Users, Groups & sudo
BeginnerLinux multi-user system — every process runs as a user, every file has an owner. Understanding users, groups, /etc/passwd, /etc/shadow, and sudo is essential for system administration and security.
Overview
Linux is a multi-user operating system. Every process runs under a UID (user ID) and one or more GIDs (group IDs). User accounts are stored in /etc/passwd (readable by all) and passwords in /etc/shadow (root-only). The root user (UID 0) has unrestricted access to everything. sudo allows specific users to run commands as root (or any other user) under audit logging, controlled by /etc/sudoers. Service accounts (www-data, postgres, nobody) run daemons with minimal privileges.
User and Group Management
useradd, usermod, userdel, groupadd — the core commands for managing users and groups. On Ubuntu/Debian, adduser is a friendlier wrapper around useradd.
# Create users
useradd -m -s /bin/bash akshay # -m: create home, -s: shell
useradd -r -s /sbin/nologin www-data # system user (no login shell)
adduser akshay # interactive (Ubuntu/Debian)
# Set/change password
passwd akshay # interactive
echo "newpass" | passwd --stdin akshay # non-interactive (scripting)
# Modify a user
usermod -aG docker akshay # add akshay to docker group (append, don't replace)
usermod -aG sudo akshay # grant sudo access on Debian/Ubuntu
usermod -s /bin/zsh akshay # change shell
usermod -L akshay # lock account (disable password login)
usermod -U akshay # unlock account
# Delete user
userdel akshay # keep home directory
userdel -r akshay # delete home and mail spool too
# Groups
groupadd developers
groupdel developers
groups akshay # list groups for user
id akshay # uid, gid, and all groups
# Who is logged in?
who # current sessions
w # with what they're doing
last # login history/etc/passwd and /etc/shadow
User account information is split across two files. passwd is world-readable (no passwords stored); shadow is root-only and stores hashed passwords.
# /etc/passwd format (world-readable, 644)
cat /etc/passwd | grep akshay
# akshay:x:1000:1000:Akshay Sonalkar:/home/akshay:/bin/bash
# ──────────────────────────────────────────────────────────
# field 1: username
# field 2: x = password in /etc/shadow
# field 3: UID (1000+ = regular users; <1000 = system accounts)
# field 4: GID (primary group)
# field 5: GECOS / comment (full name)
# field 6: home directory
# field 7: login shell (/sbin/nologin = no interactive login)
# /etc/shadow format (root-only, 640)
sudo cat /etc/shadow | grep akshay
# akshay:$6$salt$hashedpassword:19000:0:99999:7:::
# field 1: username
# field 2: hashed password ($6$ = SHA-512)
# field 3: last password change (days since epoch)
# field 4: minimum days before change
# field 5: maximum days before forced change
# /etc/group format
cat /etc/group | grep docker
# docker:x:998:akshay,alice ↠group:password:GID:memberssudo — Controlled Privilege Escalation
sudo runs a command as root (or another user) with audit logging. /etc/sudoers (edited with visudo) controls who can run what.
# Basic sudo usage
sudo apt update # run as root
sudo -u postgres psql # run as postgres user
sudo -i # open root shell (login shell)
sudo -s # open root shell (current environment)
sudo !! # re-run last command with sudo
# /etc/sudoers format (edit only with: sudo visudo)
# Format: WHO WHERE = (AS_WHOM) WHAT
# Full sudo access (like Ubuntu's sudo group):
akshay ALL=(ALL:ALL) ALL
# No password required for specific commands:
akshay ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx, /bin/systemctl status
# Allow a group to sudo:
%docker ALL=(ALL) NOPASSWD: /usr/bin/docker
# Sudoers.d — drop-in files (safer than editing /etc/sudoers directly)
echo "akshay ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/akshay
chmod 440 /etc/sudoers.d/akshay
# View sudo audit log
sudo cat /var/log/auth.log | grep sudoKey Points to Remember
- 1Every process runs as a UID; every file has an owner UID and group GID.
- 2System users (UID < 1000) run services — they have /sbin/nologin shell (no interactive login).
- 3/etc/passwd is world-readable; /etc/shadow (password hashes) is root-only.
- 4usermod -aG adds a user to a group without removing existing groups (-a = append).
- 5Always edit /etc/sudoers with visudo — it validates syntax before saving.
- 6Prefer /etc/sudoers.d/ drop-in files to reduce risk of breaking the sudoers file.
Interview Questions
Sign in to ask AriaWhat is the difference between su and sudo?
How do you add a user to the docker group and why is this needed?
Ask Aria about Users, Groups & sudo
Your personal AI tutor — ask anything about this concept
Revision Status
Personal Notes
Sign in to save personal notes for this topic.
Discussion
Sign in to join the discussion.