Managing Users and Groups

Linux is a multiuser, multitasking operating system, which means multiple users can access the operating system at the same time while sharing platform resources, with the kernel performing tasks for each user concurrently and independently. Linux provides the required isolation and security mechanisms to avoid multiple users accessing or deleting each other’s files.

When multiple users are accessing the system, permissions come into play. We’ll learn how permissions work in Linux, with their essential read, write, and execution tenets. We’ll introduce you to the concept of a superuser (root) account, with complete access to the operating system resources.

Along the way, we’ll take a hands-on approach to the topics learned, further deepening the assimilation of key concepts through practical examples. This chapter covers the following topics:

• Managing users
• Managing groups
• Managing permissions

We hope...

Technical requirements

You need a working Linux distribution installed on either a virtual machine (VM) or a desktop platform. In case you don’t have one already, Chapter 1, Installing Linux, will drive you through the related process. In this chapter, we’ll be using Ubuntu or Fedora, but most of the commands and examples used would pertain to any other Linux platform.

Managing users

In this context, a user is anyone using a computer or a system resource. In its simplest form, a Linux user or user account is identified by a name and a unique identifier, known as a UID.

From a purely technical point of view, in Linux, we have the following types of users:

• Normal (or regular) users: General-purpose, everyday user accounts, mostly suited for personal use and for common application and file management tasks, with limited access to system-wide resources. A regular user account usually has a login shell and a home directory.
• System users: These are similar to regular user accounts, except they may lack a login shell or a home directory. System accounts are usually assigned to background application services, mostly for security reasons and to limit the attack surface associated with the related resources—for example, a web server daemon handling public requests should run as a system account, ideally without login or root privileges...

Managing groups

Linux uses groups to organize users. Simply put, a group is a collection of users sharing a common attribute. Examples of such groups could be employees, developers, managers, and so on. In Linux, a group is uniquely identified by a GID. Users within the same group share the same GID.

From a user’s perspective, there are two types of groups, outlined here:

• Primary group: The user’s initial (default) login group
• Supplementary groups: A list of groups the user is also a member of; also known as secondary groups

Every Linux user is a member of a primary group. A user can belong to multiple supplementary groups or no supplementary groups at all. In other words, there is one mandatory primary group associated with each Linux user, and a user can have multiple or no supplementary group memberships.

From a practical point of view, we can look at groups as a permissive context of collaboration for a select number of users. Imagine a developers...

Managing permissions

A key tenet of Linux is the ability to allow multiple users to access the system while performing independent tasks simultaneously. The smooth operation of this multiuser, multitasking environment is controlled via permissions. The Linux kernel provides a robust framework for the underlying security and isolation model. At the user level, dedicated tools and command-line utilities help Linux users and system administrators with related permission management tasks.

For some Linux users, especially beginners, Linux permissions may appear confusing at times. This section attempts to demystify some of the key concepts about file and directory permissions in Linux. You will learn about the basic permission rights of accessing files and directories—the read, write, and execution permissions. We explore some of the essential administrative tasks for viewing and changing permissions, using system-level command-line utilities.

Most of the topics discussed in...

Summary

In this chapter, we explored some of the essential concepts related to managing users and groups in Linux. We learned about file and directory permissions and the different access levels of a multiuser environment. For each main topic, we focused on basic administrative tasks, providing various practical examples and using typical command-line tools for everyday user access and permission management operations.

Managing users and groups, and the related filesystem permissions that come into play, is an indispensable skill of a Linux administrator. The knowledge gained in this chapter will, we hope, put you on track to becoming a proficient superuser.

In the following chapter, we continue our journey of mastering Linux internals by exploring processes, daemons, and inter-process communication (IPC) mechanisms. An important aspect to keep in mind is that processes and daemons are also owned by users or groups. The skills learned in this chapter will help us navigate the...

Questions

Here are a few thoughts and questions that sum up the main ideas covered in this chapter:

1. What is a superuser?

Hint: Try sudo

2. Think of a command-line utility for creating users. Can you think of another one?

Hint: Think about adduser and useradd

3. What is the octal value of the -rw-rw-r— access permission?

Hint: Remember what the values of r, w, and x are: 4, 2, and 1

4. What is the difference between a primary group and a secondary (supplementary) group?
5. How do you change the ownership of a user’s home directory?
6. Can you remove a user from the system without deleting their home directory? How?

Further reading

Here are a few Packt titles that can help you with the task of user management:

• Mastering Ubuntu Server – Fourth Edition, Jay LaCroix
• Red Hat Enterprise Linux 9 Administration – Second Edition, Pablo Iranzo Gómez, Pedro Ibáñez Requena, Miguel Pérez Colino, and Scott McCarty