Linux Users, Groups and Permissions

Posted on Edited on In Views:

Sources:

  • A complete guide to Manage Users and Groups on Linux!
  • 蔡德明. 第十四章 Linux账号管理与权限配置. 鸟哥的Linux私房菜.

Linux Users, Groups and Permissions

Basic concepts

Users

Linux user is an account or an entity. Every process and file in Linux belongs to a user. Users are identified by:

  • Username: Human-readable name (e.g., john, alice)
  • User ID (UID): Numerical identifier (e.g., 1000, 1001)

User Types:

  • Root user: Superuser with UID 0, has complete system access
    • By default, only the root account is an administrater. You can set other admiistraters by just setting UID=0, but it's highly unrecommended.
  • System users: UIDs typically 1-999, created by the operating system or other softwares like mysql and that is used for operating system defined purposes.
  • Regular users: UIDs typically 1000+, for human users

Details of UID are in later section.

Check information of a Linux user:

id <user_name>

Groups

Groups are collections of users that share permissions. Groups have:

  • Group name: Human-readable (e.g., developers, admin)
  • Group ID (GID): Numerical identifier

Every user has:

  • Primary group: Main group (usually same name as username)
  • Secondary groups: Additional groups for extra permissions

Check group information of a Linux user:

groups <user_name>

Permissions

Unix and Unix-like systens, including macOS and Linux, use a permission system to control access to files and directories:

  • Read (r): View file contents or list directory contents
  • Write (w): Modify file contents or create/delete files in directory
  • Execute (x): Run file as program or enter directory

Permissions are assigned to three categories:

  • User (u): The file owner
  • Group (g): Users in the file's group
  • Others (o): All other users
$ ls -al _config.yml
-rw-r--r--@ 1 lyk  staff  5246 Jul  3  2024 _config.yml
│││││││││││ │ │    │     │    │              │
│││││││││││ │ │    │     │    │              └── Filename
│││││││││││ │ │    │     │    └─────────────── Last modified date
│││││││││││ │ │    │     └──────────────────── File size (5246 bytes)
│││││││││││ │ │    └────────────────────────── Group owner (staff)
│││││││││││ │ └─────────────────────────────── User owner (lyk)
│││││││││││ └───────────────────────────────── Number of hard links (1)
││││││││││└─────────────────────────────────── Extended attributes (@)
│││││││└────────────────────────────────────── Others permissions (r--)
││││└───────────────────────────────────────── Group permissions (r--)
│└──────────────────────────────────────────── User permissions (rw-)
└───────────────────────────────────────────── File type (-)
  • File type and permissions: -rw-r--r--@
    • -: Regular file (could be d for directory, l for link
    • rw-: User (lyk) can read and write, but not execute
    • r--: Group (staff) can only read
    • r--: Others can only read
    • @: File has extended attributes, which are additional metadata beyond standard file permissions.
  • Ownership and metadata:
    • 1: Number of hard links to this file
    • lyk: File owner (user)
    • staff: File owner (group)
    • 5246: File size in bytes
    • Jul 3 2024: Last modification date
    • _config.yml: Filename

There’s another way to calculate the same file permissions, using numbers.

Permission (word) Permission (number)
Read 4
Write 2
Execute 1

This means, if you want to give read and write access only to the owner and group, you mention it like this 660, where the first digit is for the owner, second digit is for the group, and the third digit is for the other users. We can use this format along with the chmod command to change permissions of any file or directory.

Database of users and groups

There are primarily 4 files placed under /etc directory which manages records about users and groups.

  • /etc/passwd -> The file containing basic information about users.
  • /etc/shadow -> The file containing encrypted passwords.
  • /etc/group -> The file containing basic information about groups and which users belong to them.
  • /etc/gshadow -> The containing encrypted group passwords.

The password (/etc/passwd) and group (/etc/group) files doesn't contain password information for security reasons and they are plain text, but the other two files are encrypted text.

The format of files for groups (/etc/group and /etc/gshadow) are quite similar to that of the files for users (/etc/passwd and /etc/shadow).

/etc/passwd

-->Source: Understanding the /etc/passwd File

User accounts are stored in /etc/passwd.

cat /etc/passwd                    # Show all users
cut -d: -f1 /etc/passwd           # Show only usernames

Entries have the format:

mark:x:1001:1001:mark,,,:/home/mark:/bin/bash
[--] - [--] [--] [-----] [--------] [--------]
|    |   |    |     |         |        |
|    |   |    |     |         |        +-> 7. Login shell
|    |   |    |     |         +----------> 6. Home directory
|    |   |    |     +--------------------> 5. GECOS
|    |   |    +--------------------------> 4. GID
|    |   +-------------------------------> 3. UID
|    +-----------------------------------> 2. Password
+----------------------------------------> 1. Username

The syntax is:

username:password:UID:GID:name:home directory:shell

where

  1. Username. the username given a the time of creation

  2. Password. Usually, we’ll see an x character there. It means the password is encrypted.

  3. UID. The user identifier is a number assigned to each user. It is used by the operating system to refer to a user.

  4. GID. The user’s group identifier number, referring to the user’s primary group. When a user creates a file , the file’s group is set to this group. Typically, the name of the group is the same as the name of the user. User’s secondary groups are listed in the /etc/groups file.

  5. Full name of the user. It's optional and not important. You can write anything to it.

  6. Home directory. User’s home directory.

  7. Login shell. User’s default shell. Note: /sbin/nologin or /bin/false indicates logging in is disabled for the user.

    • To view valid login shell please run the following command

      cat /etc/shells

/etc/shadow

Source: Understanding the /etc/shadow File

sudo cat /etc/shadow

Output:

mark:$6$.n.:17736:0:99999:7:::
[--] [----] [---] - [---] ----
|      |      |   |   |   |||+-----------> 9. Unused
|      |      |   |   |   ||+------------> 8. Expiration date
|      |      |   |   |   |+-------------> 7. Inactivity period
|      |      |   |   |   +--------------> 6. Warning period
|      |      |   |   +------------------> 5. Maximum password age
|      |      |   +----------------------> 4. Minimum password age
|      |      +--------------------------> 3. Last password change
|      +---------------------------------> 2. Encrypted Password
+----------------------------------------> 1. Username

Explanation:

  1. Username. The string you type when you log into the system. The user account that exist on the system.

  2. Encrypted Password. The password is using the $type$salt$hashed format. $type is the method cryptographic hash algorithm and can have the following values:

    • $1$ – MD5
    • $2a$ – Blowfish
    • $2y$ – Eksblowfish
    • $5$ – SHA-256
    • $6$ – SHA-512

    If the password field contains an asterisk (*) or exclamation point (!), the user will not be able to login to the system using password authentication. Other login methods like key-based authentication or switching to the user are still allowed.

    In older Linux systems, the user’s encrypted password was stored in the /etc/passwd file.

  3. Last password change. This is the date when the password was last changed. The number of days is counted since January 1, 1970 (epoch date).

  4. Minimum password age. The number of days that must pass before the user password can be changed. Typically it is set to zero, which means that there is no minimum password age.

  5. Maximum password age. The number of days after the user password must be changed. By default, this number is set to 99999.

  6. Warning period. The number of days before the password expires during which the user is warned that the password must be changed.

  7. Inactivity period. The number of days after the user password expires before the user account is disabled. Typically this field is empty.

  8. Expiration date. The date when the account was disabled. It is represented as an epoch date.

  9. Unused. This field is ignored. It is reserved for future use.

Let’s take a look at the following example:

linuxize:$6$zHvrJMa5Y690smbQ$z5zdL...:18009:0:120:7:14::

The entry above contains information about the user “linuxize” password:

  • The password is encrypted with SHA-512 (the password is truncated for better readability).
  • The password was last changed on April 23, 2019 - 18009.
  • There is no minimum password age.
  • The password must be changed at least every 120 days.
  • The user will receive a warning message seven days before the password expiration date.
  • If the user doesn’t attempt to login to the system 14 days after the password is expired, the account will be disabled.
  • There is no account expiration date.

/etc/group

cat /etc/group                    # Show all groups
cut -d: -f1 /etc/group           # Show only group names

User and group IDs

We discussed /etc/passwd in the previous section, where Linux user accounts are stored. This file contains information about every user account on the system, including the username, user ID (UID), and primary group ID (GID).

To view all user accounts, run:

cat /etc/passwd

Example output:

root:x:0:0:root:/root:/bin/bash
ubuntu:x:1000:1000:Ubuntu User:/home/ubuntu:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

Each line follows this format:

username : password-field : UID : GID : comment : home-directory : shell

Display usernames and UIDs only

If you only need the username and UID, use:

cut -d: -f1,3 /etc/passwd

Example output:

root:0
daemon:1
bin:2
sys:3
sshd:106
zhangsan:1000
lisi:1001
wangxiaoming:1002

As introduced in the previous section, Linux assigns different UID ranges for different types of accounts:

  • UID 0: reserved for the root user
  • UID 1–999: normally used by system accounts created by the operating system or installed software, such as sshd, www-data, and other service accounts
  • UID 1000 and above: normally used for regular users created by administrators

The exact UID and GID allocation ranges are defined in /etc/login.defs.

User and group ID ranges

System user and group ID ranges

To check the configured range for system accounts:

grep -i SYS_UID_MIN /etc/login.defs
grep -i SYS_UID_MAX /etc/login.defs
grep -i SYS_GID_MIN /etc/login.defs
grep -i SYS_GID_MAX /etc/login.defs

Example:

SYS_UID_MIN 100
SYS_UID_MAX 999
SYS_GID_MIN 100
SYS_GID_MAX 999

These values define the UID and GID ranges assigned to system accounts.

Regular user and group ID ranges

To check the range for regular user accounts:

grep -i UID_MIN /etc/login.defs | grep -v -E '^\#'
grep -i UID_MAX /etc/login.defs | grep -v -E '^\#'
grep -i GID_MIN /etc/login.defs | grep -v -E '^\#'
grep -i GID_MAX /etc/login.defs | grep -v -E '^\#'

On most Ubuntu systems, regular users start from UID/GID 1000.

Modifying UID and GID ranges

If you need to change the default ranges used when creating new users or groups, modify the corresponding variables in /etc/login.defs, such as:

UID_MIN
UID_MAX
GID_MIN
GID_MAX

Changes affect newly created accounts only. Existing users and groups keep their current UID and GID values unless they are manually changed with tools such as usermod or groupmod.

Here is a rewritten version with improved flow, grammar, and a more precise explanation of the sudo mechanism:

Special Topic: sudo, sudoers, and sudo Users

In Linux user management, one of the most important concepts is sudo.

sudo (superuser do) is a Linux command that allows an authorized user to execute a command with another user's privileges, most commonly the root user's privileges.

For example:

sudo reboot

runs the reboot command with root privileges.

However, sudo does not permanently turn a user into root. Instead, it only grants elevated privileges to the specific command being executed.

Here are some terminologies related to this topic:

  • A sudo user is simply a normal user who matches a rule in the sudoers configuration.

  • The term sudo permission describes the authorization granted by sudoers rules. A rule like:

    ALL=(ALL:ALL) ALL

    represents the most powerful form of sudo permission, while administrators can also create fine-grained rules that allow only specific commands.

/etc/sudoers: The Core of sudo Authorization

The permissions of sudo are controlled by the configuration file:

/etc/sudoers

This file defines:

  • which users or groups can use sudo
  • which commands they are allowed to run
  • which user or group they can run commands as

A sudoers rule follows this format:

user/group    host = (run_as_user:run_as_group)    command

For example:

%sudo ALL=(ALL:ALL) ALL

This rule can be broken down as:

%sudo
 |
 +-- members of the sudo group


ALL
 |
 +-- allowed on all hosts


(ALL:ALL)
 |
 +-- can run commands as any user and any group


ALL
 |
 +-- can run any command

Therefore, this rule grants unrestricted sudo privileges to all members of the sudo group.

The relationship between /etc/sudoers and the sudo group

A common misunderstanding is that being a member of the sudo group automatically gives a user administrative privileges.

That is not true.

The sudo group is just a normal Linux group. It only becomes special because /etc/sudoers contains a rule that grants this group sudo permissions.

The relationship is:

/etc/sudoers
      |
      |  %sudo ALL=(ALL:ALL) ALL
      v
  sudo group
      |
  +---+---+
  |       |
alice    bob

The process is:

  1. The user is added to the sudo group:
sudo usermod -aG sudo alice
  1. /etc/sudoers contains:
%sudo ALL=(ALL:ALL) ALL
  1. Therefore, alice inherits sudo privileges.

Without the sudoers rule, membership in the sudo group alone does nothing.

On Ubuntu and Debian systems, the default installation usually creates the sudo group and enables the rule %sudo ALL=(ALL:ALL) ALL in /etc/sudoers. This is a convention, not a special property of the group itself.

What Is a sudo User?

A sudo user is a normal Linux user account that has permission to execute commands through sudo.

A sudo user is different from the root user:

  • root user: UID = 0 always has full administrative privileges
  • sudo user: normal user account authorized through sudoers rules can temporarily execute commands with elevated privileges

For example:

whoami

returns:

alice

but:

sudo whoami

returns:

root

The user is still alice; only the specific command runs as root.

sudo Permission Levels

sudo permissions can range from completely unrestricted access to very limited command-specific access.

Full sudo access

Example:

%sudo ALL=(ALL:ALL) ALL

This allows members of the sudo group to:

  • run any command
  • as any user
  • with any group

For example:

sudo reboot
sudo apt update
sudo systemctl restart nginx
sudo useradd testuser

Restricted sudo access

Administrators can create more limited rules.

Example:

alice ALL=(root) /usr/bin/systemctl restart nginx

This allows alice to run:

sudo systemctl restart nginx

but prevents:

sudo rm -rf /

or:

sudo useradd hacker

User Management

TL;DR: To add a user with sudo privilege

sudo adduser lyk
sudo usermod -a -G adm lyk
sudo usermod -a -G sudo lyk
su - lyk

Add a Linux user

Method 1 (Recommended):

sudo adduser <username>

adduser is a Perl script which uses useradd (which is native to Linux) binary in back-end. It's more interactive and user friendly than it's back-end useradd.

Method 2:

sudo useradd <username>

Method 3: By directly modifying /etc/passwd file. Not a recommended way but one can create a Linux user by directly modifying /etc/passwd file and making an entry for new user. In such cases you need to create the group, home directory etc. individually for that user.

Grant sudo privilege to a user

sudo usermod -a -G adm <username> # Add user to adm group, grant permission to access certain journals
sudo usermod -a -G sudo <username> # Add user to sudo group, grant user sudo privilege

Alternatively, you can edit /etc/sudoers to achieve it.

  1. Add the write permisson to /etc/sudoers:

    chmod u+w /etc/sudoers

  2. Edit /etc/sudoers, below the line of root ALL=(ALL) ALL, add

    lyk ALL=(ALL) ALL

  3. Finnaly, delete the write permisson to /etc/sudoers:

    chmod u-w /etc/sudoers

Switch user account

Switch user account:

su - <username>

Assign/Change password to a Linux user

Using passwd command we can assign passwords to Linux user.

passwd <user>

Delete a Linux user

Using userdel command you can delete a user from Linux operating system.

userdel -r <user>

Before this, you need to kill the systemd process of that user, if any.

Modifying an Existing user's properties

For example, to change User Home Directory:

usermod -d /var/www/ sample

Inspect sudo users on a server

The simplest way is to check whether the user belongs to sudo group:

$ groups lyk
lyk : lyk adm sudo docker

# Or:
$ id lyk
uid=1002(lyk) gid=1002(lyk) groups=1002(lyk),4(adm),27(sudo),999(docker)

Group Management

There are two types of groups in Linux.

  • primary group: when you create a user the primary group that the user belongs to also gets created with the same name as the user. User must be a member of a primary group and there can be only one primary group for each member.
  • secondary group: It's always optional. If you have a requirement create it and add the users to it. A user can be mart of one or more secondary groups.

Create a Linux group:

groupadd <new_group_name>

Add users to a Linux group:

usermod -G secondgroup sample

usermod -G secondgroup user1

Change Name of a Linux group:

sudo groupmod -n new_name old_name

Change GID of a Linux group:

groupmod -g <new_gid> <groupname>

Remove a User from a Linux group:

gpasswd -d user1 lcousersecondary1

gpasswd -d user4 lcousersecondary1

Delete or Remove a Linux group:

groupdel secondarygroup

sudo permission management

Check All Sudo Users on a Linux system

The simplest way to check which users have sudo privileges is to check membership in the sudo group:

getent group sudo

On Ubuntu/Debian systems, the output usually looks like:

sudo:x:27:yukuanlu,wuji,alex

The users listed at the end (yukuanlu, wuji, and alex) are members of the sudo group and can usually run commands with sudo.

However, as mentioned earlier, sudo privileges are not determined only by group membership. Membership in the sudo group is just the default and most commonly used mechanism to grant administrative privileges.

This means that a user may have sudo privileges even if they are not a member of the sudo group, because administrators can grant permissions directly through sudoers rules.

The actual sudo rules are defined in:

/etc/sudoers
/etc/sudoers.d/

You may feel less familiar with /etc/sudoers.d/. The /etc/sudoers.d/ is a directory allowing administrators and software packages to add separate, fine-grained sudo configuration files without modifying the main /etc/sudoers file.

To check all sudo configurations:

sudo cat /etc/sudoers
sudo ls -l /etc/sudoers.d/

A more practical way to search for active sudo rules is:

sudo grep -R -E '^[^#].*(ALL|NOPASSWD)' /etc/sudoers /etc/sudoers.d/ 2>/dev/null

Example output:

%sudo   ALL=(ALL:ALL) ALL
yukuanlu ALL=(ALL) ALL
backup  ALL=(root) NOPASSWD: /usr/bin/rsync

This shows:

  • %sudo: all users in the sudo group have full sudo access
  • yukuanlu: a specific user has sudo access
  • backup: a service account can run a specific command without entering a password

Check whether a user is a sudo user

In the previous section we've learned how to get all sudo users on a Linux system. The most accurate way is to inspecting sudo rules defined in

/etc/sudoers
/etc/sudoers.d/

The simplest (and usually useful-enough) way is to list users in sudo group:

getent group sudo

In later discussion, we'll focus on the later way, i.e., inspecting the sudo group for brevity.

You can check whether a user is a sudo user by inspecting the sudo group.

Run:

groups username

or:

id username

Example:

uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo)

The important part is:

groups=...,sudo

which indicates that the user belongs to the sudo group (on Ubuntu/Debian).

Remember that sudo group itself is a normal Linux group, it is the grant permission defined in etc/sudoers gives this groups peivileges.

Grant a user to be sudo user

To add a user to the sudo group:

sudo usermod -aG sudo username

To remove sudo privileges from a user

sudo gpasswd -d username sudo

Note that different distributions use different administrative groups:

  • Ubuntu/Debian: sudo
  • RHEL/CentOS/Fedora: wheel

For example, Fedora commonly uses:

%wheel ALL=(ALL) ALL