライマリグループに属し、他のチームメンバーが修正できない可能性があります。

# View default skel contents
ls -la /etc/skel/

# Add custom configuration for all new users
sudo tee -a /etc/skel/.bashrc << 'EOF'

# ---- Team standard configuration ----
alias ll='ls -la'
alias ..='cd ..'
export EDITOR=vim
EOF

# Create a shared group
sudo groupadd developers

# Create accounts for three developers
for user in alice bob charlie; do
    sudo useradd -m -s /bin/bash "$user"
    sudo passwd "$user"      # Set password interactively
    sudo usermod -aG developers "$user"
    echo "User $user created"
done

# Verify
grep developers /etc/group

# Create shared project directory
sudo mkdir -p /srv/project/{src,docs,scripts}

# Set the group
sudo chgrp -R developers /srv/project

# Set SGID + standard permissions
sudo chmod 2775 /srv/project
# 2 = SGID
# 7 = Owner (rwx)
# 7 = Group (rwx)
# 5 = Others (r-x)

# Test: create a file as a different user and verify group inheritance
sudo -u alice touch /srv/project/test.txt
ls -l /srv/project/test.txt
# -rw-r--r-- 1 alice developers 0 Jul 7 12:00 test.txt
# File belongs to developers group ✅

# Set a unified umask for the team (so shared files are writable by default)
echo 'umask 002' | sudo tee -a /etc/bash.bashrc

# Effect of 002:
# File: 666 - 002 = 664 (rw-rw-r--)
# Directory: 777 - 002 = 775 (rwxrwxr-x)
# This way group members can modify each other's files

> ℹ️ 注意：チーム協業では、統一umask 002によりグループメンバーが互いのファイルを修正できます。ただしセキュリティに注意 — 複数チームが共有するサーバーでは002は緩すぎる可能性があります。SGID + 002は共有ディレクトリのみに使用し、ユーザーのホームディレクトリはデフォルト022を維持することを推奨します。

# Xiao Ming likes a colorful prompt
cat >> ~/.bashrc << 'EOF'
export PS1='\[\033[1;32m\]\u\[\033[0m\]:\[\033[1;34m\]\w\[\033[0m\]\$ '
alias ll='ls -lah'
EOF
source ~/.bashrc

# Bob likes it simple
cat >> ~/.bashrc << 'EOF'
export PS1='\w\$ '
alias l='ls -CF'
EOF
source ~/.bashrc

# Create a group
sudo groupadd devops

# Add Xiao Ming to the devops group (he can manage system services)
sudo usermod -aG devops charlie

# Configure sudo privileges by group
echo '%developers ALL=(ALL) ALL' | sudo tee /etc/sudoers.d/developers
echo '%devops ALL=(ALL) NOPASSWD: /usr/bin/systemctl, /usr/bin/apt' | sudo tee /etc/sudoers.d/devops

> 💡 ヒント：sudo権限管理の推奨アプローチは「グループ原則」 — 役割別にグループを作成し（例：developers、devops）、各グループごとに`/etc/sudoers.d/`に個別ファイルを作成します。これにより、ユーザーの追加・削除はグループのメンバーシップを変更するだけで済み、sudoersファイルを繰り返し編集する必要がありません。

# Set permissions
sudo chmod 440 /etc/sudoers.d/*

#!/bin/bash
# setup-multi-user.sh - Set up a multi-user team development environment
set -e

echo "=== Setting up multi-user development environment ==="

# 1. Create users
TEAM_MEMBERS=("alice" "bob" "charlie")
sudo groupadd developers 2>/dev/null || true

for user in "${TEAM_MEMBERS[@]}"; do
    if id "$user" &>/dev/null; then
        echo "User $user already exists, skipping creation"
    else
        sudo useradd -m -s /bin/bash "$user"
        echo "Please set password for $user:"
        sudo passwd "$user"
    fi
    sudo usermod -aG developers "$user"
done
echo "✅ Users created"

# 2. Create shared directory
sudo mkdir -p /srv/project/{src,docs,scripts,tests}
sudo chgrp -R developers /srv/project
sudo chmod 2775 /srv/project
sudo chmod 2775 /srv/project/*/
echo "✅ Shared directory created (SGID set)"

# 3. Configure team umask
echo 'umask 002' | sudo tee -a /etc/bash.bashrc
echo "✅ Team umask configured"

# 4. Configure sudo privileges
echo '%developers ALL=(ALL) ALL' | sudo tee /etc/sudoers.d/developers
sudo chmod 440 /etc/sudoers.d/developers
echo "✅ sudo privileges configured"

# 5. Create README
cat | sudo tee /srv/project/README.md << 'EOF'
# Team Project Directory

---
## 4. Directory Structure
- src/ — Source code
- docs/ — Documentation
- scripts/ — Scripts
- tests/ — Tests

---
## 5. Rules
- umask 002, group members can modify each other's files
- Don't use root in this directory
- Confirm before using `sudo` to install software
EOF
echo "✅ README created"

echo ""
echo "=== Environment Ready ==="
echo "Users: ${TEAM_MEMBERS[*]}"
echo "Shared directory: /srv/project"
echo ""
echo "Verification:"
echo "  1. Create files as different users and check group is developers"
echo "  2. Use who to view online users"
echo "  3. Use sudo -l to view privileges"