Skip to content
Laviyx Learn

Try

Linux and Bash course menu

Linux Users, Groups and sudo Explained

Understand root and normal users, run commands with sudo, create users and groups with adduser and usermod, read /etc/passwd, and switch users with su.

Intermediate6 min readUpdated
On this page

Linux separates what each person and service can do. A mistake by a normal user usually harms only their own files, and a compromised web server cannot read everyone's data.

Who am I?#

Terminal
whoami
id
Output
asha
uid=1002(asha) gid=1002(asha) groups=1002(asha)

Every user has a number (UID) and belongs to one or more groups.

root and sudo#

root is the administrator, with UID 0. It can do anything. Rather than logging in as root, you run single commands with sudo:

Terminal
cat /etc/shadow | head -n 1
sudo head -n 1 /etc/shadow | cut -d: -f1
Output
cat: /etc/shadow: Permission denied
root

sudo runs one command as root, after asking for your password. It keeps a log, and it lets you act as root only when you need to.

To open a root shell for several commands, use sudo -i, and type exit to leave.

Where users are stored#

/etc/passwd lists accounts, and it can be read by anyone. Passwords are stored as hashes in /etc/shadow, which only root can read.

Terminal
grep -E '^(root|asha):' /etc/passwd
Output
root:x:0:0:root:/root:/bin/bash
asha:x:1002:1002::/home/asha:/bin/bash

The fields, separated by colons, are the name, a placeholder for the password, UID, GID, a comment, the home folder and the shell.

Create a user#

On Ubuntu, adduser is the friendly command. Normally it asks for a password:

Terminal
sudo adduser ravi

Here we skip the questions, which is how you would do it in a script:

Terminal
sudo adduser --disabled-password --gecos "" ravi > /dev/null
id ravi
ls -d /home/ravi
Output
uid=1003(ravi) gid=1003(ravi) groups=1003(ravi),100(users)
/home/ravi

Set or change a password with sudo passwd ravi. Your own password is changed with passwd.

Groups#

Groups give several users the same access. A common use is a shared project folder:

Terminal
sudo groupadd developers
sudo usermod -aG developers ravi
sudo usermod -aG developers asha
getent group developers
Output
developers:x:1004:ravi,asha

-aG means append to the group.

A new group takes effect at the next login. This shared folder uses setgid, so that new files belong to the group:

Terminal
sudo mkdir /srv/shared
sudo chown root:developers /srv/shared
sudo chmod 2775 /srv/shared
ls -ld /srv/shared
sudo -u ravi touch /srv/shared/from-ravi.txt
ls -l /srv/shared
Output
drwxrwsr-x 2 root developers 4096 Nov  5 06:26 /srv/shared
total 0
-rw-rw-r-- 1 ravi developers 0 Nov  5 06:26 from-ravi.txt

sudo -u ravi runs a command as ravi. Note the s in the group's permissions, and that the new file belongs to the developers group.

Give someone sudo rights#

On Ubuntu, members of the sudo group can use it:

Terminal
sudo usermod -aG sudo ravi

To change the rules, use sudo visudo, which checks the syntax before saving. A broken sudoers file can lock everyone out.

Switch users#

Terminal
su - ravi      # needs ravi's password
sudo -i        # root shell, using your password

Remove a user#

--remove-home also deletes the home folder:

Terminal
sudo deluser --remove-home ravi 2> /dev/null | tail -n 1
sudo rm -rf /srv/shared
sudo delgroup developers | tail -n 1
Output
info: Removing user `ravi' ...
info: Removing group `developers' ...

Who is logged in?#

CommandShows
whoUsers logged in now
wUsers and what they are doing
lastRecent logins

Common mistakes#

Practice#

Practice exercise

Print the login shell of the root user from /etc/passwd, then count the accounts that have /bin/bash as their shell.

Show hint

The shell is the seventh colon-separated field.

Show solution
Terminal
grep '^root:' /etc/passwd | cut -d: -f7
awk -F: '$7 == "/bin/bash"' /etc/passwd | wc -l
Output
/bin/bash
5

Key takeaway#

Next: Environment Variables and PATH.

Finished this lesson?

Related lessons

Linux and BashLinux File Permissions Explained: chmod and chownRead rwx permissions, change them with chmod using letters and numbers like 755 and 644, change owners with chown, understand umask, and fix Permission denied errors.Intermediate7 min readLinux and BashSSH Tutorial: Log In to Linux Servers and Copy FilesConnect to servers with SSH, set up key-based login, use the SSH config file, copy files with scp and rsync, and harden a server by disabling password login.Intermediate5 min readLinux and Bashsystemd and systemctl Tutorial: Manage Linux Services and LogsStart, stop and enable services with systemctl, read logs with journalctl, and write your own systemd service file so that an app runs at boot and restarts on failure.Intermediate6 min read