Linux User and Permission Management: sudo and Groups

User and permission management in Linux is a cornerstone of server security. Properly configured user accounts and permissions prevent unauthorized access and limit the impact of security breaches. This guide covers Linux user management, group structure, sudo configuration, and SSH key-based authentication.

User Management

Creating Users

hljs bash

# Create a basic user
sudo useradd username

# Create user with home directory
sudo useradd -m username

# With home directory, shell, and comment
sudo useradd -m -s /bin/bash -c "Full Name" username

# With specific UID
sudo useradd -m -u 1500 username

# With primary group
sudo useradd -m -g www-data username

# Set password
sudo passwd username

# View user information
id username
getent passwd username

Modifying Users

hljs bash

# Rename user
sudo usermod -l new_name old_name

# Change home directory
sudo usermod -d /new/home -m username

# Change shell
sudo usermod -s /bin/bash username

# Lock account
sudo usermod -L username

# Unlock account
sudo usermod -U username

# Set account expiry date
sudo usermod -e 2025-12-31 username

# Force password change on next login
sudo chage -d 0 username

Deleting Users

hljs bash

# Delete user (home directory preserved)
sudo userdel username

# Delete user and home directory
sudo userdel -r username

# Find files owned by user
find / -user username 2>/dev/null

Group Management

hljs bash

# Create a group
sudo groupadd developers

# Add user to group
sudo usermod -aG developers username

# Add to multiple groups
sudo usermod -aG group1,group2,group3 username

# View user's groups
groups username
id username

# List users in a group
getent group developers

# Remove user from group
sudo gpasswd -d username developers

# Delete group
sudo groupdel developers

# Rename group
sudo groupmod -n new_name old_name

sudo Configuration

Granting sudo Access

hljs bash

# Add user to sudo group (Debian/Ubuntu)
sudo usermod -aG sudo username

# Add user to wheel group (RHEL/CentOS)
sudo usermod -aG wheel username

# Test the change
su - username
sudo whoami  # should output: root

Configuring the sudoers File

hljs bash

# Edit sudoers file safely
sudo visudo

# /etc/sudoers content

# Full sudo access for user
username ALL=(ALL:ALL) ALL

# Passwordless sudo (use with caution)
username ALL=(ALL) NOPASSWD: ALL

# Sudo for specific commands only
username ALL=(ALL) /usr/bin/systemctl, /usr/bin/apt

# Sudo access for a group
%developers ALL=(ALL:ALL) ALL

# Passwordless for specific command
username ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

hljs bash

# Create separate file (recommended approach)
sudo nano /etc/sudoers.d/username

# File content
username ALL=(ALL:ALL) ALL

# Set file permissions
sudo chmod 440 /etc/sudoers.d/username

File Permissions

hljs bash

# View permissions
ls -la /directory/

# Change permissions (numeric)
chmod 755 script.sh    # rwxr-xr-x
chmod 644 file.txt     # rw-r--r--
chmod 600 secret.key   # rw-------

# Change permissions (symbolic)
chmod u+x script.sh    # add execute for owner
chmod g-w file.txt     # remove write from group
chmod o-r secret.txt   # remove read from others

# Change ownership
chown username file.txt
chown username:group file.txt

# Change directory and contents recursively
chown -R username:group /directory/

# Special permissions
chmod +s /usr/bin/program  # SUID bit
chmod g+s /shared/dir      # SGID bit
chmod +t /tmp              # Sticky bit

SSH Key-Based Authentication

Generating SSH Key Pair

hljs bash

# Generate key on local machine
ssh-keygen -t ed25519 -C "email@example.com"

# RSA key (for older systems)
ssh-keygen -t rsa -b 4096 -C "email@example.com"

# Keys are created in ~/.ssh/:
# ~/.ssh/id_ed25519 (private key)
# ~/.ssh/id_ed25519.pub (public key)

Copying Public Key to Server

hljs bash

# Using ssh-copy-id (easiest method)
ssh-copy-id user@server_ip

# Manual copy
cat ~/.ssh/id_ed25519.pub | ssh user@server_ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

# Manual setup on server
mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys  # paste public key
chmod 600 ~/.ssh/authorized_keys

SSH Security Configuration

hljs bash

# Edit SSH configuration
sudo nano /etc/ssh/sshd_config

# Disable password authentication (after key is set up)
PasswordAuthentication no

# Disable root login
PermitRootLogin no

# Disallow empty passwords
PermitEmptyPasswords no

# Maximum login attempts
MaxAuthTries 3

# Allow specific users
AllowUsers user1 user2

# Allow specific group
AllowGroups ssh-users

hljs bash

# Restart SSH service
sudo systemctl restart sshd

# Test configuration (before disconnecting)
sudo sshd -t

Principle of Least Privilege

The Principle of Least Privilege states that every user and process should have only the minimum permissions needed to perform their task.

hljs bash

# Create dedicated user for application (no shell)
sudo useradd -r -s /usr/sbin/nologin -d /var/lib/myapp myapp_user

# For web server
sudo useradd -r -s /usr/sbin/nologin www-data

# Create home directory for service user
sudo mkdir -p /var/lib/myapp
sudo chown myapp_user:myapp_user /var/lib/myapp
sudo chmod 750 /var/lib/myapp

# Verify what files the user can access
sudo -u myapp_user ls /var/lib/myapp

Avoid using the root account directly. Create separate accounts for each administrator and authorize via sudo. This way, all actions are logged and traceable.

Monitoring User Activity

hljs bash

# View recent logins
last
lastlog

# View failed login attempts
lastb

# View active users
who
w

# User command history
cat /home/username/.bash_history

# Monitor sudo usage
sudo grep sudo /var/log/auth.log

Conclusion

Linux user and permission management forms the foundation of server security. Grant each user only the permissions they need, use SSH key-based authentication, and restrict root access. These practices protect your REXE servers against unauthorized access.

Linux User and Permission Management: sudo and Groups

Table of Contents