After ordering a server, you log in to it as the root user, which has no restrictions at all. This is convenient for the first steps, but working this way all the time is unsafe, and if several people use the server, each of them needs their own account. In this article we look at how users and groups work in Linux, how to create a user, give them administrator rights through sudo, see the list of users and remove the ones you no longer need. We tested all commands on a test server with Debian 12.
How users and groups work
Linux was designed from the very beginning as a system that many people work on at the same time, so every action in it is performed on behalf of some user. To the system, a user is above all a number, the UID. A name like ivan is there for people, while the kernel checks permissions by the number. The user with UID 0 is called root, and the kernel allows it everything, regardless of file permissions. Regular users in Debian and Ubuntu get numbers starting from 1000, and the numbers below that are taken by system accounts. Programs such as a web server or a database run under them, and you cannot log in to the server as one of them.
Information about users is stored in plain text files. For each user, /etc/passwd records the name, the UID, the number of the primary group, the home folder and the shell that starts at login. Passwords are kept separately in the /etc/shadow file. It holds not the passwords themselves but their hashes, and only root can read it. This separation appeared because /etc/passwd has to be readable by every program, while password hashes must not be shown to everyone.
Groups let you grant permissions not to each user separately but to several users at once. Suppose three developers need write access to the website folder. Instead of setting up permissions for each of them, you add them to one group and give the permissions to that group. Administrator rights in Debian and Ubuntu are granted the same way. All members of the sudo group can run commands as root if they put the word sudo in front of them and enter their own password. This is the main reason to create a separate user. You work with regular permissions and will not break the system with an accidental command, and when you really need to change something, you type sudo on purpose. In addition, the log keeps a record of who ran which command with administrator rights.
What you will need
- An SSH connection to the server as
root, for example via Termius. - A server with Debian or Ubuntu. The
adduseranddelusercommands used in this article exist only in these systems, and for other systems we give a replacement.
1. Create a user
In Debian and Ubuntu the most convenient command is adduser. It creates the home folder by itself, copies the default settings into it and asks you for a password.
adduser ivanThe command asks you to enter the password twice. The characters are not shown as you type, and that is normal. Then it offers to fill in the full name, room number and phone numbers. You can leave these fields empty by just pressing Enter, and at the end confirm the details by answering Y.
adduser created the user, the group and the home folder
If there is no adduser command
In other distributions, for example AlmaLinux or Rocky Linux, a user is created with the useradd command, and the password is set separately. The -m option creates the home folder, and -s sets the shell.
useradd -m -s /bin/bash ivan
passwd ivan2. Grant sudo rights
On our servers with Debian 12 the sudo program is not installed by default, so install it first. If the sudo command already exists on your server, you can skip this step.
apt update && apt install -y sudoNow add the user to the sudo group and check that they were added.
usermod -aG sudo ivan
id ivanIn the output of the id command, the group 27(sudo) should appear in the groups list. To make sure the rights work, switch to the new user and run any command through sudo.
su - ivan
sudo whoamisudo asks for the password of the user ivan, not the root password. If the command printed root, the user has administrator rights. You can return to root with the exit command.
The user is in the sudo group, and the command ran as root
Now you can connect to the server over SSH as the new user, for example ssh ivan@SERVER_IP. We checked that password login works right away on our Debian 12 image. You can read more about groups and how to remove a user from sudo in the article about the usermod command.
The next step for security
Once you have checked that login as the new user works, set up SSH key login for them and disable login as root. How to do this is described in the article about SSH keys.
3. See which users exist on the server
The full list of accounts is stored in /etc/passwd, but along with people it lists dozens of system users. To see only the regular ones, select the lines with a UID of 1000 or higher.
# Name, UID, home folder and shell of regular users
awk -F: '$3>=1000 && $3<65534 {print $1, $3, $6, $7}' /etc/passwd
# Who is in the sudo group
getent group sudo
There are two regular users on the server, and only ivan has sudo rights
A few more useful commands.
# Groups of the user
groups ivan
# Who is connected to the server right now
who
# History of logins to the server
last -n 104. Change a user's password
Root can set a new password for any user. A regular user changes their own password with the same command, just without a name.
# Password for the user ivan
passwd ivan
# Your own password
passwd5. Delete a user
The deluser command with the --remove-home option deletes the user together with their home folder and cron jobs.
deluser --remove-home anna
The user and their home folder are deleted
On systems without deluser, use userdel -r anna. If you only need to take administrator rights away from a user, you do not have to delete them. It is enough to remove them from the sudo group.
deluser ivan sudoSave the files you need before deleting
--remove-home permanently deletes everything in the /home/name folder. If there are projects or keys left there, copy them first.
Frequently asked questions
sudo: command not found
The sudo program is not installed. Run apt install -y sudo as root. If you are already working as a regular user, first switch to root with the su - command and enter the root password.
ivan is not in the sudoers file
The user is not in the sudo group. Add them with usermod -aG sudo ivan as root. The change takes effect after a new login, so the user needs to log out of the session and connect again.
What is the difference between su and sudo
su - name switches you completely to another user and asks for their password. sudo command runs one command as root and asks for your password. That is why working with sudo does not require telling anyone the root password, and logging in as root can be disabled altogether.
The user cannot connect over SSH
- Check that a password is set with the
passwd -S ivancommand. The second column should showP. - Check that the user has a regular shell and not
/usr/sbin/nologin. You can see it in the last field of the user's line in/etc/passwd. - If password login is disabled in the SSH settings, the user needs an SSH key.
Our resources
Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com