User Accounts

Chapter 12 — Users, Permissions & Security

Linux was designed from the start as a multi-user system — multiple people can use the same machine, each with their own files, settings, and level of access. The permission system that makes this work also provides a strong security model: programs and users can only touch what they're explicitly allowed to. This chapter explains how users and groups work, how to read and change file permissions, and how to set up a basic firewall for a desktop machine.

1. Users and the Root Account

Every person who uses a Linux system has a user account with a unique username and a numeric UID (User ID). The system uses UIDs internally; usernames are just the human-readable label.

There is one special account: root (UID 0). Root has unrestricted access to everything on the system — it can read, write, and delete any file, kill any process, and change any setting. On desktop Linux, you are never logged in as root directly; instead you use sudo to temporarily borrow root's powers for a single command.

# See your own username and UID $ id uid=1000(philip) gid=1000(philip) groups=1000(philip),4(adm),27(sudo),1000(philip) # See all user accounts on the system $ cat /etc/passwd | grep -v nologin | grep -v false root:x:0:0:root:/root:/bin/bash philip:x:1000:1000:Philip:/home/philip:/bin/bash # Check which groups your account belongs to $ groups philip adm cdrom sudo dip plugdev lpadmin

System accounts vs user accounts. /etc/passwd contains many accounts with /usr/sbin/nologin as their shell — these are service accounts (www-data for Apache, mysql for MySQL, etc.) that can't log in interactively. They exist so that services run under a restricted identity, not as root. Filtering them out with grep -v nologin shows only the real people accounts.

Managing users from the terminal

# Create a new user (interactive — sets password and details) $ sudo adduser sarah # Delete a user (keeps their home directory) $ sudo deluser sarah # Delete a user AND their home directory $ sudo deluser --remove-home sarah # Change a user's password $ sudo passwd sarah # Change your own password $ passwd # Lock an account (prevents login without deleting it) $ sudo passwd -l sarah # Unlock it again $ sudo passwd -u sarah

2. Groups

A group is a collection of users that share access to certain resources. Every file has both an owner (a user) and an owning group. Groups let you grant access to multiple users at once without making files world-readable.

When you install Linux and create your account, a group with the same name as your username is created automatically (your primary group). You also get added to several system groups that grant specific permissions:

sudo (Ubuntu/Debian) / wheel (Fedora/Red Hat) — allows use of sudo to run admin commands
adm — read access to system log files in /var/log
cdrom — access to optical disc drives
plugdev — access to removable storage devices (USB sticks)
lpadmin — manage printers
docker — run Docker containers without sudo (added when you install Docker)

# Add a user to a group $ sudo usermod -aG groupname username # The -a means "append" — without it, the user is REMOVED from all other groups! # Examples: $ sudo usermod -aG sudo sarah # Give sarah admin access (Ubuntu) $ sudo usermod -aG wheel sarah # Give sarah admin access (Fedora) $ sudo usermod -aG docker philip # Let philip run Docker # Create a new group $ sudo groupadd developers # View all groups and their members $ cat /etc/group | grep developers

Group membership takes effect at next login. If you add yourself to a group, you need to log out and back in (or run newgrp groupname in the terminal) before the new group permissions apply. Running groups after usermod won't show the new group until you log out.

3. Understanding File Permissions

Every file and directory in Linux has a set of permissions that controls who can read it, write to it, and execute it. You can see these by running ls -l:

$ ls -l ~/Documents -rw-r--r-- 1 philip philip 4096 Jun 15 10:23 report.txt drwxr-xr-x 2 philip philip 4096 Jun 14 09:00 Projects -rwxr-xr-x 1 philip philip 512 Jun 13 14:11 backup.sh

The first column is the permission string. Let's break it down:

- | rw- | r-- | r--

Owner (user)

rw-

Can read and write. Cannot execute.

Group

r--

Members of the owning group can only read.

Others (everyone else)

r--

All other users can only read.

What r, w, and x mean

r (read, value 4) — on a file: can view the contents. On a directory: can list what's inside (ls).
w (write, value 2) — on a file: can modify or delete the contents. On a directory: can create, rename, or delete files inside it.
x (execute, value 1) — on a file: can run it as a program or script. On a directory: can enter it (cd) and access its contents.
- (dash) — permission is not granted.

The first character — file type

- — regular file
d — directory
l — symbolic link (a shortcut to another file or directory)
b / c — block or character device (disks, terminals)

Numeric (octal) permissions

Permissions are often written as three digits — each digit is the sum of r(4), w(2), x(1) for owner, group, and others respectively:

644 — rw-r--r-- — standard file (owner writes, everyone reads)
755 — rwxr-xr-x — standard directory or executable (owner full, others read+execute)
700 — rwx------ — private to owner only
600 — rw------- — private file (SSH keys use this)
777 — rwxrwxrwx — everyone can do anything (avoid this)

4. chmod — Changing Permissions

chmod (change mode) sets file and directory permissions. You can use numeric notation or symbolic notation.

# Numeric notation — set exact permissions $ chmod 644 report.txt # rw-r--r-- (standard file) $ chmod 755 script.sh # rwxr-xr-x (executable script) $ chmod 700 private-dir/ # rwx------ (private directory) $ chmod 600 ~/.ssh/id_rsa # rw------- (private SSH key) # Symbolic notation — add or remove specific permissions $ chmod +x script.sh # Add execute for everyone $ chmod -x script.sh # Remove execute for everyone $ chmod u+x script.sh # Add execute for owner only (u=user/owner) $ chmod g+w shared-file.txt # Add write for group (g=group) $ chmod o-r secret.txt # Remove read from others (o=other) $ chmod a+r readme.txt # Add read for all (a=all) # Apply recursively to a directory and all its contents $ chmod -R 755 my-website/

Common numeric permissions

400Read-only for owner (e.g., licence files)

600Private file — owner read/write (SSH keys)

644Normal file — owner writes, group/others read

700Private directory or script

755Standard directory or executable

775Shared directory — owner and group write

Symbolic notation reference

uuser (owner)

ggroup

oothers

aall (u + g + o)

+add permission

-remove permission

=set exact permission

5. chown — Changing Ownership

chown (change owner) changes who owns a file or directory. Only root (via sudo) can change file ownership.

# Change owner of a file $ sudo chown philip report.txt # Change owner AND group together (owner:group) $ sudo chown philip:developers report.txt # Change only the group (note the leading colon) $ sudo chown :developers shared-folder/ # Change ownership recursively $ sudo chown -R philip:philip ~/Projects/ # A common use case: fixing ownership after copying files as root $ sudo chown -R $USER:$USER ~/Downloads/extracted-archive/

When do you need chown? The most common scenario is when files have been created or copied by root (e.g., via sudo) and the resulting files are owned by root, making them hard to edit as a normal user. sudo chown -R $USER:$USER path/ transfers ownership back to you. The $USER variable automatically expands to your username.

6. sudo — A Bit More Detail

Chapter 11 introduced sudo. Here's a bit more of what it can do and how it's configured.

# Run a command as root $ sudo apt update # Run a command as a different user (not root) $ sudo -u www-data ls /var/www/html # Open an interactive root shell (use sparingly — exit when done) $ sudo -i # Re-run the last command with sudo (when you forgot to add it) $ sudo !! # Check whether you can use sudo (and what commands) $ sudo -l # Clear the sudo password cache (forces re-entry of password) $ sudo -k

The sudoers file

sudo's configuration lives in /etc/sudoers and the directory /etc/sudoers.d/. This controls who can use sudo and what commands they're allowed to run. Always edit sudoers with visudo — it validates the syntax before saving, preventing a broken sudoers file that would lock you out.

# Edit the sudoers file safely $ sudo visudo

# Example sudoers entries: # Allow user sarah to run any command as root: sarah ALL=(ALL:ALL) ALL # Allow sarah to run apt without entering a password: sarah ALL=(ALL) NOPASSWD: /usr/bin/apt # The sudo group line (present by default on Ubuntu): %sudo ALL=(ALL:ALL) ALL

Never give NOPASSWD: ALL to a regular user account. This would let anyone who gains access to that account have unrestricted root access without needing a password — completely bypassing the security model. NOPASSWD should be restricted to specific commands only, and only when genuinely necessary.

7. UFW — The Uncomplicated Firewall

Linux uses iptables (or the newer nftables) for packet filtering, but configuring them directly is complex. UFW (Uncomplicated Firewall) is a front-end that makes firewall management straightforward. It's pre-installed on Ubuntu and available on most Debian-based distros.

Do you need a firewall on a desktop? On a home desktop behind a router (which acts as a NAT firewall), the risk is lower — incoming connections from outside your home network are blocked by the router. UFW is still worthwhile as a second layer of defence, and is strongly recommended on any laptop that connects to public WiFi or any machine acting as a server.

Setting up UFW

# Check if UFW is installed $ sudo ufw status Status: inactive # Set default policies: block all incoming, allow all outgoing $ sudo ufw default deny incoming $ sudo ufw default allow outgoing # Allow specific services (before enabling — don't lock yourself out) $ sudo ufw allow ssh # Allow SSH (port 22) — important if remote # Enable the firewall $ sudo ufw enable Command may disrupt existing ssh connections. Proceed with operation (y|n)? y Firewall is active and enabled on system startup

Common UFW rules

# Allow by service name (UFW knows common services) $ sudo ufw allow ssh # port 22 $ sudo ufw allow http # port 80 $ sudo ufw allow https # port 443 # Allow by port number $ sudo ufw allow 8080 $ sudo ufw allow 5432 # PostgreSQL # Allow from a specific IP address only $ sudo ufw allow from 192.168.1.10 # Allow from a specific IP to a specific port $ sudo ufw allow from 192.168.1.0/24 to any port 22 # Deny a specific port $ sudo ufw deny 23 # Block telnet # Delete a rule $ sudo ufw delete allow 8080 # Check all current rules $ sudo ufw status verbose

After enabling with the defaults above, here's what the status looks like for a basic desktop that only allows SSH:

Status: active

ToActionFrom

22/tcpALLOW INAnywhere

22/tcp (v6)ALLOW INAnywhere (v6)

Enable UFW before connecting remotely. If you're configuring a remote machine over SSH, add the SSH allow rule before enabling UFW. If you enable UFW without allowing SSH first, you'll be locked out immediately and will need physical access to the machine to recover.

UFW on Fedora

Fedora uses firewalld instead of UFW. The graphical tool is firewall-config; the command-line tool is firewall-cmd. The concepts are the same — default zones, allowing services by name — but the syntax differs:

# Fedora — allow a service permanently $ sudo firewall-cmd --permanent --add-service=http $ sudo firewall-cmd --reload # Check current rules $ sudo firewall-cmd --list-all

8. Good Security Habits for Desktop Linux

Keep the system updated

Most real-world attacks exploit known vulnerabilities that have already been patched. Running sudo apt update && sudo apt upgrade weekly keeps security patches applied. Don't ignore update notifications.

Use strong, unique passwords

Your login password protects your sudo access. Use a password manager (Bitwarden, KeePassXC) to generate and store strong passwords. Avoid reusing passwords across accounts.

Don't use root for daily work

Never log in as root or stay in a root shell longer than necessary. The permission system only protects you if you're operating as a normal user. A mistake as root can destroy the system; as a normal user, the damage is limited to your own files.

Be careful with sudo commands from the internet

Before running a sudo command you found online, understand what it does. sudo rm -rf /, sudo chmod -R 777 /, and curl url | sudo bash are examples that have caused real data loss for people who ran them without checking.

Lock your screen

Set your screen to lock automatically after a few minutes of inactivity (Settings → Privacy → Screen Lock on Ubuntu). Physical access to an unlocked machine bypasses all file permissions.

Enable full-disk encryption

On laptops, LUKS encryption (set up during installation as covered in Chapter 5) protects all your data if the machine is stolen. Without it, anyone with physical access can read your files by booting from a live USB.

Only install software from trusted sources

Stick to your distro's official repositories, Flatpak (Flathub), and well-known developer websites. Random scripts from forums, unverified PPAs, and pirated software are the most common vectors for malware on Linux.

Check file permissions on sensitive files

SSH private keys should be 600 (owner read-only). Configuration files with passwords should not be world-readable. Run ls -la in sensitive directories occasionally to check nothing has been accidentally made too permissive.

Chapter Summary

Topic	Key commands and concepts
Users	`sudo adduser name` — create. `sudo deluser name` — delete. `sudo passwd name` — change password. `id` — see your own UID and groups.
Groups	`sudo usermod -aG groupname user` — add user to group (always use `-a`). `groups` — see your current groups. Takes effect at next login.
Permissions	Three sets (owner / group / others) × three bits (r=4, w=2, x=1). `ls -l` shows permissions. Common values: 644 (file), 755 (dir/exec), 600 (private), 700 (private dir).
chmod	`chmod 644 file` (numeric) or `chmod u+x file` (symbolic). `chmod -R` applies recursively to directories.
chown	`sudo chown user:group file` — change owner and group. `sudo chown -R $USER:$USER path/` — reclaim ownership of a directory tree.
sudo	Temporary root access for one command. Configure with `sudo visudo` (never edit sudoers directly). `sudo -l` shows what you're permitted to run.
UFW firewall	`sudo ufw default deny incoming` → `sudo ufw allow ssh` → `sudo ufw enable`. Check rules with `sudo ufw status verbose`. Fedora uses firewalld instead.

Next: Chapter 13 — Keeping Linux healthy. The final chapter covers running updates, monitoring disk space, reading log files, and simple backup strategies to keep your system running reliably long-term.