Courses DevOps for Developers Linux Users and Permissions Mastery Master the fundamental concepts of Linux user management, groups, and permissions - essential skills for any DevOps professional working with Linux systems.
Master the fundamental concepts of Linux user management, groups, and permissions - essential skills for any DevOps professional working with Linux systems.
Learn how to create users, manage groups, and control permissions in Linux systems
Contents The Three Guardians of Linux Why Your Server Needs a Team, Not a Dictator Groups: The Secret to Scaling User Management The Hidden Database of Every Linux User User Creation: From Zero to Hero in One Command Group Management: Building Your Digital Organizational Chart User Modification: The Power to Transform Accounts User Switching: Become Anyone (With Permission)
References Rreferences will be added soon :) Topics Topics will be added soon .
The Three Guardians of Linux Meet the three types of users that protect and manage every Linux system - each with their own special powers and responsibilities.
Groups: The Secret to Scaling User Management Learn why managing 100 users individually is a nightmare, but managing 5 groups is a breeze - the power of Linux groups revealed.
Why Your Server Needs a Team, Not a Dictator Discover why giving everyone the root password is like giving everyone the keys to Fort Knox - and why that's a terrible idea.
Every Linux system is like a kingdom with three distinct types of inhabitants, each playing a crucial role:
🏰 The Root User - The All-Powerful Ruler
The root user is the supreme administrator with unrestricted access to everything. Think of them as having the master key to every door in the castle. They can:
Access any file or folder
Install or remove software
Modify system configurations
Create or delete other users
👤 Regular Users - The Citizens
These are everyday users like you and me. Each gets their own private space in /home/username and can:
Work within their home directory
Run applications they have permission for
Cannot access system files without permission
🔧 Service Users - The Specialized Workers
These are special accounts created for applications and services like:
MySQL database user
Apache web server user
Each service gets its own isolated user for security
Why This Matters: This separation ensures security - if one service gets compromised, it can't easily damage the entire system!
Picture this nightmare scenario: You have 50 developers, and each needs access to deploy applications. You set permissions for each user individually. Then your company grows to 100 developers. Then 200...
Without Groups = Management Hell:
Set permissions for User1 ✓
Set permissions for User2 ✓
Set permissions for User3 ✓
...User198 ✓
User47 leaves company → Remove all their permissions manually
New intern joins → Set up all permissions from scratch
With Groups = Management Paradise:
The Magic:
✨ Add user to group → Instantly gets all group permissions
🗑️ Remove user from group → Instantly loses all group permissions
🎯 Change group permissions → Affects all members automatically
📈 Scales from 10 to 10,000 users effortlessly
Best Practice: Users should get permissions through groups, not directly. This is the foundation of enterprise-level access management!
Imagine you're managing a production server worth millions of dollars. Would you give the master key to everyone on your team? Of course not!
The Problem with Shared Root Access:
🚨 No accountability - Who broke the production server at 3 AM?
🎯 Too much power - Junior developers shouldn't have nuclear launch codes
🔍 No audit trail - Impossible to track who did what
The Smart Solution: Individual User Accounts
Real-World Benefits:
Traceability: System logs show exactly who executed each commandGranular Permissions: Alice gets admin rights, Bob gets limited accessEasy Management: When Bob leaves the company, just delete his accountSecurity: If Bob's account gets compromised, the damage is contained
Pro Tip: Even system administrators should have personal accounts and only use sudo when they need elevated privileges!
# Create logical groups once
sudo groupadd developers
sudo groupadd devops-team
sudo groupadd < TopicPreview slug="database" > database < /TopicPrevie w > -admins
# Set permissions for groups once
# Add/remove users with one command
sudo usermod -aG developers new_intern
sudo deluser departing_employee developers
# Create logical groups once
sudo groupadd developers
sudo groupadd devops-team
sudo groupadd < TopicPreview slug="database" > database < /TopicPrevie w > -admins
# Set permissions for groups once
# Add/remove users with one command
sudo usermod -aG developers new_intern
sudo deluser departing_employee developers
# Instead of everyone using root, create individual accounts:
sudo adduser alice # Senior DevOps Engineer
sudo adduser bob # Junior Developer
sudo adduser charlie # <TopicPreview slug="database">Database</TopicPreview> Administrator
# Instead of everyone using root, create individual accounts:
sudo adduser alice # Senior DevOps Engineer
sudo adduser bob # Junior Developer
sudo adduser charlie # <TopicPreview slug="database">Database</TopicPreview> Administrator
User Creation: From Zero to Hero in One Command Master the art of creating users with the perfect balance of automation and customization - know when to use which command.
Creating users in Linux is like cooking - you can go quick and easy, or detailed and customized. Let's master both approaches:
Method 1: The Friendly Interactive Way
What happens behind the scenes:
✨ Creates user account
🏠 Creates /home/tom directory automatically
👥 Creates a 'tom' group and makes it primary
🔑 Prompts for password interactively
📝 Asks for user details (full name, phone, etc.)
🛡️ Sets secure default permissions
Method 2: The Script-Friendly Power Way
When to Use Which:
🖱️ adduser : Manual creation, development environments, one-off users
⚙️ useradd : Scripts, automation, mass user creation, production deployments
Pro Power Move - Custom User Creation:
Translation:
-m: Create home directory-g developers: Set primary group-s /bin/bash: Set default shell-c "...": Set user description
Remember: Both commands need sudo because user creation is a system administration task!
Group Management: Building Your Digital Organizational Chart Learn to create groups and organize users like a master architect - building the foundation for scalable permission management.
The Hidden Database of Every Linux User Uncover the secret file where Linux stores every user's information - it's simpler than you think, but more powerful than you imagine.
User Modification: The Power to Transform Accounts Master the usermod command - your Swiss Army knife for changing everything about a user account after creation.
User Switching: Become Anyone (With Permission) Learn the art of switching between users and understanding when you need superpowers - the gateway to advanced Linux administration.
Groups in Linux are like departments in a company. Let's build a proper organizational structure:
Creating the Foundation:
The Group Database:
Sample Output:
Understanding Group Anatomy:
Group Name → devops-teamPassword Placeholder → x (rarely used)Group ID (GID) → 1001Member List → alice,bob (users in this group)
Assigning Users to Groups:
Checking Group Membership:
Pro Organization Tip: Design your groups to match real-world responsibilities, not technical limitations!
Every Linux system keeps a detailed record of every user in a simple text file. Let's decode this hidden database :
Sample Output:
Decoding the Mystery (each line has 7 fields separated by colons):
Username → nanaPassword Placeholder → x (real passwords stored securely elsewhere)User ID (UID) → 1000 (root is always 0)Primary Group ID → 1000User Description → Nana,,, (full name, contact info)Home Directory → /home/nanaDefault Shell → /bin/bash (command interpreter)
Fun Facts:
🏠 Every user gets their own home directory
🔢 UIDs under 1000 are typically reserved for system users
🐚 /bin/false shell means the user can't login interactively
📁 This file is readable by everyone but only writable by root
Pro Insight: Service users often have /bin/false as their shell because they're meant to run services, not provide interactive logins!
The usermod command is like a magic wand for user accounts - it can transform any aspect of a user after creation:
Changing Primary Groups:
Managing Secondary Groups:
Other Powerful Modifications:
Real-World Example - Employee Role Change:
Safety First:
Always use -aG to ADD groups (preserves existing memberships)
Use -G only when you want to REPLACE all secondary groups
Test changes with groups username command
Pro Tip: Keep a backup of /etc/group before making major changes to group memberships!
Linux gives you the power to become any user on the system (with proper permissions). This is essential for administration and troubleshooting:
The Basic Switch:
Understanding the Dash (-):
The Modern Way - Using sudo:
Checking Your Identity:
Practical Scenario:
Security Best Practices:
Use sudo instead of su when possible (better audit trail)
Always use su - for full environment switch
Exit switched sessions with exit command
Never share root passwords - use sudo configuration instead
Pro Tip: The su command stands for "substitute user" or "switch user", not "super user" as commonly misunderstood!
# User-friendly, asks questions step by step
sudo adduser tom
# User-friendly, asks questions step by step
sudo adduser tom
# Low-level, full control, perfect for automation
sudo useradd tom
sudo passwd tom
sudo mkdir /home/tom
sudo chown tom:tom /home/tom
# Low-level, full control, perfect for automation
sudo useradd tom
sudo passwd tom
sudo mkdir /home/tom
sudo chown tom:tom /home/tom
# Create user with specific group and home directory
sudo useradd -m -g developers -s /bin/bash -c "Tom Wilson, Developer" tom
# Create user with specific group and home directory
sudo useradd -m -g developers -s /bin/bash -c "Tom Wilson, Developer" tom
devops-team:x:1001:alice,bob
developers:x:1002:charlie,diana,eve
database-admins:x:1003:alice,frank
devops-team:x:1001:alice,bob
developers:x:1002:charlie,diana,eve
database-admins:x:1003:alice,frank
root:x:0:0:root:/root:/bin/bash
nana:x:1000:1000:Nana,,,:/home/nana:/bin/bash
mysql:x:999:999:MySQL Server:/var/lib/mysql:/bin/false
root:x:0:0:root:/root:/bin/bash
nana:x:1000:1000:Nana,,,:/home/nana:/bin/bash
mysql:x:999:999:MySQL Server:/var/lib/mysql:/bin/false
# Create logical business groups
sudo groupadd devops-team
sudo groupadd developers
sudo groupadd < TopicPreview slug="database" > database < /TopicPrevie w > -admins
sudo groupadd interns
# Create logical business groups
sudo groupadd devops-team
sudo groupadd developers
sudo groupadd < TopicPreview slug="database" > database < /TopicPrevie w > -admins
sudo groupadd interns
# Check what groups exist
cat /etc/group
# Check what groups exist
cat /etc/group
# Make DevOps the user's PRIMARY group
sudo usermod -g devops-team tom
# Add user to ADDITIONAL groups (keeps existing groups)
sudo usermod -aG developers,database-admins tom
# DANGER: This REPLACES all secondary groups
sudo usermod -G developers tom # Tom loses other group memberships!
# Make DevOps the user's PRIMARY group
sudo usermod -g devops-team tom
# Add user to ADDITIONAL groups (keeps existing groups)
sudo usermod -aG developers,database-admins tom
# DANGER: This REPLACES all secondary groups
sudo usermod -G developers tom # Tom loses other group memberships!
# See groups for current user
groups
# See groups for specific user
groups tom
# Output: tom : devops-team developers database-admins
# See groups for current user
groups
# See groups for specific user
groups tom
# Output: tom : devops-team developers database-admins
# The secret user database
cat /etc/passwd
# The secret user database
cat /etc/passwd
# Move user to a different primary group
sudo usermod -g new-primary-group username
# Example: Make alice's primary group 'managers'
sudo usermod -g managers alice
# Move user to a different primary group
sudo usermod -g new-primary-group username
# Example: Make alice's primary group 'managers'
sudo usermod -g managers alice
# ADD to existing groups (safe - keeps current groups)
sudo usermod -aG group1,group2,group3 username
# REPLACE all secondary groups (dangerous!)
sudo usermod -G group1,group2 username
# Example: Add alice to admin and developers groups
sudo usermod -aG admin,developers alice
# ADD to existing groups (safe - keeps current groups)
sudo usermod -aG group1,group2,group3 username
# REPLACE all secondary groups (dangerous!)
sudo usermod -G group1,group2 username
# Example: Add alice to admin and developers groups
sudo usermod -aG admin,developers alice
# Change user's home directory
sudo usermod -d /new/home/path -m username
# Change user's default shell
sudo usermod -s /bin/zsh username
# Change username itself
sudo usermod -l newname oldname
# Lock a user account (disable login)
sudo usermod -L username
# Unlock a user account
sudo usermod -U username
# Change user's home directory
sudo usermod -d /new/home/path -m username
# Change user's default shell
sudo usermod -s /bin/zsh username
# Change username itself
sudo usermod -l newname oldname
# Lock a user account (disable login)
sudo usermod -L username
# Unlock a user account
sudo usermod -U username
# Alice gets promoted from developer to DevOps lead
sudo usermod -aG devops-team,admin alice
sudo usermod -c "Alice Johnson, DevOps Lead" alice
# Alice gets promoted from developer to DevOps lead
sudo usermod -aG devops-team,admin alice
sudo usermod -c "Alice Johnson, DevOps Lead" alice
# Switch to specific user (asks for THEIR password)
su - tom
# Switch to root user (asks for root password)
su -
# or
su - root
# Switch to specific user (asks for THEIR password)
su - tom
# Switch to root user (asks for root password)
su -
# or
su - root
# WITH dash: Full login (loads user's environment)
su - tom
# Result: You're in /home/tom with tom's PATH and settings
# WITHOUT dash: Keeps current environment
su tom
# Result: You're still in your current directory with your settings
# WITH dash: Full login (loads user's environment)
su - tom
# Result: You're in /home/tom with tom's PATH and settings
# WITHOUT dash: Keeps current environment
su tom
# Result: You're still in your current directory with your settings
# Execute single command as another user
sudo -u tom whoami
# Switch to another user (asks for YOUR password, not theirs)
sudo su - tom
# Become root temporarily
sudo su -
# Execute single command as another user
sudo -u tom whoami
# Switch to another user (asks for YOUR password, not theirs)
sudo su - tom
# Become root temporarily
sudo su -
whoami # Shows current username
id # Shows user ID and all groups
pwd # Shows current directory
echo $HOME # Shows home directory path
whoami # Shows current username
id # Shows user ID and all groups
pwd # Shows current directory
echo $HOME # Shows home directory path
# You're troubleshooting why tom can't access a file
echo "I am: $( whoami )"
sudo su - tom
echo "Now I am: $( whoami )"
ls -la /path/to/problem/file
exit # Return to your original user
echo "Back to: $( whoami )"
# You're troubleshooting why tom can't access a file
echo "I am: $( whoami )"
sudo su - tom
echo "Now I am: $( whoami )"
ls -la /path/to/problem/file
exit # Return to your original user
echo "Back to: $( whoami )"
