Users and groups
🏠The everyday picture
A school has teachers, students and office staff. Each person has their own login and locker; groups (Class 8, the staff room) share some rooms and cupboards.
📘What it really is
-
Every person and many services have a user account. Each user belongs to groups; groups make it easy to give several users the same access.
-
root is the all-powerful administrator. Don't sign in as root for daily work; use your own user with
sudo. -
Service users: programs like Nginx and PostgreSQL run as their own limited users (
www-data,postgres), so a bug in one can't read everything else. Your app should too (Module 65). -
Commands:
whoami,id: who you are and your groups;sudo adduser asha: create a user (with a home folder and password);sudo usermod -aG sudo asha: add to a group (sudogroup = may use sudo);sudo deluser asha;-
getent passwd,getent group: list users and groups. -
Least privilege (Modules 48 and 58): each person and service gets only the access they need; only administrators are in the
sudogroup.
🖱️Try it
Create a user deploy and a group crm. Add deploy to crm. Switch to the new user with sudo -iu deploy, run id,
and try sudo apt update (it should be refused, since deploy isn't in the sudo group). Exit back.
✅Quick check
Why do services like Nginx run as their own users?
Show the answer
So a flaw in one service can only reach what that user can, not the whole system.
Should you sign in as root for everyday work?
Show the answer
No. Use your own user and sudo only when needed.