Users, groups and sudo on Debian, Ubuntu and RHEL

Every process on Linux runs as a user, and every file belongs to a user and a group. Permissions decide what each user may read, write or run. The special user root (user ID 0) may do anything. On a well-run server, people log in with their own accounts and use sudo to run single commands as root, so every admin action is tied to a name and logged.

Where accounts live

• /etc/passwd: one line per account with name, user ID (UID), primary group ID, home directory and login shell. Readable by everyone; it contains no passwords.
• /etc/shadow: password hashes and expiry data, readable only by root.
• /etc/group: groups and their extra (supplementary) members.

Accounts below UID 1000 are usually system accounts for services (www-data, nginx, postgres) and have no real login shell.

id                      # your UID, primary group and all groups
id admin                # the same for another user
getent passwd admin     # the account's passwd line
groups admin
who                     # who is logged in now
last -n 10              # recent logins

Creating a user

useradd exists on every distribution. Pass -m to create a home directory and -s to set a shell; without them some systems create an account with no home and a minimal shell.

sudo useradd -m -s /bin/bash -c "Alex Admin" admin
sudo passwd admin

Debian and Ubuntu also ship adduser, a friendlier wrapper that asks for the password and details interactively: sudo adduser admin.

Groups

Each user has one primary group (by default a group with the same name) and any number of supplementary groups, which grant shared access, for example to a project directory or to the Docker socket.

sudo groupadd developers
sudo usermod -aG developers admin     # ADD to a group
sudo gpasswd -d admin developers      # remove from a group

Always use -aG, not just -G. usermod -G developers admin without -a replaces all of the user’s supplementary groups, which can silently remove their admin rights. Group changes apply at the next login; the user must log out and back in.

sudo: admin rights for named users

sudo runs one command as root after asking for your password, and records it in the system log. Who may use it is defined in /etc/sudoers and files in /etc/sudoers.d/. Distributions pre-configure an admin group:

• Debian and Ubuntu: members of the sudo group. sudo usermod -aG sudo admin (or sudo adduser admin sudo).
• RHEL, Rocky, AlmaLinux: members of the wheel group, through the line %wheel ALL=(ALL) ALL. sudo usermod -aG wheel admin.

On Debian, if you set a root password during installation, sudo may not be installed and no user is in the sudo group; install it as root with apt install sudo first.

sudo -l               # what am I allowed to run?
sudo -v               # refresh credentials / test that sudo works
sudo -i               # a root login shell, when you really need one

Custom sudo rules

Never edit /etc/sudoers with a normal editor: a syntax error can lock everyone out of sudo. Put your rules in a separate file in /etc/sudoers.d/ and edit it with visudo, which checks the syntax before saving:

sudo visudo -f /etc/sudoers.d/deploy

# let the deploy user restart one service without a password
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp.service

A line starting with % refers to a group. Afterwards run sudo visudo -c to check the complete configuration including all included files. Avoid NOPASSWD: ALL for people; it turns a stolen session into instant root.

Locking and removing accounts

sudo usermod -L admin                  # lock the password
sudo usermod -s /usr/sbin/nologin admin # stop interactive logins
sudo chage -E 0 admin                  # expire the account entirely

A locked password does not stop SSH key logins; expiring the account or changing the shell does. Warning: sudo userdel -r admin deletes the account and its home directory and mail spool permanently. Check what is in the home directory and back it up first, or run userdel without -r to keep the files.

Official documentation

• Debian Wiki: sudo
• useradd(8)
• visudo(8)