Users, groups and permissions

Users and groups

Linux is a multi-user system. Each person and each service runs as a user. A user has a name and a number called the UID. root (UID 0) is the all-powerful administrator. Services such as nginx or postgres usually run as their own users, so a bug in one cannot easily damage the others.

A group is a named set of users. Groups make sharing easy: put everyone who deploys into a deploy group, and give that group access to the release folder. Users are listed in /etc/passwd and groups in /etc/group. Password hashes are kept separately in /etc/shadow, which only root can read.

asha:x:1001:1001:Asha Rao:/home/asha:/bin/bash
name:password placeholder:UID:GID:comment:home folder:login shell

id                              # my UID, main group and all groups
id asha                         # the same for another user
sudo useradd -m -s /bin/bash asha   # create user asha with a home folder and bash
sudo passwd asha                # set her password
sudo usermod -aG docker asha    # ADD asha to the docker group
groups asha                     # list her groups

Reading permissions

-rwxr-xr-x 1 deploy deploy 2048 Oct 19 10:00 deploy.sh
drwxr-x--- 2 deploy www    4096 Oct 19 10:00 releases

After the first character come three sets of three letters: for the owner (user, u), the group (g) and others (o, everyone else). r means read, w means write and x means execute. On a directory, r lets you list it, w lets you create and delete files in it, and x lets you enter it with cd. A dash means the permission is missing.

Octal numbers

Each letter has a value: r = 4, w = 2, x = 1. Add them for each set to get one digit. rwx = 4 + 2 + 1 = 7. r-x = 4 + 0 + 1 = 5. rw- = 6. r-- = 4. So rwxr-xr-x is 755, and rw-r--r-- is 644.

chmod and chown

chmod 755 deploy.sh            # set exact permissions with octal
chmod u+x deploy.sh            # add execute for the owner only
chmod g-w,o-r report.txt       # remove group write and others read
chmod -R 750 /opt/shop         # apply to a folder and everything inside
sudo chown deploy:www releases # change owner to deploy and group to www
sudo chown -R deploy:deploy /opt/shop

umask sets which permissions new files do NOT get. The common default 022 removes write for group and others, so new files are 644 and new folders 755.

root, sudo and least privilege

sudo runs one command as root, after checking that your user is allowed (usually by membership of the sudo group on Ubuntu or the wheel group on RHEL). Working as root all the time is dangerous: one typo can delete the system, and any program you run has full power.

Least privilege means every user and service gets only the access it needs, and nothing more. The web server can read the website files but not change them. The deploy user can write to /opt/shop but cannot read the database password file. If one part is hacked, the damage stays small.

SSH key permissions

SSH refuses to use keys that others can read. Your ~/.ssh folder should be 700, your private key (for example ~/.ssh/id_ed25519) 600, and ~/.ssh/authorized_keys on the server 600. The public key (.pub) can be 644.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519 ~/.ssh/authorized_keys