Skip to main content

Users and permissions

Users and groups

# Create a user, then add it to groups (copy another user's groups first)
sudo adduser newuser
groups olduser
sudo usermod -aG group1,group2 newuser

# Delete a user and its home directory
sudo deluser --remove-home olduser
sudo groupdel olduser

# Passwords
passwd # change your own
sudo passwd root # set root's password
sudo su - # switch to root with a login shell (- loads root's env)

Inspect users and groups:

id USER # uid, gid and group membership
groups USER # groups a user belongs to
who # active login sessions
w # active sessions plus what each is doing
compgen -u # list all users
compgen -g # list all groups

whoami reports the credentials of the current process; who/w report the login-session table. They can differ, for example after sudo su -.

Permissions

A mode string like -rw-rw-r-- reads as: type, then owner / group / others, each as r (read), w (write), x (execute).

OctalPermissionSymbolic
0none---
1execute--x
2write-w-
3write + execute-wx
4readr--
5read + executer-x
6read + writerw-
7read + write + executerwx

touch creates files as 664 (-rw-rw-r--) by default.

sudo chown new-owner FILE # change owner
sudo chgrp group FILE # change group
chmod 770 DIR # rwx for owner and group, nothing for others

Fine-grained access with ACLs

When ownership and group bits are not enough, POSIX ACLs grant a specific user access without changing the file's owner or group:

setfacl -m u:postgres:r /root/service/backend/prod-oauth-postgresql.sql
getfacl /root/service/backend

Shared folder between two users

Give both users a common group and a group-writable, setgid directory so new files inherit the group:

sudo groupadd projectA
sudo mkdir /home/sharedFolder
sudo chgrp projectA /home/sharedFolder
sudo chmod 770 /home/sharedFolder # rwx owner + group, none for others
sudo chmod +s /home/sharedFolder # setgid: new files inherit the group
sudo usermod -aG projectA Bob
sudo usermod -aG projectA Alice

The setgid bit (chmod +s on a directory, or g+s) is what makes this work: without it, files created in the shared folder keep the creator's primary group and the other user cannot write them.