We've taken care of the initial configuration; let's wrap up this chapter by covering a few finishing touches in the configuration, creating users, and giving them power!
Before logging on as your new user, you might want to give them the ability to do superuser things, like the pi account does. Let's take a look at how to give your new user more powers!
Note
What is this sudo thing anyway? If you are new to Linux, it probably seems strange to see a lot of these commands start with sudo. This command means superuser-do, which puts the command in a temporary elevated state. sudo is intended to prevent regular users from being able to do something they shouldn't (such as formatting a disk or deleting a filesystem), but it gives certain users powers to do those things if they specifically ask for elevation. It also logs attempts at trying to run things with elevated permissions that users were not given permission to do. It should become more clear as we move through the cookbook, but if you find yourself typing a command, failing, and then typing it again with sudo when you realize your mistake, you are already living the life of many experienced Linux users.
To give your user the ability to run as a superuser, use the visudo tool:
sudo visudo
This opens an edit window of the sudoers file, which will allow you to give your new user special permissions. Look down to where the pi user is already set up, and add rpz ALL=(ALL) ALL, like this:
#includedir /etc/sudoers.d
pi ALL=(ALL) NOPASSWD: ALL
rpz ALL=(ALL) ALL
This gives your user the same permissions as the pi user, but requires that you enter a password when executing something that requires elevated permissions. This way, you can prevent the unauthorized execution of things that only a superuser should execute.
You can try logging in as our new user and trying to sudo. The touch command creates an empty file wherever you tell it to. If you don't have permissions to write, the touch command will fail. We will try logging on as our rpz user and trying touch with and without sudo, in a directory that requires elevated permission to write to. Use the su command to log on as another user:
pi@rpz14101:~ $ sudo su - rpz
rpz@rpz14101:~ $ touch /opt/testsudo.deleteme
touch: cannot touch '/opt/testsudo.deleteme':
Permission denied
rpz@rpz14101:~ $ sudo touch /opt/testsudo.deleteme
[sudo] password for rpz:
rpz@rpz14101:~ $ ls /opt
minecraft-pi pigpio sonic-pi testsudo.deleteme
vc Wolfram
Excellent! You now have superuser abilities (but remember, Spider-Man, with great power comes great responsibility), and whoever is executing them needs to know your password (which is only you, of course). If you'd prefer to keep the permissions the same as the pi user, you can sudo visudo the permissions again and set your user's settings to NOPASSWD: ALL, just like for the pi user.
There is a collection of user and group commands you can use beyond adduser: addgroup, usermod, and userdel are all good things to put in your administrator's toolbox. For pretty much any Linux command, adding --help (for example, useradd --help) or prefixing with man (man useradd) will provide you with instructions and options for what you can do with it:
rpz@rpz14101:~ $ useradd --help
Usage: useradd [options] LOGIN
useradd -D
useradd -D [options]
Options:
-b, --base-dir BASE_DIR base directory for
the home directory of the
new account
-c, --comment COMMENT GECOS field of the
new account
-d, --home-dir HOME_DIR home directory of
the new account
-D, --defaults print or change
default useradd configuration
-e, --expiredate EXPIRE_DATE expiration date of
the new account
-f, --inactive INACTIVE password inactivity
period of the new account
-g, --gid GROUP name or ID of the
primary group of the new
account
-G, --groups GROUPS list of
supplementary groups of the new
account
-h, --help display this help
message and exit
-k, --skel SKEL_DIR use this alternative
skeleton directory
-K, --key KEY=VALUE override
/etc/login.defs defaults
-l, --no-log-init do not add the user
to the lastlog and
faillog databases
-m, --create-home create the user's
home directory
-M, --no-create-home do not create the
user's home directory
-N, --no-user-group do not create a
group with the same name as
the user
-o, --non-unique allow to create
users with duplicate
(non-unique) UID
-p, --password PASSWORD encrypted password
of the new account
-r, --system create a system
account
-R, --root CHROOT_DIR directory to chroot
into
-s, --shell SHELL login shell of the
new account
-u, --uid UID user ID of the new
account
-U, --user-group create a group with
the same name as the user
-Z, --selinux-user SEUSER use a specific
SEUSER for the SELinux user mapping
Argentina
Australia
Austria
Belgium
Brazil
Bulgaria
Canada
Chile
Colombia
Cyprus
Czechia
Denmark
Ecuador
Egypt
Estonia
Finland
France
Germany
Great Britain
Greece
Hungary
India
Indonesia
Ireland
Italy
Japan
Latvia
Lithuania
Luxembourg
Malaysia
Malta
Mexico
Netherlands
New Zealand
Norway
Philippines
Poland
Portugal
Romania
Russia
Singapore
Slovakia
Slovenia
South Africa
South Korea
Spain
Sweden
Switzerland
Taiwan
Thailand
Turkey
Ukraine
United States
Filter
