Why Name it Access2Chk?
Access2Chk means three things:
1.) Second - Version 2.0, the Linux version of AccessChk
2.) To - Access to check permissions
3.) Too - Linux gets access too
It's a name that tells a story in ten characters:
"The second version, for Linux, to check access too."
The Need and It's general purpose.
Windows administrators get all the flashy and fun tools, some users may disagree but when you are moving from Windows to Linux it seems quite desolate and glamorless. moving to Linux often offers very little and for most that isolation is liberation but for others it may feel like, "Oh no did I make a mistake?". In a mad scramble for something that feels familiar something that will keep their spirits high. Something to help the transition that feels like home. So the search for familiar tools begins. Me personally, I was extremely upset I couldn't use any the wonderful tools that lay within the Sysinternals Suite, sure there are some maid to use linux architecture but they are kinda shit (no offense to their developers). While attempting to convert any native Windows app to work on UNIX too. Understand that any project is a massive undertaking that seems like it should be easy, however each operating system is different. Linux and Windows do not share the same syntax and Linux is built with a plethora of powerful permission-checking tools (like find, stat, getfacl), none combine them into the simple, focused interface that AccessChk provides. So I thought Id take a crack at it, making what I wanted a reality I chose the robust AccessChk mainly because I actually enjoyed the tool and was going to miss it greatly. Also I knew the design of it really well and figured that it may prove a challenge to wall to wall implement the UNIX version of what Windows had accomplished, however it seemed like the most likey to convert 1 to 1 from there the idea of Access2Chk began taking shape.
1.) Access2Chk is the first step in an attempt to fill this gap.
2.) Providing familiar syntax for Windows admins transitioning to Linux.
3.) Powerful features for experienced sysadmins to acquire easier access.
4.) Consistent output that is simple to parse and understand.
5.) Finally, faithful behavior that matched the original version.
Access2Chk asked of me to confront two humbling yet fundamental questions:
-
"What access does this user have to acquire these resources?"
-
"Is it possible to maintain the integrity of the original tool to Linux?"
The Checklist:
- Features include file and directory permissions,
- POSIX Access Control Lists (ACLs),
- SUID/SGID binaries and capabilities,
- systemd services, running processes,
- network shares (Samba/NFS),
- and /dev, /proc, /sys namespaces.
Quick Install: First install the prerequisites. On Debian/Ubuntu, use sudo apt-get install acl attr. For RHEL/CentOS, use sudo yum install acl attr. For Arch Linux, use sudo pacman -S acl attr.
Then download and install Access2Chk with these commands: curl -O https://raw.githubusercontent.com/TheMasked0ne/Access2Chk/main/Access2Chk chmod +x Access2Chk sudo cp Access2Chk /usr/local/bin/
Test it by running Access2Chk $(whoami) ~
Usage: The basic syntax is Access2Chk [flags]
Here are some common examples: Access2Chk john /home/john - Basic permission check Access2Chk -r john /home/john - Recursive scan Access2Chk -s john /home/john - Show only read access Access2Chk -w john /home/john - Show only write access Access2Chk -i john /home/john - Show explicit ACLs only (ignore inherited) Access2Chk -l -v john /home/john - Verbose output with full ACLs Access2Chk -c sshd.service - Check a systemd service Access2Chk -p 1234 - Check a process by PID Access2Chk -r -v -l -i security_team /etc - Full security audit Access2Chk -x -r root /usr/bin - Find SUID/SGID binaries (sudo)
Flags Reference -a checks account rights (user/group membership) -c checks a systemd service -d processes directories only -e shows SELinux/AppArmor context -f filters output for specific accounts (comma-separated) -h checks network shares (Samba/NFS mounts) -i shows only explicit ACLs (ignores inherited) -k maps to filesystem paths (registry key equivalent) -l shows full security descriptor (getfacl output) -n shows only objects with no access -o maps to /dev, /proc, /sys (object manager equivalent) -p checks a process by PID or name -r recurses through subdirectories -s shows only objects with read access -t filters by object type (file, dir, symlink, pipe, socket) -u suppresses errors -v enables verbose output -w shows only objects with write access -x shows only objects with execute access
Output Format The output uses a simple format. R means read access, W means write access, X means execute access, RW means both read and write, and a blank space means no access.
Example output looks like this: RW /path/to/file.txt R /path/to/readonly.txt W /path/to/writeonly.txt X /path/to/executable.sh /path/to/noaccess.txt
With verbose mode enabled using -v, you get additional details such as owner, group, octal permissions, file size, and ACL information:
RW /home/john/file.txt (john, users, 755, 1024 bytes) [ACL: user:rw group:users:r mask:r]
Philosophy "The world does not stop and start at your convenience." Access2Chk has no progress bars because the filesystem doesn't care about your schedule. There is no hand-holding because if you don't understand something, you should learn it. There is no feature creep because the tool stays true to the original, as intended. There are no apologies because the truth will set you free.
Requirements The required tools are usually pre-installed on most Linux systems. You need bash version 4.0 or higher, find, stat, id, and sudo.
For enhanced functionality, you can install optional tools. getfacl provides ACL support, getcap shows capabilities, systemctl enables service checking, and pgrep enables process checking.
Install optional tools with: Debian/Ubuntu use, sudo apt-get install acl attr, RHEL/CentOS use, sudo yum install acl attr, Arch Linux use, sudo pacman -S acl attr.
Troubleshooting If you get a "User not found" error, verify the user exists with id username. If you get "getfacl not found", install the acl package with sudo apt-get install acl. If you get permission denied, run with sudo for root paths. If performance is slow, use non-recursive mode or scan specific paths instead of entire filesystems.
For performance tuning, estimate scan time with du -sh /path/to/scan, count files first with find /path/to/scan -type f | wc -l, or time the scan with time Access2Chk -r admin /var.
Real-World Examples:
Example 1: User Access Audit Run Access2Chk -r developer /var/www to audit what a developer can access. The output shows RW for /var/www/index.html (read and write), R for /var/www/config.php (read only), RW for /var/www/uploads/ (read and write), and a blank for /var/www/private/ (no access).
Example 2: Security Vulnerability Scan Run Access2Chk -x -r user /usr/bin to find SUID/SGID binaries. The output shows /usr/bin/sudo with SUID, /usr/bin/passwd with SUID, /usr/bin/chsh with SUID, and /usr/bin/chfn with SUID.
Example 3: ACL Audit Run Access2Chk -i -r finance /data to find files with explicit ACLs for the finance group. The output shows RW for /data/budgets/ with explicit ACLs and R for /data/reports/ with explicit ACLs.
Example 4: Service Security Check Run Access2Chk -c nginx.service to check the nginx service. The output shows the service status and the unit file permissions, typically RW for /lib/systemd/system/nginx.service with root ownership.
Example 5: Complete Security Audit Run Access2Chk -r -v -l -i admin /etc for a full security audit of /etc. The output shows detailed permission information for each file including ACLs. At the end, a summary shows total items scanned, items with explicit ACLs, items with inherited-only ACLs that were filtered out, and items shown in output.
Contributing When contributing, stay true to the original with no feature creep. Preserve the philosophy with no progress bars and no hand-holding. Test thoroughly to ensure compatibility with all Linux distributions. Document well so future maintainers can understand your changes.
Areas for improvement include additional ACL edge cases for NFS and other filesystems, extended attribute support with getfattr, optional JSON or CSV output mode, and additional service types such as SysV init and Upstart.
License - Access2Chk is licensed under the MIT License. See the LICENSE file for details.
Acknowledgments - Thank you Mark Russinovich creator the original AccessChk and built the Sysinternals suite. The Linux Community built the powerful permission model that makes security possible. The developers who tried to create similar tools & every contribution to help maintain and improve Access2Chk.
Access2Chk v1.3 - Linux Port of Sysinternals AccessChk Coded by TheMasked0ne - https://github.com/TheMasked0ne Original concept by Mark Russinovich - https://sysinternals.com