Photo by KeepCoding on Unsplash
Managing who can do what on a Linux system is the backbone of security, collaboration, and automation.
This guide explains how to create users and groups, set file ownership and permissions, use ACLs for fine‑grained control, and configure sudo so that privileged actions stay auditable and safe.
Goal: After reading this article you will be able to:
* Add, delete, and modify user accounts safely.
* Organise users into groups that reflect real‑world roles.
* Apply the correct file ownership and mode bits for everyday files and directories.
* Use Access Control Lists (ACLs) when standard Unix permissions aren’t enough.
* Grant temporary root access with sudo while keeping a complete audit trail.
1. Understanding the Linux Permission Model
| Element | Symbol | Meaning |
|---|---|---|
User (u) |
Owner of the file | Can be the creator or an explicit owner set with chown. |
Group (g) |
Members of the file’s group | Group membership is defined in /etc/group and can be changed with usermod -aG. |
Others (o) |
Everyone else | Anyone not matched by user or group. |
Permissions are expressed as three trinary digits (rwx) per class, either numerically (e.g., 755) or symbolically (u+r,g-w,o=x).
The permission bits are:
r– readw– writex– execute / traverse
Key rule: If a directory has the execute bit set, users can enter it; without it they cannot list or access its contents.
2. Creating and Managing Users
2.1 Add a new user
sudo adduser alice # interactive prompt for password & details
# or
sudo useradd -m -s /bin/bash bob # minimal non‑interactive creation
-mcreates the home directory.-ssets the login shell.
2.2 Delete a user
sudo deluser --remove-home alice
--remove-home removes the user’s home and mail spool, preventing orphaned files.
2.3 Changing passwords securely
Use passwd:
sudo passwd bob
The system will enforce password complexity according to /etc/pam.d/common-password.
3. Groups – The Building Blocks of Collaboration
3.1 Create a group
sudo groupadd developers
3.2 Add users to groups
sudo usermod -aG developers alice
sudo usermod -aG developers bob
-aG appends the user to the group without removing existing memberships.
3.3 Verify group membership
groups alice # shows all groups Alice belongs to
id alice # shows UID, GID and supplementary groups
4. File Ownership & Mode Bits
4.1 Changing ownership
sudo chown alice:developers /srv/project/
# Recursively:
sudo chown -R alice:developers /srv/project/
chown changes both user and group; separate with :.
4.2 Setting file permissions
chmod 755 /usr/local/bin/script.sh # executable for all, owner can write
chmod 644 /etc/hosts # readable by everyone, writable only by root
Symbolic mode example
chmod u=rwx,g=rx,o=rx /srv/project/
4.3 The sticky bit – protecting shared directories
The sticky bit (t) prevents users from deleting files they don’t own in a directory.
sudo chmod +t /tmp
# Now only the file owner, root, or directory owner can delete files.
5. Access Control Lists (ACLs) – When Standard Bits Fall Short
Standard Unix permissions are binary per class; ACLs allow multiple users/groups to have distinct rights on a single object.
5.1 Enable ACL support (most modern file systems do by default)
Check if the filesystem is mounted with acl:
mount | grep acl
If missing, add acl to /etc/fstab and remount.
5.2 Set an ACL
Give group developers write access to a directory:
sudo setfacl -m g:developers:rwx /srv/project/
Add default ACLs so new files inherit permissions:
sudo setfacl -d -m g:developers:rwx /srv/project/
5.3 View ACLs
getfacl /srv/project/
Output shows owner, group, others, and any specific entries.
5.4 Removing an ACL entry
sudo setfacl -x g:developers /srv/project/
# Remove all default ACLs:
sudo setfacl -b /srv/project/
6. Sudo – Controlled Root Access
Sudo allows privileged commands without sharing the root password, while logging every action.
6.1 Install sudo (if not present)
sudo apt-get install sudo # Debian/Ubuntu
# or
sudo yum install sudo # RHEL/CentOS
6.2 Add a user to the sudo group
sudo usermod -aG sudo alice
On many distros, members of sudo (or wheel) can run any command.
6.3 Configure fine‑grained rules
Edit /etc/sudoers with visudo to avoid syntax errors:
# Allow Alice to restart web services without a password
alice ALL=(root) NOPASSWD: /usr/bin/systemctl restart apache2
Use wildcards and command lists judiciously. Always test changes before committing.
6.4 Audit sudo logs
All sudo activity goes to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS). Search with:
sudo grep 'COMMAND=' /var/log/auth.log | less
7. PAM – The Pluggable Authentication Framework
While not directly a permission tool, PAM controls how users authenticate and can enforce policies such as password complexity or account locking.
7.1 Common PAM modules for user management
| Module | Purpose |
|---|---|
pam_unix.so |
Standard Unix authentication |
pam_pwquality.so |
Enforces password strength |
pam_tally2.so |
Locks accounts after failed attempts |
Configure them in /etc/pam.d/common-auth (Debian) or /etc/pam.d/system-auth (RHEL).
Tip: Use
pam_cracklib.soorpam_pwquality.soto set minimum length, dictionary checks, and password history.
8. Practical Scenarios & Troubleshooting
8.1 Scenario: Multiple developers need read/write access to a shared repo but should not touch system files
sudo groupadd devteam
sudo usermod -aG devteam alice bob
sudo mkdir /srv/devrepo
sudo chown root:devteam /srv/devrepo
sudo chmod 2775 /srv/devrepo # setgid + rwx for owner/group, others r-x
setgid (2) ensures new files inherit the group.
8.2 Scenario: A user can’t delete a file in /tmp
Check sticky bit:
ls -ld /tmp
# drwxrwxrwt
If missing, set it:
sudo chmod +t /tmp
8.3 Common permission error – “Permission denied” when executing a script
- Verify the file has execute bit for the user or group.
- Confirm the directory traversal rights (
xon all parent directories). - Check ACLs that might override defaults.
getfacl /path/to/script.sh
8.4 Locked out after too many failed logins
If pam_tally2.so is enabled, reset the counter:
sudo pam_tally2 -u alice -r # reset for user Alice
# or globally:
sudo pam_tally2 -a # list all counters
9. Security Best Practices
| Practice | Why it matters |
|---|---|
| Least privilege – Grant only the permissions a user needs. | Limits damage if an account is compromised. |
| Use groups over individual rights | Simplifies management and auditing. |
| Enable ACLs sparingly | Over‑use can create confusion; document ACL changes. |
| Audit sudo usage regularly | Detect anomalous privileged commands early. |
| Keep PAM modules up to date | Benefit from latest security fixes. |
| Use strong, unique passwords or SSH keys | Prevent brute force attacks. |
10. Conclusion
Linux user management and permissions form a layered approach:
- Accounts & groups – Who is on the system.
- Ownership & mode bits – Basic file access control.
- ACLs – Fine‑grained overrides when needed.
- Sudo & PAM – Controlled privilege escalation and authentication policies.
By mastering these tools, you can build secure, maintainable systems that reflect real organizational roles while protecting against accidental or malicious misuse.
Frequently Asked Questions (FAQ)
What is the difference between adduser and useradd?
adduser is a higher‑level, interactive script that creates a home directory, sets up default files, and prompts for user details.
useradd is a lower‑level command; you must supply options like -m to create the home directory and -s to specify the shell.
How do I give a group write access to a directory without changing its ownership?
Use Access Control Lists (ACLs).
sudo setfacl -m g:developers:rwx /srv/project/
This grants the developers group write permission while keeping the existing owner unchanged.
Why is the sticky bit important for /tmp and similar directories?
The sticky bit (t) prevents users from deleting or renaming files they do not own in a shared directory.
Setting it on /tmp ensures that only file owners, root, or the directory owner can remove files there.
How can I verify which groups a user belongs to after adding them?
Run either groups username or id username.
Both commands list all primary and supplementary group memberships for the specified user.
