Linux Users, Groups and sudo Explained

Linux separates what each person and service can do. A mistake by a normal user usually harms only their own files, and a compromised web server cannot read everyone's data.

Who am I?#

whoami
id

asha
uid=1002(asha) gid=1002(asha) groups=1002(asha)

Every user has a number (UID) and belongs to one or more groups.

root and sudo#

root is the administrator, with UID 0. It can do anything. Rather than logging in as root, you run single commands with sudo:

cat /etc/shadow | head -n 1
sudo head -n 1 /etc/shadow | cut -d: -f1

cat: /etc/shadow: Permission denied
root

sudo runs one command as root, after asking for your password. It keeps a log, and it lets you act as root only when you need to.

To open a root shell for several commands, use sudo -i, and type exit to leave.

Where users are stored#

/etc/passwd lists accounts, and it can be read by anyone. Passwords are stored as hashes in /etc/shadow, which only root can read.

grep -E '^(root|asha):' /etc/passwd

root:x:0:0:root:/root:/bin/bash
asha:x:1002:1002::/home/asha:/bin/bash

The fields, separated by colons, are the name, a placeholder for the password, UID, GID, a comment, the home folder and the shell.

Create a user#

On Ubuntu, adduser is the friendly command. Normally it asks for a password:

sudo adduser ravi

Here we skip the questions, which is how you would do it in a script:

sudo adduser --disabled-password --gecos "" ravi > /dev/null
id ravi
ls -d /home/ravi

uid=1003(ravi) gid=1003(ravi) groups=1003(ravi),100(users)
/home/ravi

Set or change a password with sudo passwd ravi. Your own password is changed with passwd.

Groups#

Groups give several users the same access. A common use is a shared project folder:

sudo groupadd developers
sudo usermod -aG developers ravi
sudo usermod -aG developers asha
getent group developers

developers:x:1004:ravi,asha

-aG means append to the group.

A new group takes effect at the next login. This shared folder uses setgid, so that new files belong to the group:

sudo mkdir /srv/shared
sudo chown root:developers /srv/shared
sudo chmod 2775 /srv/shared
ls -ld /srv/shared
sudo -u ravi touch /srv/shared/from-ravi.txt
ls -l /srv/shared

drwxrwsr-x 2 root developers 4096 Nov  5 06:26 /srv/shared
total 0
-rw-rw-r-- 1 ravi developers 0 Nov  5 06:26 from-ravi.txt

sudo -u ravi runs a command as ravi. Note the s in the group's permissions, and that the new file belongs to the developers group.

Give someone sudo rights#

On Ubuntu, members of the sudo group can use it:

sudo usermod -aG sudo ravi

To change the rules, use sudo visudo, which checks the syntax before saving. A broken sudoers file can lock everyone out.

Switch users#

su - ravi      # needs ravi's password
sudo -i        # root shell, using your password

Remove a user#

--remove-home also deletes the home folder:

sudo deluser --remove-home ravi 2> /dev/null | tail -n 1
sudo rm -rf /srv/shared
sudo delgroup developers | tail -n 1

info: Removing user `ravi' ...
info: Removing group `developers' ...

Who is logged in?#

Common mistakes#

Practice#

grep '^root:' /etc/passwd | cut -d: -f7
awk -F: '$7 == "/bin/bash"' /etc/passwd | wc -l

/bin/bash
5

Key takeaway#

Next: Environment Variables and PATH.