Linux: Phase 2 Mini Project

# 1. Each person has their own account and home directory
sudo useradd -m -s /bin/bash alice
sudo useradd -m -s /bin/bash bob
sudo useradd -m -s /bin/bash charlie

# 2. Shared project directory (SGID ensures group inheritance)
sudo mkdir -p /srv/project
sudo chgrp developers /srv/project
sudo chmod 2775 /srv/project

# /srv/project is the shared directory
sudo chown root:developers /srv/project
sudo chmod 2775 /srv/project
# 2 = SGID (new files inherit group)
# 775 = Owner and group can read/write/execute, others can read/execute

> ⚠️ Note: The `2` in `chmod 2775` represents SGID — when SGID is set on a shared directory, any new file created there automatically inherits the directory's group (rather than the creator's primary group). This is the key mechanism for team collaboration. Without SGID, new files would belong to the creator's primary group, and other team members might not be able to modify them.

# View default skel contents
ls -la /etc/skel/

# Add custom configuration for all new users
sudo tee -a /etc/skel/.bashrc << 'EOF'

# ---- Team standard configuration ----
alias ll='ls -la'
alias ..='cd ..'
export EDITOR=vim
EOF

# Create a shared group
sudo groupadd developers

# Create accounts for three developers
for user in alice bob charlie; do
    sudo useradd -m -s /bin/bash "$user"
    sudo passwd "$user"      # Set password interactively
    sudo usermod -aG developers "$user"
    echo "User $user created"
done

# Verify
grep developers /etc/group

# Create shared project directory
sudo mkdir -p /srv/project/{src,docs,scripts}

# Set the group
sudo chgrp -R developers /srv/project

# Set SGID + standard permissions
sudo chmod 2775 /srv/project
# 2 = SGID
# 7 = Owner (rwx)
# 7 = Group (rwx)
# 5 = Others (r-x)

# Test: create a file as a different user and verify group inheritance
sudo -u alice touch /srv/project/test.txt
ls -l /srv/project/test.txt
# -rw-r--r-- 1 alice developers 0 Jul 7 12:00 test.txt
# File belongs to developers group ✅

# Set a unified umask for the team (so shared files are writable by default)
echo 'umask 002' | sudo tee -a /etc/bash.bashrc

# Effect of 002:
# File: 666 - 002 = 664 (rw-rw-r--)
# Directory: 777 - 002 = 775 (rwxrwxr-x)
# This way group members can modify each other's files

> ℹ️ Note: For team collaboration, a unified umask of 002 lets group members modify each other's files. But be mindful of security — on a server shared by multiple teams, 002 may be too permissive. Recommend using SGID + 002 only in shared directories, and keeping the default 022 for user home directories.

# Alex likes a colorful prompt
cat >> ~/.bashrc << 'EOF'
export PS1='\[\033[1;32m\]\u\[\033[0m\]:\[\033[1;34m\]\w\[\033[0m\]\$ '
alias ll='ls -lah'
EOF
source ~/.bashrc

# Bob likes it simple
cat >> ~/.bashrc << 'EOF'
export PS1='\w\$ '
alias l='ls -CF'
EOF
source ~/.bashrc

# Create a group
sudo groupadd devops

# Add Alex to the devops group (he can manage system services)
sudo usermod -aG devops charlie

# Configure sudo privileges by group
echo '%developers ALL=(ALL) ALL' | sudo tee /etc/sudoers.d/developers
echo '%devops ALL=(ALL) NOPASSWD: /usr/bin/systemctl, /usr/bin/apt' | sudo tee /etc/sudoers.d/devops

> 💡 Tip: The recommended approach for sudo privilege management is the "group principle" — create groups by role (e.g., developers, devops), then create separate files under `/etc/sudoers.d/` for each group. This way, adding or removing users only requires changing group membership, without repeatedly editing sudoers files.

# Set permissions
sudo chmod 440 /etc/sudoers.d/*

#!/bin/bash
# setup-multi-user.sh - Set up a multi-user team development environment
set -e

echo "=== Setting up multi-user development environment ==="

# 1. Create users
TEAM_MEMBERS=("alice" "bob" "charlie")
sudo groupadd developers 2>/dev/null || true

for user in "${TEAM_MEMBERS[@]}"; do
    if id "$user" &>/dev/null; then
        echo "User $user already exists, skipping creation"
    else
        sudo useradd -m -s /bin/bash "$user"
        echo "Please set password for $user:"
        sudo passwd "$user"
    fi
    sudo usermod -aG developers "$user"
done
echo "✅ Users created"

# 2. Create shared directory
sudo mkdir -p /srv/project/{src,docs,scripts,tests}
sudo chgrp -R developers /srv/project
sudo chmod 2775 /srv/project
sudo chmod 2775 /srv/project/*/
echo "✅ Shared directory created (SGID set)"

# 3. Configure team umask
echo 'umask 002' | sudo tee -a /etc/bash.bashrc
echo "✅ Team umask configured"

# 4. Configure sudo privileges
echo '%developers ALL=(ALL) ALL' | sudo tee /etc/sudoers.d/developers
sudo chmod 440 /etc/sudoers.d/developers
echo "✅ sudo privileges configured"

# 5. Create README
cat | sudo tee /srv/project/README.md << 'EOF'
# Team Project Directory

---
## 4. Directory Structure
- src/ — Source code
- docs/ — Documentation
- scripts/ — Scripts
- tests/ — Tests

---
## 5. Rules
- umask 002, group members can modify each other's files
- Don't use root in this directory
- Confirm before using `sudo` to install software
EOF
echo "✅ README created"

echo ""
echo "=== Environment Ready ==="
echo "Users: ${TEAM_MEMBERS[*]}"
echo "Shared directory: /srv/project"
echo ""
echo "Verification:"
echo "  1. Create files as different users and check group is developers"
echo "  2. Use who to view online users"
echo "  3. Use sudo -l to view privileges"