Linux User, Group, and Ownership Administration

User and group management controls authentication, authorization, and process isolation across a Linux operating system. This guide covers identity lookup, account creation/modification, ownership assignment (chown, chgrp), and administrative privilege delegation (sudo, visudo).

⚡ Quick Dive

User & Group Management Cheat Sheet

Quick Start Recipes

# 1. Create a service engineer account with sudo and docker privileges
sudo useradd -m -s /bin/bash -G sudo,docker alice
sudo passwd alice

# 2. Assign web root ownership recursively to web server user and developers group
sudo chown -R www-data:developers /var/www/html
sudo chmod -R 775 /var/www/html

# 3. Grant passwordless sudo to a deploy script in /etc/sudoers.d/deploy
echo "deploy ALL=(ALL) NOPASSWD: /usr/local/bin/deploy.sh" | sudo tee /etc/sudoers.d/deploy

📖 Extended Guide

1. Identity Inspection & Logged-in Users

whoami & id

• whoami: Returns the username associated with the effective UID of the current process.
• id: Displays the effective and real UID, primary GID, and list of supplementary groups.

$ id
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),27(sudo),998(docker)

$ id -u  # Returns numerical UID only
1000

who, w, and last

• who: Shows who is currently logged into the system, their TTY/PTS, and login time.
• w: Detailed view of logged-in users and their currently running processes/CPU load.
• last: Displays history of recent user logins and system reboots from /var/log/wtmp.

2. Core Identity Files in /etc

Linux stores account configurations in plain text files in /etc:

1. /etc/passwd (Readable by all):
   • Format: username:password_placeholder:UID:GID:gecos_info:home_dir:login_shell
   • Example: ubuntu:x:1000:1000:Ubuntu User,,,:/home/ubuntu:/bin/bash
2. /etc/shadow (Readable only by root):
   • Contains salted password hashes, password expiration dates, and account lock flags.
3. /etc/group (Readable by all):
   • Format: group_name:password_placeholder:GID:comma_separated_user_list
   • Example: docker:x:998:ubuntu,alice
4. /etc/gshadow (Readable only by root):
   • Secure group metadata and group passwords.

3. User Account Administration

Creating Users: useradd vs adduser

• useradd: Low-level, non-interactive standard utility available on all Linux distros.
• adduser: High-level, interactive Perl wrapper common in Debian/Ubuntu.

# Recommended standard non-interactive user creation:
# -m: create home directory (/home/username)
# -s: define login shell
# -c: add descriptive comment
# -G: assign secondary groups
sudo useradd -m -s /bin/bash -c "Developer Account" -G docker,developers bob

# Set initial password
sudo passwd bob

Modifying Users: usermod

[!IMPORTANT] Always include the -a (append) flag when using -G with usermod. Running usermod -G group user without -a will remove the user from all other supplementary groups!

# Safely add user to docker group
sudo usermod -aG docker bob

# Change user's login shell
sudo usermod -s /bin/zsh bob

# Lock / Unlock user account
sudo usermod -L bob    # Lock (prepends ! to password in /etc/shadow)
sudo usermod -U bob    # Unlock

Deleting Users: userdel

# Delete user while wiping their home directory and mail spool (-r)
sudo userdel -r bob

4. Group Administration

Groups simplify permission management across multiple users.

# Create group
sudo groupadd backend-team

# Modify group name or GID
sudo groupmod -n apis-team backend-team

# Remove group
sudo groupdel apis-team

# Add/remove user to group using gpasswd
sudo gpasswd -a alice backend-team    # Add user
sudo gpasswd -d alice backend-team    # Remove user

5. Managing Ownership: chown and chgrp

chown (Change Owner and Group)

Syntax: chown [OPTIONS] [USER][:GROUP] FILE...

# Change owner only
sudo chown alice /opt/app/config.json

# Change owner AND group simultaneously
sudo chown alice:backend-team /opt/app/config.json

# Change group only (note leading colon)
sudo chown :backend-team /opt/app/config.json

# Change ownership recursively across directory tree (-R)
sudo chown -R www-data:www-data /var/www/html/

# Match ownership of target file to a reference file
sudo chown --reference=/etc/nginx/nginx.conf /etc/nginx/conf.d/custom.conf

chgrp (Change Group)

# Change group ownership recursively
sudo chgrp -R backend-team /data/projects/

6. Privilege Management: su, sudo, and visudo

su vs sudo

• su - [user]: Switch user context entirely, spawning a login shell with the target user's environment (defaults to root).
• sudo <command>: Execute a specific command with elevated root (or designated user) privileges while retaining audit logging in /var/log/auth.log.
• sudo -i: Start an interactive root login shell.
• sudo -u <user> <cmd>: Run command as a specific non-root user.

# Run command as postgres service account
sudo -u postgres psql -c "SELECT version();"

Sudoers Configuration & visudo

Never edit /etc/sudoers directly with a normal text editor. Always use visudo to validate syntax before saving, preventing administrative lockouts.

# Launch safe sudoers editor
sudo visudo

# Best Practice: create modular drop-in configs inside /etc/sudoers.d/
sudo visudo -f /etc/sudoers.d/developers

Example /etc/sudoers.d/developers rules:

# Allow members of group developers to restart nginx without password
%developers ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx, /usr/bin/systemctl status nginx

# Allow user deploy full root execution
deploy ALL=(ALL:ALL) ALL