Experiments

3 min read

User Management and Access Control

Types of Users

Root User (Super User)

  • name: root
    • UID: 0
  • group name: root (wheel in MacOS)
    • GID: 0
  • Complete unrestricted access
  • bypasses file permissions
  • The power of Super user comes from its User ID not name

System User (Service Account)

  • created by software installations like web servers and databases
  • UID: [1-999]
  • GID: [1-99]
  • Highly restricted privileges
  • Cannot login interactively
  • Used for running background applications safely
  • Examples of users (with same group names)
    • www-data (Apache/Nginx)
    • mysql
    • daemon
    • bin
    • sys
    • tty

Normal User (Human)

  • standard accounts for humans
  • UID: >1000
  • GID: >1000
  • Restricted to their home directories
  • cannot modify system files

Managing users and groups

  • Part of shadow-utils package
  • lastlog
    • report most recent login of users

User

  • useradd
    • add user
  • userdel
    • delete user
  • usermod
    • modify user
    • add/remove user from group
    • change shell
    • change home directory

Group

  • groupadd
    • add group
  • groupdel
    • delete group
  • groupmod
    • modify group

Interactive wrappers (Ubuntu)

  • addgroup: for groupadd
  • adduser: for useradd

Config files

  • /etc/passwd
    • Stores user account information with primary group
    • Username, UID, GID, shell, home directory
  • /etc/group
    • stores group definitions and memberships
    • user is omitted if the group is primary
  • /etc/shadow
    • Stores hashed passwords and password policies

Useful commands

  • Display user identity
    • shows user ID, primary group ID, additional groups
# show current user info
id
 
# show bob user info
id bob
 
> id
uid=500(me) gid=500(me) groups=500(me),80(admin),61(localaccounts)
> id -u # user
500
> id -g # group
500
  • show users in the machine with encrypted passwords and groups they belong
cat /etc/passwd
  • show user groups in the machine
cat /etc/group
  • show the groups the current user belong to
groups
  • show active users logged in the machine
w

Changing ownership

chown

  • Changes owner/group of file
  • chgrp was used in older systems to change group
# Syntax
chown <new_owner>:<new_group> <file>
 
# owner -> bob
chown bob file.txt
 
# owner -> bob, group -> users
chown bob:users file.txt
 
# owner unchanged, group -> admins
chown :admins file.txt
 
# owner -> bob, group -> login group of bob
chown bob: file.txt

Changing Identities

  • Logout and Login as different user
  • Use the su command
  • Use the sudo command

su

  • stands for Substitute User
  • Start a shell with a different user
  • you will need to enter password of new user
# start shell as bob 
su bob
 
# start login shell as bob
su -l bob
su - bob
 
# start shell as super user
su
 
# start login shell as super user
su -
su -l
 
# execute command as super user
su -c 'command'

sudo

  • execute commands as different user (generally super user)
  • It does not start a new shell
  • you will need to enter your own password
  • /etc/sudoers
    • define specific commands that particular users are permitted to execute under an assumed identity
sudo <command>

Changing password

  • Use passwd command
# change current password
passwd
 
# change password of bob
passwd bob