Basic Linux Administration: Users, Groups and Permissions

My notes on managing users, groups and file permissions. Several of my original commands were incomplete or wrong, so each one has a corrected version underneath.

Before you start

User and group commands, and reading /etc/shadow, need root. Run them as root or with sudo.
Practise on a test machine or virtual machine, not a live server.

Users and groups

To make a new user:
Terminal window
```
useradd
```
useradd needs a user name:
Terminal window
```
useradd username
```
Change password:
Terminal window
```
passwd username
```
Sets or changes the password of an existing user. Run as root to change another user’s password; a normal user running passwd on its own changes their own password. (The original had curly quotes around “existing username”; no quotes are needed.)
To create a group:
Terminal window
```
groupadd
```
Like useradd, it needs a name:
Terminal window
```
groupadd groupname
```
Create a new user and put in the existing group:
```
useradd groupname username
```
Correction: this form does not work; useradd takes only one name and needs an option to set the group. Use:
Terminal window
```
useradd -g groupname username
```
-g sets the user’s primary group. To add the new user to extra (supplementary) groups instead, use -G, for example useradd -G groupname username.
To add an existing user into an existing group:
```
usermod -G groupname username
```
Correction: the original used a typographic dash (–G), which the shell does not recognise as an option; it must be a plain hyphen, as shown above. Also, -G on its own replaces all the user’s supplementary groups with the one given, which can remove them from groups they need (such as wheel or sudo). Add -a (append):
Terminal window
```
usermod -aG groupname username
```
The user needs to log out and back in for the new group to take effect. Check with id username.

File permissions

To check the list of permissions:
Terminal window
```
ls -l
```
(The original had a typographic dash instead of a hyphen.) Example output line:
```
-rwxr-xr-- 1 user staff 120 Jul 22 10:00 script.sh
```
After the first character (- for a file, d for a directory), there are three sets of rwx: owner, group and others.
To change permission we use 777 (rwx rwx rwx).

The 1st 7 is for the owner (the user who owns the file), the 2nd 7 for the group, and the 3rd 7 for others (everyone else). The original said “admin user” and “end users”; the correct terms are owner and others.
- (r) 4 read only
- (w) 2 write permission
- (x) 1 execute permission
Add the numbers for each set: 7 = 4+2+1 (rwx), 6 = 4+2 (rw-), 5 = 4+1 (r-x), 4 = r–, 0 = no permission. So 755 means owner rwx, group r-x, others r-x.
To change the permission use:
```
chmod 777 "group" or "user name"
```
Correction: chmod changes the permissions of a file or directory, not of a user or group. The name you give is the file:
Terminal window
```
chmod 755 filename
```
To change which user or group owns a file, use chown:
Terminal window
```
chown username:groupname filename
```
Safety note: 777 lets every user on the system read, change and run the file. Avoid it, especially on web server files. Typical safe values are 644 for normal files and 755 for directories and scripts.

Account files in /etc

To see the encrypted password:
Terminal window
```
cat /etc/shadow
```
(The original wrote this as <etc> cat shadow, meaning run cat shadow inside /etc.) Only root can read this file. Strictly, the passwords are stored as one-way hashes, not encrypted text, so they cannot be decrypted back to the password. Never copy or share this file.
To see groups info:
Terminal window
```
cat /etc/group
```
Each line has four fields separated by :. Correction: the first field is the group name (not the user name):
1. group name
2. group password (usually x, meaning it is stored elsewhere or not used)
3. group ID number (GID)
4. members of the group, separated by commas
Example:
```
developers:x:1001:alice,bob
```

Notes for today

getent group groupname shows one group’s line, and groups username lists the groups a user belongs to.
gpasswd -d username groupname removes a user from a group; groupdel groupname deletes a group.
On Debian and Ubuntu, adduser username and adduser username groupname are friendlier alternatives to useradd and usermod -aG.
Admin rights: on Red Hat-family systems, members of the wheel group can use sudo by default; on Debian and Ubuntu it is the sudo group.
Symbolic chmod is often clearer than numbers, for example chmod u+x script.sh (owner can execute) or chmod o-w file (others cannot write).