How to Create Users, Groups, and Manage Permissions in Linux

The Linux permission system is based on the principle of least privilege. This means that users and processes should have access strictly to what they need to work, reducing the attack surface in case of vulnerabilities.

In this practical guide, we cover how to create users, group them, and control access to files and directories using essential terminal commands.

1. Creating and Managing Users

Never run your application or share accounts using the root user directly. Create individual accounts with limited privileges.

Useful commands:

• Create user:
  sudo adduser username
  
  (The adduser command automatically creates the user's home folder and prompts for password creation).
• Delete user:
  sudo deluser username
• Add user to sudo group (administrator):
  sudo usermod -aG sudo username

2. Creating and Managing Groups

Groups facilitate directory sharing among multiple users (for example, developers who need to edit the same files of a website in WordPress).

How to structure:

1. Create the work group:
   sudo groupadd devteam
2. Add users to the group:
   sudo usermod -aG devteam user1
   sudo usermod -aG devteam user2

3. Changing File Owners with chown

Each file and folder in Linux belongs to a user and a group. The chown (change owner) command changes this ownership.

Practical use:

To set the www-data user and the devteam group as owners of a web application folder recursively (all subfolders): sudo chown -R www-data:devteam /var/www/mysite

4. Managing Permissions with chmod

The chmod (change mode) command defines who can read (r), write (w), or execute (x) files and directories.

Permissions are distributed to three classes:

1. Owner (User - u)
2. Group (Group - g)
3. Others (Others - o)

Numerical Representation (Octal):

• 4 = Read (read)
• 2 = Write (write)
• 1 = Execute (execute)

By summing the values, we generate the permission. For example:

• 7 (4+2+1): Full permission (read, write, and execute).
• 6 (4+2): Read and write.
• 5 (4+1): Read and execute.
• 4: Read only.

Common chmod examples:

• chmod 755 script.sh: Allows the owner to do everything, while the group and others can only read and execute (common for public scripts).
• chmod 600 id_rsa: Allows only the owner to read and write the file (required for SSH private keys).
• chmod -R 775 /var/www: Gives full permission to owner and development group, and read/execution to others.

5. Example: a deploy user and the site directory

An account with no login password, the site group, owner, and mode. 2775 on directories sets the setgid bit: a new file inherits the web group.

sudo adduser --disabled-password --gecos "" deploy
sudo groupadd --force web
sudo usermod -aG web deploy
sudo mkdir -p /var/www/mysite
sudo chown -R deploy:web /var/www/mysite
sudo find /var/www/mysite -type d -exec chmod 2775 {} \;
sudo find /var/www/mysite -type f -exec chmod 664 {} \;
id deploy
namei -l /var/www/mysite

id shows the groups. namei -l shows the mode of each directory on the path. The public key goes in with mode 600, and the .ssh directory with 700:

sudo -u deploy mkdir -p /home/deploy/.ssh
sudo -u deploy chmod 700 /home/deploy/.ssh
echo 'ssh-ed25519 AAAA... deploy@laptop' | sudo -u deploy tee /home/deploy/.ssh/authorized_keys
sudo chmod 600 /home/deploy/.ssh/authorized_keys

Replace AAAA... with the real key. chmod 777 is not part of this sequence: every user on the server would be able to write into the application.

Conclusion

Maintaining proper control of owners and permissions is one of the pillars of security for any Linux server. Applying the correct chown and chmod prevents security breaches of sensitive files without hindering the functioning of your applications.