"How to Create Users, Groups, and Manage Permissions in Linux

The Linux permission system is based on the principle of least privilege. This means that users and processes should have access strictly to what they need to work, reducing the attack surface in case of vulnerabilities.

In this practical guide, we cover how to create users, group them, and control access to files and directories using essential terminal commands.

1. Creating and Managing Users

Never run your application or share accounts using the root user directly. Create individual accounts with limited privileges.

Useful commands:

• Create user:
  sudo adduser username
  
  (The adduser command automatically creates the user's home folder and prompts for password creation).
• Delete user:
  sudo deluser username
• Add user to sudo group (administrator):
  sudo usermod -aG sudo username

2. Creating and Managing Groups

Groups facilitate directory sharing among multiple users (for example, developers who need to edit the same files of a website in WordPress).

How to structure:

1. Create the work group:
   sudo groupadd devteam
2. Add users to the group:
   sudo usermod -aG devteam user1
   sudo usermod -aG devteam user2

3. Changing File Owners with chown

Each file and folder in Linux belongs to a user and a group. The chown (change owner) command changes this ownership.

Practical use:

To set the www-data user and the devteam group as owners of a web application folder recursively (all subfolders): sudo chown -R www-data:devteam /var/www/mysite

4. Managing Permissions with chmod

The chmod (change mode) command defines who can read (r), write (w), or execute (x) files and directories.

Permissions are distributed to three classes:

1. Owner (User - u)
2. Group (Group - g)
3. Others (Others - o)

Numerical Representation (Octal):

• 4 = Read (read)
• 2 = Write (write)
• 1 = Execute (execute)

By summing the values, we generate the permission. For example:

• 7 (4+2+1): Full permission (read, write, and execute).
• 6 (4+2): Read and write.
• 5 (4+1): Read and execute.
• 4: Read only.

Common chmod examples:

• chmod 755 script.sh: Allows the owner to do everything, while the group and others can only read and execute (common for public scripts).
• chmod 600 id_rsa: Allows only the owner to read and write the file (required for SSH private keys).
• chmod -R 775 /var/www: Gives full permission to owner and development group, and read/execution to others.

Conclusion

Maintaining proper control of owners and permissions is one of the pillars of security for any Linux server. Applying the correct chown and chmod prevents security breaches of sensitive files without hindering the functioning of your applications.