Users & Permissions¶

Reference: Debian Wiki — UserAccounts · adduser(8) · sudoers(5) · Linux man-pages: chmod, chown, passwd

User Management¶

Create a User¶

# Create user with home directory
sudo useradd -m -s /bin/bash username

# Create user and add to a group immediately
sudo useradd -m -s /bin/bash -G sudo username

# Set password
sudo passwd username

adduser vs useradd

adduser is Debian's own friendlier wrapper (Ubuntu inherited it). It creates the home directory, copies /etc/skel, asks for a password and follows /etc/adduser.conf. useradd is the low-level tool, better for scripts. Either is fine.

sudo adduser username            # interactive
sudo adduser username sudo       # add an existing user to a group

Modify a User¶

# Add existing user to a group
sudo usermod -aG groupname username

# Change user's shell
sudo usermod -s /bin/bash username

# Change username
sudo usermod -l newname oldname

# Lock / unlock account
sudo usermod -L username   # lock
sudo usermod -U username   # unlock

Warning

Always use -aG (append) when adding groups. Without -a, usermod -G replaces all existing groups.

Delete a User¶

# Remove user (keep home directory)
sudo userdel username

# Remove user and their home directory
sudo userdel -r username

View User Info¶

id username          # UID, GID, and all groups
whoami               # current user
w                    # who is logged in and what they're doing
cat /etc/passwd      # all users on system
getent passwd username  # single user entry

Group Management¶

# Create a group
sudo groupadd groupname

# Delete a group
sudo groupdel groupname

# List all groups a user belongs to
groups username

# List all groups on system
cat /etc/group

File Permissions¶

Permissions are displayed as rwxrwxrwx — three sets of three for owner, group, and other.

ls -la /path/to/file
# -rw-r--r-- 1 user group 1234 Jan 1 12:00 file.txt
#  ^ owner   ^ group  ^ other

chmod — Change Permissions¶

# Symbolic
chmod u+x script.sh        # add execute for owner
chmod g-w file.txt         # remove write for group
chmod o=r file.txt         # set other to read-only
chmod a+r file.txt         # add read for all (a = all)

# Octal (most common in practice)
chmod 755 script.sh        # rwxr-xr-x  (owner full, group/other read+execute)
chmod 644 file.txt         # rw-r--r--  (owner read/write, group/other read)
chmod 600 .env             # rw-------  (owner only — use this for secrets)
chmod 700 private-dir/     # rwx------  (owner only, directory)

Octal	Binary	Meaning
7	111	read + write + execute
6	110	read + write
5	101	read + execute
4	100	read only
0	000	no permissions

# Recursive — apply to directory and all contents
chmod -R 755 /var/www/html

chown — Change Ownership¶

# Change owner
sudo chown username file.txt

# Change owner and group
sudo chown username:groupname file.txt

# Change group only
sudo chown :groupname file.txt

# Recursive
sudo chown -R username:groupname /opt/myapp

umask — Default Permission Mask¶

umask controls the default permissions applied to newly created files and directories.

umask           # view current umask (commonly 022)
umask 027       # set temporarily for session

With umask 022: new files get 644, new directories get 755. With umask 027: new files get 640, new directories get 750 — group has no write, other has nothing.

To persist, add umask 027 to ~/.bashrc or /etc/profile.

sudo¶

# Run single command as root
sudo command

# Open root shell
sudo -i

# Run as a different user
sudo -u otheruser command

# Edit sudoers safely (never edit /etc/sudoers directly)
sudo visudo                          # main file
sudo visudo -f /etc/sudoers.d/name   # a drop-in (preferred)

Grant sudo to a User¶

# Add to the sudo group (members get full sudo, with their own password)
sudo usermod -aG sudo username

# Verify (log out and back in for it to apply)
groups username

If you left the root password blank in the Debian installer, sudo is already installed and your user is in the sudo group. If you set a root password, sudo isn't installed: su -, then apt install sudo and the usermod above.

Keep the password prompt¶

The sudo group asks for your password, and that's the point: with keys-only SSH, someone who steals your SSH key still can't become root without also knowing your password. Don't make a whole account NOPASSWD: ALL for convenience.

If an automation user genuinely needs root for something, give it exactly that command and nothing else, in its own file under /etc/sudoers.d/:

# Always edit sudoers through visudo: it syntax-checks before saving (a broken file locks everyone out of sudo)
sudo visudo -f /etc/sudoers.d/backup

/etc/sudoers.d/backup

# The backup user may run borgmatic as root, with no password, and nothing else
backup ALL=(root) NOPASSWD: /usr/bin/borgmatic

Use full paths and avoid commands that can spawn a shell or edit arbitrary files (vim, less, tar, systemctl edit, docker), since any of those is effectively ALL.
Files in /etc/sudoers.d/ must not contain a . or end in ~, or sudo silently ignores them.
sudo -l -U backup shows what a user is allowed to run.
sudo usage is logged to the journal: journalctl _COMM=sudo.

The docker group is root

Membership of the docker group (or access to /var/run/docker.sock) lets a user start a container that mounts / and does anything as root. No password prompt, no sudo log. Treat adding someone to docker like giving them NOPASSWD: ALL. See Docker post-installation.

Special Permission Bits¶

# Setuid — run file as owner, not caller (e.g. passwd)
chmod u+s /usr/bin/somebinary

# Setgid — new files in dir inherit group
chmod g+s /shared/directory

# Sticky bit — only owner can delete their files (e.g. /tmp)
chmod +t /shared/directory

# View special bits
ls -la   # 's' in owner execute = setuid/setgid, 't' in other execute = sticky