Users, Groups, and File Permissions

Users, Groups, and File Permissions in Linux

Data centers run Linux on the vast majority of their servers. Controlling who can read, write, or execute files is a core security responsibility for every data center technician. A misconfigured permission can expose configuration files, corrupt logs, or allow an attacker to escalate privileges. This lesson gives you the practical commands and mental model you need to manage users, groups, and permissions correctly.

User Accounts and the /etc/passwd File

Every person or service that interacts with a Linux system is represented by a user account. Accounts are stored in `/etc/passwd`, which lists each account's username, user ID (UID), group ID (GID), home directory, and default shell. Passwords themselves are stored in hashed form in `/etc/shadow`, which only root can read.

Key commands for managing users:

• `useradd username` — creates a new account. Use `-m` to create a home directory and `-s` to set the shell (e.g., `-s /bin/bash`).
• `passwd username` — sets or changes a user's password. Always set a strong password immediately after creating an account.
• `usermod -aG groupname username` — adds a user to a supplementary group without removing them from others. The `-a` (append) flag is critical; omitting it replaces all existing group memberships.
• `userdel username` — removes an account. Add `-r` to also delete the home directory and mail spool.

Groups and the /etc/group File

Groups let you grant the same access to multiple users at once. Group definitions live in `/etc/group`. Each file and directory has exactly one owning group.

• `groupadd groupname` — creates a new group.
• `id username` — displays a user's UID and all group memberships; use this to verify your work.
• `groups username` — shows group membership in plain text.

In a data center environment you might create groups like `datacenter`, `backup-ops`, or `log-readers` to match job roles, then assign directory permissions to those groups rather than to individual users. This makes access control easier to audit and maintain.

Understanding File Permissions

Every file and directory has three permission triplets: one for the owner (user), one for the owning group, and one for others (everyone else). Each triplet contains three bits:

| Symbol | Meaning for files | Meaning for directories |

|--------|------------------|------------------------|

| r (4) | read file content | list directory contents |

| w (2) | modify file | create/delete files inside |

| x (1) | execute file | enter the directory |

The command `ls -l` shows permissions as a ten-character string, for example `-rwxr-x---`. The first character is the file type (`-` for file, `d` for directory). The next nine characters are three triplets: owner, group, others.

chmod: Changing Permissions

Octal notation expresses each triplet as a single digit (sum of r=4, w=2, x=1):

• `chmod 750 /data/scripts` — owner: rwx (7), group: r-x (5), others: --- (0)
• `chmod 640 /data/configs` — owner: rw- (6), group: r-- (4), others: --- (0)

Symbolic notation uses letters and operators:

• `chmod u+x script.sh` — adds execute for the owner (u)
• `chmod g-w logfile` — removes write from the group (g)
• `chmod o= configs/` — removes all permissions from others (o)
• `chmod a+r readme.txt` — adds read for all (a = all)

Either syntax produces identical results. Octal is faster for setting all permissions at once; symbolic is clearer when you need to change just one bit.

chown: Changing Ownership

`chown owner:group filename` changes who owns a file or directory.

• `chown root:datacenter /data/logs` — sets owner to root, group to datacenter.
• `chown -R dctech1:datacenter /data/uploads` — applies recursively to all contents.

You must be root or use `sudo` to change ownership.

Special Permission Bits: SUID, SGID, and Sticky Bit

Three extra bits add special behaviors:

• SUID (Set User ID, octal 4000): When set on an executable, it runs with the file owner's privileges rather than the caller's. This is legitimate on system binaries like `passwd` but is a serious vulnerability on shell scripts or any file an attacker could modify. Never set SUID on a shell script.
• SGID (Set Group ID, octal 2000): On a directory, new files inherit the directory's group automatically — useful for shared project directories.
• Sticky bit (octal 1000): On a directory, prevents users from deleting files they do not own (standard on `/tmp`).

To add SUID: `chmod u+s filename` or include `4` as the leading octal digit: `chmod 4755 filename`. To remove it: `chmod u-s filename`.

Safety and Security Practices

Permission errors can cause outages or security breaches. Follow these rules:

• Never make `/etc/passwd` world-writable. Anyone who can write to that file can manipulate accounts, including creating a root-equivalent user.
• Audit SUID/SGID files regularly using `find / -perm /6000 -type f` and confirm each result is an expected system binary.
• Apply the principle of least privilege: grant only the access a user or group actually needs.
• Use `sudo` rather than logging in as root directly. This limits exposure and creates an audit trail.
• When working on live servers, follow your facility's change-management procedures. Incorrect permission changes on running services can cause immediate service disruption.