Linux User Group and Permission Management

# Linux User Group and Permission Management

Introduction

User and permission management is fundamental to Linux security. Every file, directory, and process has an owner and group with specific permissions. Proper user and group management ensures that users can access only what they need, following the principle of least privilege.

This tutorial covers user and group creation, modification, and deletion, file permissions (chmod, chown), special permissions (setuid, setgid, sticky bit), Access Control Lists (ACLs), sudo configuration, and permission best practices.

By the end of this guide, you will be able to manage Linux users, groups, and permissions securely and effectively.

Technical Background

Linux Permission Model

Linux uses a Discretionary Access Control (DAC) model with three permission types:

| Permission | Symbol | Numeric | File Effect | Directory Effect | |------------|--------|---------|-------------|------------------| | Read | r | 4 | View file contents | List directory contents | | Write | w | 2 | Modify file contents | Create/delete files in directory | | Execute | x | 1 | Execute file/program | Enter directory (cd) |

Permission Classes

| Class | Description | |-------|-------------| | User (u) | File owner | | Group (g) | Group members | | Other (o) | All other users |

Special Permissions

| Permission | Symbol | Numeric | File Effect | Directory Effect | |------------|--------|---------|-------------|------------------| | SetUID | s | 4 | Run as file owner | - | | SetGID | s | 2 | Run as group owner | New files inherit directory group | | Sticky Bit | t | 1 | - | Users can only delete own files |

Umask

Umask determines default permissions for newly created files:

• Default file: 666 - umask
• Default directory: 777 - umask
• Common umask 022: Files 644, directories 755

Prerequisites

• Linux system with root or sudo access
• Understanding of file ownership and permissions
• Test files and directories for practice

Architecture

Permission Representation

File: -rwxr-xr-- 1 owner group 4096 Jan 1 12:00 filename
  └─┬─┘└─┬─┘└─┬─┘
   │    │    └── Other: read only (r--)
   │    └─────── Group: read+execute (r-x)
   └──────────── Owner: read+write+execute (rwx)

First character indicates file type:

• `-` Regular file
• `d` Directory
• `l` Symbolic link
• `s` Socket
• `b` Block device
• `c` Character device

Sudo Privilege Model

User → sudo → /etc/sudoers → Command as root (or another user)

Step-by-Step Implementation

Step 1: Create and Manage Users

**Purpose**: Create user accounts with appropriate settings.

**Commands**:

# Create a new user with home directory
sudo useradd -m -s /bin/bash jdoe

# Create user with specific UID and primary group
sudo useradd -m -s /bin/bash -u 2001 -g developers jdoe

# Set password for user
sudo passwd jdoe

# Create user without login (system account)
sudo useradd -r -s /usr/sbin/nologin service-account

# View user information
id jdoe
finger jdoe  # if installed
getent passwd jdoe

# Modify user (change shell, home, groups)
sudo usermod -s /bin/zsh jdoe
sudo usermod -aG sudo jdoe  # Add to sudo group (append)

# Lock/unlock user account
sudo passwd -l jdoe   # Lock
sudo passwd -u jdoe   # Unlock

# Delete user (with home directory)
sudo userdel -r jdoe

**Expected output**: User accounts created, modified, or removed.

**Verification**:

id jdoe
# Shows uid, gid, and groups

Step 2: Create and Manage Groups

**Purpose**: Create groups for organizing users by function or department.

**Commands**:

# Create a new group
sudo groupadd developers

# Create group with specific GID
sudo groupadd -g 3001 operations

# Add user to group
sudo usermod -aG developers jdoe

# Remove user from group
sudo gpasswd -d jdoe developers

# View group members
getent group developers

# List all groups a user belongs to
groups jdoe

# Delete group
sudo groupdel developers

**Explanation**: `-aG` appends user to additional group without removing from other groups. Without `-a`, user is removed from all groups not listed.

**Expected output**: Groups created and users assigned.

**Verification**:

getent group developers
# Shows group name, password, GID, and member list

Step 3: Manage File Permissions with chmod

**Purpose**: Set read, write, execute permissions on files and directories.

**Commands**:

# Symbolic mode
chmod u+x script.sh           # Add execute for owner
chmod g-w document.txt        # Remove write for group
chmod o=r file.txt            # Set other to read only
chmod u+x,g+rw,o-r file.txt   # Multiple changes

# Numeric mode
chmod 755 script.sh           # rwxr-xr-x
chmod 644 document.txt        # rw-r--r--
chmod 600 private.key         # rw-------
chmod 700 /root               # rwx------

# Recursive permission change
chmod -R 755 /var/www/html

# Change permissions and owner together
chmod 750 /etc/myapp
chown root:myapp /etc/myapp

**Expected output**: File permissions changed.

**Verification**:

ls -l script.sh
# Shows -rwxr-xr-x or similar
stat script.sh
# Shows detailed permission information

Step 4: Change File Ownership with chown and chgrp

**Purpose**: Change file owner and group.

**Commands**:

# Change owner
sudo chown jdoe document.txt

# Change owner and group
sudo chown jdoe:developers document.txt

# Change only group
sudo chgrp developers document.txt

# Recursive ownership change
sudo chown -R jdoe:developers /home/jdoe/project

# Change owner using UID
sudo chown 2001 document.txt

**Expected output**: File ownership changed.

**Verification**:

ls -l document.txt
# Shows new owner and group

Step 5: Set Special Permissions

**Purpose**: Configure setuid, setgid, and sticky bit for special access control.

**Commands**:

# SetUID: Run program as file owner
sudo chmod u+s /usr/bin/custom-command
sudo chmod 4755 /usr/bin/custom-command

# SetGID: Run program as group owner
sudo chmod g+s /usr/bin/shared-command
sudo chmod 2755 /usr/bin/shared-command

# SetGID on directory: New files inherit directory group
sudo chmod g+s /shared/project
sudo chmod 2775 /shared/project

# Sticky bit: Users can only delete their own files
sudo chmod +t /tmp/shared
sudo chmod 1777 /tmp/shared

# Verify special permissions
ls -ld /shared/project /tmp/shared

**Expected output**: Special permissions set on files and directories.

**Verification**:

ls -l /usr/bin/custom-command
# Shows -rwsr-xr-x (setuid)
ls -ld /shared/project
# Shows drwxrwsr-x (setgid directory)
ls -ld /tmp/shared
# Shows drwxrwxrwt (sticky bit)

Step 6: Configure Access Control Lists (ACLs)

**Purpose**: Set fine-grained permissions beyond owner/group/other.

**Commands**:

# Install ACL tools (Ubuntu/Debian)
sudo apt install acl

# Install ACL tools (RHEL/CentOS/Fedora)
sudo dnf install acl

# Set ACL for specific user
sudo setfacl -m u:jdoe:rwx /shared/project

# Set ACL for specific group
sudo setfacl -m g:developers:rx /shared/project

# Remove ACL for user
sudo setfacl -x u:jdoe /shared/project

# View ACLs
getfacl /shared/project

# Copy ACL from one file to another
getfacl file1 | setfacl --set-file=- file2

# Remove all ACLs
sudo setfacl -b /shared/project

**Expected output**: ACLs configured for specific users and groups.

**Verification**:

getfacl /shared/project
# Shows user, group, mask, other, and named user/group entries

Step 7: Configure Sudo Privileges

**Purpose**: Grant specific users administrative privileges.

**Commands**:

# Edit sudoers file safely
sudo visudo

# Add user with full sudo access
jdoe ALL=(ALL:ALL) ALL

# Add user with specific command access
jdoe ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl status nginx

# Add group with sudo access
%developers ALL=(ALL) ALL

# Allow passwordless sudo for specific command
jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

# Test sudo access
sudo -l -U jdoe

**Expected output**: Sudo privileges configured for specific users and commands.

**Verification**:

sudo -l -U jdoe
# Shows allowed commands for jdoe
sudo -u jdoe sudo /usr/bin/systemctl status nginx
# Should work if permitted

Step 8: Set Default Umask

**Purpose**: Configure default permissions for new files and directories.

**Commands**:

# View current umask
umask

# Set umask for current session
umask 022

# Set umask permanently (add to /etc/profile or ~/.bashrc)
echo "umask 022" >> ~/.bashrc

# Set system-wide umask in /etc/login.defs
sudo nano /etc/login.defs
# UMASK 022

# Set umask for PAM
sudo nano /etc/pam.d/common-session
# session optional pam_umask.so

**Expected output**: New files created with umask-adjusted permissions.

**Verification**:

umask
# Shows 0022 or similar
touch testfile
ls -l testfile
# Shows -rw-r--r-- (644) with umask 022

Configuration Examples

Sudoers Examples (`/etc/sudoers` via visudo)

# Full sudo access
admin ALL=(ALL:ALL) ALL

# Specific commands only
deploy ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx

# Passwordless sudo for monitoring
monitoring ALL=(ALL) NOPASSWD: /usr/bin/systemctl status *, /usr/bin/journalctl -u *

# Group-based sudo
%admins ALL=(ALL:ALL) ALL
%developers ALL=(ALL) NOPASSWD: /usr/bin/git pull, /usr/bin/systemctl restart app

# Run as specific user
jdoe ALL=(www-data) /usr/bin/systemctl restart nginx

Default ACLs on Directory

# Set default ACL so new files inherit permissions
sudo setfacl -d -m u:jdoe:rwx /shared/project
sudo setfacl -d -m g:developers:rx /shared/project
sudo setfacl -d -m o::--- /shared/project

# Verify default ACLs
getfacl /shared/project
# Shows default entries prefixed with "default:"

Umask Examples

umask 022     # Files: 644, Directories: 755 (standard)
umask 027     # Files: 640, Directories: 750 (more restrictive)
umask 002     # Files: 664, Directories: 775 (group collaborative)
umask 077     # Files: 600, Directories: 700 (private)

Verification

Permission Verification Commands

ls -l filename              -- Basic permissions
ls -ld directory            -- Directory permissions
stat filename               -- Detailed file information
getfacl filename            -- ACL information
id username                 -- User and group info
groups username             -- User's groups
getent group groupname      -- Group members
sudo -l -U username         -- User's sudo privileges
namei -l /path/to/file      -- Permission check along path

Expected Output

-rw-r--r-- 1 jdoe developers 4096 Jan  1 12:00 document.txt
drwxrwsr-x 2 root developers 4096 Jan  1 12:00 /shared/project
# File: document.txt with owner jdoe, group developers, permissions rw-r--r--
# Directory: /shared/project with setgid bit, owner root, group developers

Troubleshooting

| Symptom | Possible Cause | Diagnostic Command | Corrective Action | Verification | |---------|---------------|-------------------|-------------------|--------------| | Permission denied | Insufficient file permissions | `ls -l file` | Add read/write/execute permission | Access succeeds | | Cannot enter directory | Missing execute on directory | `ls -ld dir` | Add execute permission on directory | cd succeeds | | Cannot delete file | Sticky bit or no write on directory | `ls -ld dir` | Add write permission on directory | File deleted | | sudo command not allowed | Not in sudoers | `sudo -l -U user` | Add user to sudoers via visudo | sudo works | | New files have wrong permissions | Umask too permissive | `umask` | Set appropriate umask | New files have correct permissions | | ACL not working | Filesystem doesn't support ACLs | `mount | grep acl` | Remount with acl option | ACLs work | | User cannot access group file | User not in group | `groups user` | Add user to group with usermod -aG | User can access | | Setuid not working | Filesystem mounted nosuid | `mount | grep nosuid` | Remount without nosuid | Setuid works |

Best Practices

1. **Principle of least privilege**: Grant only the minimum permissions needed. 2. **Use groups for access control**: Assign users to groups; set group permissions on resources. 3. **Use sudo instead of root**: Log in as regular user; use sudo for administrative tasks. 4. **Use visudo for sudoers**: Prevents syntax errors that can lock out all admin access. 5. **Set restrictive umask**: 027 or 077 for sensitive environments. 6. **Use ACLs sparingly**: Complex ACLs are harder to audit; use groups when possible. 7. **Audit permissions regularly**: Review file and directory permissions periodically. 8. **Remove unused accounts**: Disable or delete accounts for departed employees. 9. **Use strong passwords**: Enforce password complexity and rotation. 10. **Document permission scheme**: Record group memberships, sudo rules, and ACLs.

Conclusion

Linux user and permission management provides the foundation for system security. By understanding users, groups, file permissions, special permissions, ACLs, and sudo, administrators can implement the principle of least privilege and ensure users access only what they need. Regular auditing, group-based access control, and careful sudo configuration maintain a secure and manageable Linux environment.

References

• Linux Filesystem Hierarchy Standard (https://refspecs.linuxfoundation.org/FHS/)
• chmod, chown, chgrp man pages
• sudoers man page (sudoers(5))
• ACL Documentation (https://www.nongnu.org/acl/)
• Red Hat User and Group Management (https://access.redhat.com/documentation/)
• Ubuntu Users and Groups (https://ubuntu.com/server/docs/user-management)