Skip to content

Beginner · Permissions, users and sudo · topic 7 of 57 · 30 min

Users, groups and the files behind them

Explanation

Every process runs as a user, and every user has a number called a UID. Users are listed in /etc/passwd, their password hashes in /etc/shadow, and groups in /etc/group. root has UID 0; system services use low UIDs; people get UIDs from 1000 up on RHEL.

Why users exist

A server is shared by many people and many programs. Users keep them apart: the web server should not read the database files, and an intern should not be able to delete the payroll data. Linux decides what is allowed by checking which user and group a process runs as.

Three kinds of user

KindUID on RHEL 9Example
Superuser0root: can do anything
System users1 to 999apache, sshd, chrony: run services, usually cannot log in
Regular users1000 and upasha, ravi: people

The name is for humans; the kernel only uses the number. If two names had the same UID, Linux would treat them as one user. The ranges come from UID_MIN and UID_MAX in /etc/login.defs.

/etc/passwd: the user list

output
asha:x:1000:1000:Asha Rao:/home/asha:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
Seven fields separated by colons.
  1. username (asha)
  2. password field: x means "the hash is in /etc/shadow"
  3. UID (1000)
  4. GID of the primary group (1000)
  5. GECOS: a comment, usually the full name
  6. home directory (/home/asha)
  7. login shell (/bin/bash). /sbin/nologin stops interactive logins, which is right for service accounts.

Everyone can read /etc/passwd, because many programs need to turn UIDs into names. That is exactly why the password hashes were moved out of it.

/etc/shadow: password hashes and ageing

output
asha:$6$Jx2...long-hash...:20015:0:90:7:::
Only root can read /etc/shadow.

The fields are: name, password hash, the day the password was last changed (counted in days since 1 January 1970), minimum days between changes, maximum days before a change is forced, warning days, inactive days, account expiry date, and a reserved field. A hash starting with $6$ is SHA-512. A ! or * in the hash field means the password is locked or unset, so password login is not possible.

Groups: /etc/group

output
wheel:x:10:asha,ravi
developers:x:1005:asha,meena
name : password (unused) : GID : comma-separated member list

Each user has one primary group (the GID in /etc/passwd). New files get that group. A user can also be in supplementary (extra) groups, listed in /etc/group. On RHEL each new user gets a private group with the same name, so asha's primary group is asha.

bash
$ id asha
uid=1000(asha) gid=1000(asha) groups=1000(asha),10(wheel),1005(developers)
$ getent passwd asha
asha:x:1000:1000:Asha Rao:/home/asha:/bin/bash
$ groups ravi
ravi : ravi wheel
getent also finds users from central directories (LDAP, IdM), not only local files.

Common mistakes

  • Editing /etc/passwd or /etc/shadow by hand with a normal editor. One wrong colon can lock everyone out. Use useradd/usermod, or vipw and vigr, which lock the file and check it.
  • Thinking a group change works at once: group membership is read at login. The user must log out and in (or run newgrp) to get a new group.
  • Giving a service account a real shell. Services should have /sbin/nologin.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Users, groups and the files behind them · 1/6

User + group → allowed or not

Every process runs as a user. Linux checks the user and group before allowing anything.

Prefer a video by a teacher? Find free videos on “linux /etc/passwd /etc/shadow /etc/group explained” on YouTube ↗

In real life: An audit at a cooperative bank

An IT auditor at a cooperative bank in Gujarat asks: "Which accounts on this server have UID 0, and which human accounts can log in?" The admin answers in two lines: an awk command over /etc/passwd shows that only root has UID 0, and another lists the users with UID 1000 or more and a real shell. The auditor marks the check as passed.

bash
$ awk -F: '$3 == 0 {print $1}' /etc/passwd
root
$ awk -F: '$3 >= 1000 && $7 !~ /nologin/ {print $1, $7}' /etc/passwd
asha /bin/bash
ravi /bin/bash

Practice (0/3 done)

Task 1 · Question

In /etc/passwd, what does the x in the second field mean?

Task 2 · Code · Python

Write parse_passwd(line) that turns one /etc/passwd line into a dict with the keys name, uid, gid, comment, home and shell. uid and gid must be int. Example: "asha:x:1000:1000:Asha Rao:/home/asha:/bin/bash" gives {"name": "asha", "uid": 1000, "gid": 1000, "comment": "Asha Rao", "home": "/home/asha", "shell": "/bin/bash"}.

Task 3 · Code · Python

Write login_users(passwd_text) that returns the names of human users who can log in: UID 1000 or more AND a shell that does not end in "nologin" or "false". Keep the order of the file and skip empty lines.

Quick quiz

Question 1

1.What is the UID of root?

Question 2

2.Which file can only root read?

Question 3

3.What is the 7th field of an /etc/passwd line?

Question 4

4.asha was just added to the developers group, but id in her open session does not show it. Why?

Question 5

5.Which shell should a service account like apache have?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

What is the UID of root?

Answer: 0

root is always UID 0.

Which file can only root read?

Answer: /etc/shadow

/etc/shadow holds the password hashes, so it is readable by root only.

What is the 7th field of an /etc/passwd line?

Answer: Login shell

The last field is the login shell.

asha was just added to the developers group, but id in her open session does not show it. Why?

Answer: Group membership is read at login; she must log in again

Log out and in (or use newgrp) to pick up new groups.

Which shell should a service account like apache have?

Answer: /sbin/nologin

/sbin/nologin refuses interactive logins.

You change PASS_MAX_DAYS in /etc/login.defs to 90. Who is affected?Related

Answer: Only users created after the change

login.defs gives defaults to new accounts; existing ones keep their values.

From Creating and managing users and passwords

Which file holds Linux password hashes?Related

Answer: /etc/shadow

/etc/shadow holds the hashes and is readable only by root (and the shadow group).

From Linux security basics

Which command adds user ravi to the docker group without removing his other groups?Related

Answer: sudo usermod -aG docker ravi

-a appends. Without it, -G replaces all extra groups.

From Users, groups and permissions

Why use visudo instead of vim /etc/sudoers?Related

Answer: It checks the syntax and locks the file

A broken sudoers file can lock out all admins; visudo prevents saving errors.

From sudo and the sudoers file

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: Creating and managing users and passwords →

Next steps

  1. 5 more topics in “Permissions, users and sudo” before its exam: Creating and managing users and passwords, File permissions: rwx, chmod and chown, umask and the special bits: SUID, SGID and sticky, Access control lists (ACLs), sudo and the sudoers file.
  2. Module 2 exam: Permissions, users and sudo · 14 questions · 25 min, without help. 6 topics of this module still to finish first.
  3. Then the next module, Processes, services and logs. 57 topics left in the course before the final exam.

← Previous: Editing files with vim