Linux was born as a multi-user system: even on a laptop used by a single person, dozens of accounts live side by side. Some belong to human beings, most to services such as the web server or the database. Understanding how users and groups are organised serves two very concrete purposes: giving everyone only the permissions they need, and understanding why a command replies «permission denied».
Who you are to the system
To the kernel a user is not a name but a number, the UID. The name is only for us. The root user always has UID 0 and can do anything. Service accounts usually have low UIDs, while human users start at 1000 on most distributions.
Three commands answer the question «who am I»:
whoami
id
groups
id is the most complete: it shows your UID, primary group and all the secondary groups you belong to.
The files that describe accounts
| File | Contents |
|---|---|
/etc/passwd |
name, UID, primary group, home folder, shell |
/etc/shadow |
password hashes and expiry dates, readable only by root |
/etc/group |
groups and their members |
A line in /etc/passwd looks like this:
anna:x:1001:1001:Anna Rossi:/home/anna:/bin/bash
The x means the password is not here but in /etc/shadow. Service accounts often have /usr/sbin/nologin as their shell, which prevents them being used for an interactive login. These files are fine to read but should be changed with the proper commands, not with an editor: a syntax error can lock everyone out.
Creating and changing users
Debian and Ubuntu have adduser, interactive and convenient; useradd, more bare-bones, is available everywhere:
sudo useradd -m -s /bin/bash -c "Anna Rossi" anna
sudo passwd anna
The -m option creates the home folder; without it the user ends up with no space of their own. Changes are made with usermod; the most common operation is adding a user to a group:
sudo usermod -aG docker anna
Watch the a: without it, -G replaces the list of secondary groups instead of adding to it, and the user may suddenly lose access to sudo. The new membership takes effect from the next login; until then id won't show it.
To temporarily block an account without deleting it, use sudo usermod -L anna, which disables the password, or sudo chage -E 0 anna, which expires the account. To remove it, sudo userdel -r anna also deletes the home folder: back up the data first.
Groups: shared permissions
Groups let you give access to several people without touching each file's permissions. A typical example: three people need to edit the files of a website in /srv/site.
sudo groupadd web
sudo usermod -aG web anna
sudo usermod -aG web luca
sudo chgrp -R web /srv/site
sudo chmod -R g+w /srv/site
sudo chmod g+s /srv/site
The setgid bit on the folder makes new files created inside it inherit the web group, so one person's work stays editable by the others.
Some groups have a special meaning: sudo (Debian and Ubuntu) or wheel (Fedora and Arch) give access to administrator privileges; docker lets you control containers and is effectively equivalent to root access; dialout allows use of serial ports, handy with development boards.
sudo: administering without being root
Logging in directly as root is discouraged: every command has full power and there is no record of who ran it. sudo runs a single command with elevated privileges, asks for the user's password rather than root's, and records the operation in the system logs.
The rules live in /etc/sudoers and in the files in the /etc/sudoers.d/ folder. They must always be edited with:
sudo visudo
visudo checks the syntax before saving. A broken sudoers file can leave you with no way to become administrator, and on a remote server that is a serious problem.
A rule reads like this: who, from which host, as which user, which commands. For example, to let a user restart only the web server:
luca ALL=(root) /usr/bin/systemctl restart nginx
That way Luca can perform that single operation without full access to the system. Granting NOPASSWD: ALL is convenient but removes an important barrier; it only makes sense for well-protected automation accounts, and even there it is better restricted to the commands needed.
Useful commands for checking
sudo -lshows what the current user can do with sudo;sudo -iopens a root shell, to be used sparingly;lastlists the most recent logins to the system;whoshows who is logged in right now;getent group sudolists the members of a group.
In my work, when I take over a server, one of the first checks is precisely the list of accounts with a valid shell and the members of the administrative groups: forgotten accounts of past collaborators are an opening nobody is watching.
In short
- To the system a user is a UID; root has UID 0 and no limits.
/etc/passwd,/etc/shadowand/etc/groupare read freely but changed with the proper commands.usermod -aGadds to a group; without-athe existing groups are lost.sudogrants privileges one command at a time and leaves a record; its rules are changed withvisudo.- Reviewing accounts and administrative groups regularly prevents forgotten access.
