# 权限说明
– 第1位：文件类型（-普通文件，d目录，l链接）
– 第2-4位：所有者权限（r读，w写，x执行）
– 第5-7位：组权限
– 第8-10位：其他用户权限

# 修改权限
$ chmod 755 script.sh
$ chmod u+x script.sh
$ chmod g-w script.sh
$ chmod o=r script.sh

# 修改所有者
$ chown user1:group1 file.txt
$ chown -R user1:group1 /var/www/html

# 特殊权限
# SUID（4）：执行时获得文件所有者权限
$ chmod 4755 /usr/bin/passwd

# SGID（2）：执行时获得文件所属组权限
$ chmod 2775 /shared/project

# Sticky bit（1）：只有所有者可删除
$ chmod 1777 /tmp

# 查看特殊权限
$ ls -la /usr/bin/passwd
-rwsr-xr-x. 1 root root 33544 Jan 10 10:00 /usr/bin/passwd

$ ls -la /tmp
drwxrwxrwt. 10 root root 4096 Apr 4 02:25 /tmp

# 查找SUID文件
$ sudo find / -perm -4000 -type f 2>/dev/null
/usr/bin/su
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/newgrp

# 查找SGID文件
$ sudo find / -perm -2000 -type f 2>/dev/null
/usr/bin/write
/usr/bin/wall

# 查看ACL支持
$ tune2fs -l /dev/sda1 | grep “Default mount options”
Default mount options: user_xattr acl

# 查看ACL
$ getfacl /var/www/html
getfacl: Removing leading ‘/’ from absolute path names
# file: var/www/html
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

# 设置用户ACL
$ sudo setfacl -m u:user1:rwx /var/www/html

# 设置组ACL
$ sudo setfacl -m g:developers:rwx /var/www/html

# 设置默认ACL
$ sudo setfacl -d -m u:user1:rwx /var/www/html

# 删除ACL
$ sudo setfacl -x u:user1 /var/www/html

# 清除所有ACL
$ sudo setfacl -b /var/www/html

# 复制ACL
$ getfacl file1 | setfacl –set-file=- file2

# 查看ACL
$ getfacl /var/www/html
# file: var/www/html
# owner: root
# group: root
user::rwx
user:user1:rwx
group::r-x
group:developers:rwx
mask::rwx
other::r-x
default:user::rwx
default:user:user1:rwx
default:group::r-x
default:group:developers:rwx
default:mask::rwx
default:other::r-x

# 递归设置ACL
$ sudo setfacl -R -m u:user1:rwx /var/www/html

# 生成密钥对
$ gpg –full-generate-key
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(14) Existing key from card
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0) 1y
Key expires at Fri Apr 4 02:30:00 2027 UTC
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: Admin User
Email address: admin@fgedu.net.cn
Comment: Admin Key
You selected this USER-ID:
“Admin User (Admin Key) ”

Change (N)ame,更多视频教程www.fgedu.net.cn (C)omment, (E)mail or (O)kay/(Q)uit? O

# 列出密钥
$ gpg –list-keys
/home/user1/.gnupg/pubring.kbx
——————————-
pub rsa4096 2026-04-04 [SC] [expires: 2027-04-04]
ABCD1234ABCD1234ABCD1234ABCD1234ABCD1234
uid [ultimate] Admin User (Admin Key)
sub rsa4096 2026-04-04 [E] [expires: 2027-04-04]

# 加密文件
$ gpg -e -r admin@fgedu.net.cn secret.txt

# 解密文件
$ gpg -d secret.txt.gpg > secret.txt

# 对称加密
$ gpg -c secret.txt
Enter passphrase:
Repeat passphrase:

# 对称解密
$ gpg -d secret.txt.gpg > secret.txt

# 导出公钥
$ gpg –export -a admin@fgedu.net.cn > public.key

# 导入公钥
$ gpg –import public.key

# 导出私钥
$ gpg –export-secret-keys -a admin@fgedu.net.cn > private.key

# 导入私钥
$ gpg –import private.key

# 计算SHA256校验和
$ sha256sum file.txt
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 file.txt

# 验证校验和
$ sha256sum -c checksum.sha256
file.txt: OK

# 生成校验和文件
$ sha256sum file.txt > checksum.sha256

# 批量生成校验和
$ find /var/www -type f -exec sha256sum {} \; > checksums.sha256

# 使用AIDE监控文件变化
$ sudo dnf install -y aide

# 初始化AIDE数据库
$ sudo aide –init
Start timestamp: 2026-04-04 02:35:00 +0000 (Fri Apr 4 02:35:00 UTC 2026)
AIDE initialized database at /var/lib/aide/aide.db.new.gz
Number of entries: 50000

# 更新数据库
$ sudo cp /var/lib/aide/aide.db.new.学习交流加群风哥微信: itpux-comgz /var/lib/aide/aide.db.gz

# 检查文件变化
$ sudo aide –check
AIDE found NO changes

# 更新数据库
$ sudo aide –update

# 配置AIDE
$ sudo tee /etc/aide.conf << 'EOF' database = file:/var/lib/aide/aide.db.gz database_out = file:/var/lib/aide/aide.db.new.gz report_url = stdout report_url = file:/var/log/aide/aide.log p = perms i = inode n = numberoflinks m = mtime c = ctime s = size NORMAL = p+i+n+m+c+s / NORMAL /etc NORMAL /var/log p+n EOF