User group others linux

User Groups and Permissions in Linux

From smartphones to cars, supercomputers and home appliances, home desktops to enterprise servers, the Linux operating system is everywhere.

Introduction

To create a secure environment in Linux, you need to learn about user groups and permissions. For example, if you work in a company and you want the finance department to read a file but not make any modification to it, then you need to use permissions in Linux. It is a must for every programmer working with Linux nowadays.

Prerequisites

To follow along with this tutorial, you should have:

Table of contents

File permissions

Let’s start by talking about the ownership of Linux files.

1. User: the owner of the file (person who created the file).
2. Group: the group can contain multiple users. Therefore, all users in that group will have the same permissions. It makes things easier than assign permission for every user you want.
3. Other: any person has access to that file, that person has neither created the file, nor are they in any group which has access to that file.

When you perform the following command:

Then you will see the file’s permissions, like the following:

We will work with this part “-rw-r–r–”.

As we see above, the empty first part means that it is a file. If it were a directory then it will be the letter “d” instead. The second part means that the user “Home” has read and write permissions but he does not have the execute one. The group and others have only the read permission.

Let’s change the permissions using the chmod command.

This command will add the write permission for other users to my text file “section.txt”.

Now if you try to execute ls -l then you will see -rw-r—rw- .

“o” refers to others, “g” for the group, “u” for the user, and “a” for all.

Now let’s add the execute permission to the user with:

The permissions will be -rwxr—rw- .

If you want to remove the permission, you can use the same method but with “-” instead of “+”. For example, let’s remove the execute permission from the user by:

And the permissions now are: -rw-r—rw- .

Also, you can use Symbolic Mode to modify permissions like the following:

Number	Permission
0	No permission
1	Execute
2	Write
3	Execute and Write
4	Read
5	Read and Execute
6	Read and Write
7	Read, Write and Execute

For example, let’s give every permission for all with:

Then the permissions will be: -rwxrwxrwx .

Let’s remove the execute from the group and the write from other by:

The permissions will be: -rwxrw-r-x .

User accounts

Create a user

We can create a new user account by issuing the following command:

We can make sure that the user has been created in two ways:

And the output will be something like this:

uid=1007(testuser) gid=1009(testuser) groups=1009(testuser) 

This will show the user id and the groups that the user is currently in, usually, a new group with the same username is assigned to the user.

So we can issue cat /etc/passwd and we will see the new user that has been created.

After creating the user using the command above, you notice that no user directories have been created inside /home directory, which is not good since the user cannot log in to his account.

To create a new user with its directories, we can issue:

sudo useradd -m -s /bin/bash testuser 

If you navigate to the /home directory, you notice that a new directory with the name testuser is created.

Afterwards, you need to set a new password to the testuser by:

We noticed that creating a new user takes a lot of commands to accomplish, so there is a command that automates everything:

After creating a new user and setting a password to it, you can log in in two ways:

Delete a user

Like the process of adding users, there are two commands that delete a user.

If you try that command, you will notice that the user directory has not been deleted and you need to delete it by yourself.

You can use this automated command to do everything for you:

sudo deluser --remove-home testuser 

User groups

A group is a collection of users. The primary purpose of the groups is to define a set of privileges like read, write, or execute permission for a given resource that can be shared among the users within the group.

Create a group

You can see all of the groups you have by opening the following file:

Let’s create a group with the name of section by:

Add user to a group

We will add the testuser user to the section group by:

sudo usermod -aG section testuser 

Delete user from a group

You can delete the testuser from the group with:

sudo gpasswd -d testuser section 

Delete a group

Let’s delete the previous group by:

Conclusion

Linux is one of the most secure systems because it allows an admin to create multiple users with different permissions in the same hardware.

And now you know exactly how to do it!✨

Further reading

Peer Review Contributions by: Odhiambo Paul

Источник

How to manage users and groups in Linux

«What skills must Linux administrators have?» is way too broad a question for any single article. But there are plenty of general must-have sysadmin skills—and user and group administration are chief among them. Proper user account management enables Linux to enforce access controls (permissions) and audit who does what on the system.

Great Linux resources

The commands below are written for Red Hat Enterprise Linux (RHEL) and RHEL-like distributions, but the concepts apply to any distribution of Linux. Knowing the skills and commands outlined in this article (and its two follow-up pieces, which dive deeper into user admin and group admin) helps ensure you’re ready for the day-to-day user and group administration tasks a sysadmin is called on to do.

Managing users

Users must authenticate to any system they need to use. This authentication provides access to resources and a customized, user-specific environment. The user’s identity is based on their user account. What skills do sysadmins need to manage user accounts?

1. Understand the /etc/passwd file

User account information is stored in the /etc/passwd file. This information includes the account name, home directory location, and default shell, among other values. Linux sysadmins should be able to recognize these fields.

Each field is separated by a : character, and not all fields must be populated, but you must delineate them.

Here’s an example of the /etc/passwd fields:

username:password:UID:GID:comment:home:shell

In this example, the comment field is empty:

dgarn:x:1001:1001::/home/dgarn:/bin/bash

Observe how the two colons still exist to delineate the comment field.

Here is an example with the comment field populated:

dgarn:x:1001:1001:Damon Garn:/home/dgarn:/bin/bash

I’ll discuss passwords more below, but expect to see an x in the password field of this file.

2. Understand the /etc/shadow file

Long ago, password hashes were stored in the /etc/passwd file. This file was world-readable, allowing inquisitive users to pull password hashes for other accounts from the file and run them through password-cracking utilities. Eventually, the password hashes were moved to a file readable only by root: /etc/shadow . Today, the password field in the /etc/passwd file is marked with an x .

Administrators should recognize each field in /etc/shadow . Several of the fields pertain to password requirements.

Here’s an example of /etc/shadow fields:

username:password:last password change:min:max:warning:inactive:expired

The first two fields identify the user and a hashed version of the password, while the remaining six fields represent password change information. The password information is manipulated with the chage command.

Look at these articles for additional details:

3. Create, modify, and delete user accounts

The process for managing user accounts is very straightforward. Sysadmins either add, modify, or delete users, and the related commands are quite intuitive.

The commands to manage user accounts on RHEL and RHEL-like distributions are:

Ken Hess documents these commands in Linux sysadmin basics: User account management. There are many options available to customize the user accounts and their related resources.

My companion article provides specifics about the useradd , usermod , and userdel commands.

[ You might also be interested in downloading the Bash shell scripting cheat sheet. ]

4. Manage password requirements

Many organizations rely on password policies to define appropriate password requirements. Sysadmins can enforce those requirements by using various mechanisms on Linux.

Two common ways of managing password settings are using the /etc/login.defs file or Pluggable Authentication Module (PAM) settings. Be sure to understand the options, fields, and settings for this important security configuration.

For more detail on password security settings, read:

Managing groups

It’s more efficient to group user accounts with similar access requirements than to manage permissions on a user-by-user basis. Therefore, sysadmins need to be comfortable with the process of creating, modifying, and deleting groups.

[ Practice your Linux skills in the free online course RHEL technical overview. ]

1. Understand the /etc/group file

Similar to the /etc/passwd file above, the /etc/group file contains group account information. This information can be essential for troubleshooting, security audits, and ensuring users can access the resources they need.

Understand each field of the file to make life easier as a sysadmin.

The fields in the /etc/group file are:

groupname:password:GID:group members

Here is an example of the editors group with two members:

Tyler Carrigan’s article Managing local group accounts in Linux presents this information nicely.

Linux groups are significantly different from local groups in Windows, so be sure to understand the differences.

2. Create, modify, and delete groups

Like the user account commands described above, the group management commands are very intuitive and provide a lot of flexibility. There is an easy-to-remember command for each function you might need to carry out for a group:

The following articles provide a good overview of working with groups:

3. Manage group membership

Linux security

Adding users to a group simplifies permissions management. Many people find the process a little unintuitive: Adding a user to a group modifies the user, not the group. Therefore, the necessary command is the usermod command.

Here are some commands to display group information:

• usermod : Update group membership
• id : Display a list of groups the user is a member of
• cat /etc/group : Show a list of existing groups, with membership displayed in the last field

One resource for these commands is their related man pages.

The process for adding users to a group requires the -a and/or -G options. Tyler Carrigan’s article Managing local group accounts in Linux covers using these options to manipulate group membership.

Wrap up

If these commands and files seem familiar, you can probably manage most basic sysadmin user and group management tasks in RHEL. Otherwise, you now have some great resources right at your fingertips for learning more.

Источник