Users and groups on Linux¶

Practical 5.1 users-and-groups-on-linux-annex.pdf · PDF

Open a terminal in deb-lab and type two letters: id. The machine answers with something like uid=1000(student). Your name is there, in brackets. But what is that 1000 in front of it — and why does it come first?

Monday, 9:00, Tramuntana Apps. Four people start today: marta and pau in development, joan in design, aina in administration. Each of them needs an account on the new machine, the right department, and a home folder nobody else can snoop in. You are the sysadmin. By the end of this page you can do it — and you will know the classic mistake that silently throws people out of their groups.

You are a number¶

Back in Unit 2 the operating system was the kitchen manager, and one of its jobs was managing users. Here is a secret about that manager: it does not know names. Every cook wears a number on the apron, and the manager only reads numbers.

A user account is a number the system uses to tell people (and programs) apart, plus a name, a home folder and a shell for the humans.

That number is the UID (user identifier). Every file and every running program is stamped with one. The names are only a list on the kitchen wall so that humans can read the numbers.

$ id
uid=1000(student) gid=1000(student) groups=1000(student),27(sudo),100(users)...

There are three kinds of account, told apart by the UID:

The list on the wall: /etc/passwd¶

The list of numbers and names lives in a plain text file: /etc/passwd. One line per account, seven fields separated by :.

marta:x:1001:1001:Marta Vidal:/home/marta:/bin/bash

It is a table, just like staff.csv in Back to the shell, only with : instead of ,. So the same tools work:

grep "^$USER:" /etc/passwd                          # your own line
cut -d: -f7 /etc/passwd | sort | uniq -c            # how many accounts use each shell
cut -d: -f1,3 /etc/passwd | sort -t: -k2 -n | tail -4   # the four highest UIDs

The second line shows the surprise: most accounts use /usr/sbin/nologin. Most accounts on a Linux system are not people.

Three files, three jobs¶

A hash is a scrambled fingerprint of the password: the system can check a password against it, but nobody can turn it back into the password. On Debian 13 the hash in /etc/shadow starts with $y$, which means yescrypt, the method used. You will open this file properly in Account and password policies.

ls -l /etc/passwd /etc/shadow
cat /etc/shadow                   # Permission denied
sudo grep "^$USER:" /etc/shadow   # works: field 2 starts with $y$

A group is a list of users that gets rights together: one decision for the whole dev team instead of seven.

A line of /etc/group has four fields: name, x, GID, members.

sudo:x:27:student

That is the group whose members may use sudo. Check yours with getent group sudo. The command getent ("get entries") reads these account lists for you; getent passwd marta and getent group dev print just the line you ask for.

Creating users and groups¶

Back to Monday morning. One complete example, for marta:

sudo groupadd dev                 # a new, empty group
sudo adduser marta                # asks for a password and the real name
id marta                          # uid=1001(marta) gid=1001(marta) groups=1001(marta),100(users)
sudo usermod -aG dev marta        # -a append, -G to these groups
id marta                          # ... groups=1001(marta),100(users),1002(dev)
ls -ld /home/marta                # drwx------ marta marta

Read what adduser did, from its own messages:

1. It created the user marta with the next free UID.
2. It created a group with the same name, marta: her primary group.
3. It created /home/marta, copying the starter files from /etc/skel, and closed it to everybody else (drwx------).
4. It added her to the group users.

adduser is Debian's friendly tool. Underneath it calls useradd, the bare one, which creates no home and sets no password unless you tell it to. groupadd creates a group; usermod modifies an existing user.

adduser asks for a room number and phone numbers. Press Enter to skip them, then Y. If you make a typo in the user name, delete the user and create it again; never edit /etc/passwd by hand.

Primary and supplementary groups¶

Every user has:

• exactly one primary group — field 4 of /etc/passwd. On Debian it is a private group with the user's own name. New files the user creates get this group.
• any number of supplementary groups — listed in /etc/group. These are the departments: dev, design, admin.

flowchart LR
    subgraph USER ["The account marta"]
        M["<b>marta</b><br>UID 1001"]
    end
    M -->|"primary group<br>field 4 of /etc/passwd"| PG["<b>marta</b><br>GID 1001"]
    M -->|"supplementary"| U["<b>users</b><br>GID 100"]
    M -->|"supplementary"| D["<b>dev</b><br>shared with pau"]

To repair, add the lost group back with -aG. To take someone out of one group without touching the others, use gpasswd -d:

sudo usermod -aG dev pau          # back in dev
sudo gpasswd -d pau design        # out of design, dev untouched

One more surprise: after usermod, id marta shows the new group at once, but a session of marta that was already open does not have it. Group lists are read at login. Log out and in again.

Becoming someone else: su and sudo¶

There are two ways to act as another user.

The - in su - marta matters: it gives marta's own environment and home, as in a real login.

$ su - marta
$ whoami
marta
$ sudo whoami
marta is not in the sudoers file.
$ exit

Before every command, read the prompt: it tells you who you are. Forgetting exit and running the next admin command as marta is the most common mistake of the day.

When sudo asks for your password, it shows nothing while you type — not even dots. That is normal. The whole story of sudo comes in sudo and least privilege.

Locking and deleting¶

Aina goes on leave. Her account should stop working, but her files must stay.

sudo passwd -l aina      # lock
sudo passwd -S aina      # status: aina L ...   (L = locked)
su - aina                # su: Authentication failure, even with the right password
sudo passwd -u aina      # unlock: passwd -S now shows aina P ...  (P = usable password)

passwd -l puts a ! in front of the hash in /etc/shadow, so no password can ever match it. A lock closes the door for the user, not for the administrator: root can still enter with sudo su - aina.

When someone really leaves, delete the account and its home:

sudo deluser --remove-home temp
getent passwd temp       # prints nothing: the account is gone

Practical 5.1: onboarding Tramuntana Apps¶

Open the Practical 5.1 sheet (the button at the top) and do it in deb-lab. Part A has you read the three files on your own machine. Then the onboarding: three groups (dev, design, admin), four users (marta, joan, aina, pau, lab password tramuntana — weak on purpose; the system itself will refuse it soon), each in their department. You will break pau's groups on purpose and repair them, lock aina, and delete a temp user.

Write practical-5.1-surname.md as you go: commands and outputs in code blocks, plus one line of explanation for the su refusals, the -a mistake and the lock.

Key takeaways¶

• The system knows you by your UID, not your name. root is UID 0, system accounts are 1–999, people start at 1000.
• /etc/passwd lists who exists (seven fields, readable by all); /etc/shadow keeps the password hashes (root only); /etc/group lists the groups and their members.
• adduser creates the user, a primary group with the same name, and a private home directory; groupadd creates groups; id and getent check the result.
• usermod -G replaces the list of supplementary groups; usermod -aG adds to it. Forgetting -a silently removes groups.
• su - opens a session as another user with their password; sudo runs one command as root with yours.
• Locking (passwd -l) stops the password from matching but keeps the account; deluser --remove-home deletes it.

Quick check¶

2. In marta1001:1001:Marta Vidal:/home/marta:/bin/bash, what is the first 1001?

• Her UID
• Her password
• The size of her group
• The size of her home

Field 3 is the UID, the number the system really uses to identify marta. Field 4, the second 1001, is the GID of her primary group.

An account answers the question "who are you?". To create accounts on the other side of the classroom you need the other shell you will meet at work: PowerShell first contact.