In the last chapter, we set up our very own Ubuntu Server installation. During the installation process, we were instructed to create a user account as an administrator of the system. So, at this point, we should have two users on our server. We have the aforementioned administrative user, as well as root. We can certainly create additional user accounts with varying levels of access (and we will do so in this chapter), but before we get to that, some discussion is in order regarding the administrator account you created, as well as the root user that was created for you.

In regard to root, the root user account exists on all Linux distributions and is the most powerful user account on the planet. The root user account can be used to do anything, and I do mean anything. Want to use root to create files and directories virtually anywhere on the filesystem...

Creating users in Ubuntu can be done with one of either of two commands: adduser and useradd. This can be a little confusing at first, because both of these commands do the same thing (in different ways) and are named very similarly. I'll go over the useradd command first and then I'll explain how adduser differs. You may even prefer the latter, but we'll get to that in a moment.

First, here's an example of the useradd command in action:

sudo useradd -d /home/jdoe -m jdoe

Now that we know how to create (and delete) user accounts on our server, we are well on our way to being able to manage our users. But where exactly is this information stored? We know that users store their personal files in /home, but is there some kind of database somewhere that keeps track of which user accounts are on our system? Actually, user account information is stored in two special text files:

• /etc/passwd
• /etc/shadow

You can display the contents of each of those two files with the following commands. Take note that any user can look at the contents of /etc/passwd, while only root has access to /etc/shadow:

cat /etc/passwd 
sudo cat /etc/shadow

Go ahead and take a look at these two files (just don't make any changes), and I will help you understand them. First, let's go over the /etc/passwd file. What follows...

In a typical organization, there are usually some defaults that are recommended for users in terms of files and configuration. For example, in a company that performs software development, there are likely recommended settings for text editors and version control systems. Files that are contained within /etc/skel are copied into the home directory for all new users when you create them (assuming you've chosen to create a home directory while setting up the user).

In fact, you can see this for yourself right now. If you execute the following command, you can view the contents of the /etc/skel directory:

ls -la /etc/skel 

You probably already know how to list files within a directory, but I specifically called out the -a parameter because the files included in /etc/skel by default are hidden (their...

Now that we have several users on our system, we need to know how to switch between them. Of course, you can always just log in to the server as one of the users, but you can actually switch to any user account at any time providing you either know that user's password or have sudo access.

The command you will use to switch from one user to another is the su command. If you enter su with no options, it will assume that you want to switch to root and will ask you for your root password. As I mentioned earlier, Ubuntu locks out the root account by default, so you really don't have a root password. Unlocking the root account is actually really simple; all you have to do is create a root password. To do that, you can execute the following command as any user with sudo access:

sudo passwd 

The command will ask you to create and confirm your root password....

Now that we understand how to create, manage, and switch between user accounts, we'll need to understand how to manage groups as well. The concept of groups in Linux is not very different from other platforms and pretty much serves the exact same purpose. With groups, you can more efficiently control a user's access to resources on your server. By assigning a group to a resource (a file, directory, and so on), you can allow and disallow access to users by simply adding them or removing them from the group.

The way this works in Linux is that every file or directory has both a user and a group that takes ownership of it. This is contrary to platforms such as Windows, which can have multiple groups assigned to a single resource. With Linux, it's just a one-to-one ownership: just one user and just one group assigned to each file or directory. If you...

In this chapter, we've already covered a bit of password management, since I've given you a few examples of the passwd command. If you recall, the passwd command allows us to change the password of the currently logged-in user. In addition, using passwd as root (and supplying a user name) allows us to change the password for any user account on our system. But that's not all this command can do.

One thing I've neglected to mention regarding the passwd command is the fact that you can use it to lock and unlock a user's account. There are many reasons why you may want to do this. For instance, if a user is going on vacation or extended leave, perhaps you'd want to lock their account so that it cannot be used while they are away. After all, the fewer active accounts, the lower your attack surface. To lock an account...

By now, we've already used sudo quite a few times in this book. At this point, you should already be aware of the fact that sudo allows you to execute commands as if you were logged in as root. However, we haven't had any formal discussion about it yet, nor have we discussed how to actually modify which of your user accounts are able to utilize sudo.

On all Linux systems, you should protect your root account with a strong password and limit it to be used by as few people as possible. On Ubuntu, the root account is locked anyway, so unless you unlocked it by setting a password, it cannot be used to log into the system. Using sudo is an alternative to using root, so you can give your administrators access to perform root tasks with sudo without actually giving them your root password or unlocking the root account. In fact, sudo...

In this section, all the user management we've done in this chapter so far all comes together. We've learned how to add accounts, manage accounts, and secure them but we haven't actually done any work regarding managing the resources as far as who is able to access them. In this section, I'll give you a brief overview of how permissions work in Ubuntu Server and then I'll provide some examples for customizing them.

I'm sure by now that you understand how to list the contents of a directory with the ls command. When it comes to viewing permissions, the -l flag is especially handy, as the output that the long listing provides allows us to view the permissions of an object:

ls -l 

The following are some example, hypothetical file listings:

-rw-rw-rw- 1 doctor doctor   5          Jan 11   12:52 welcome 
-rw...

In the field, managing users and permissions is something you'll find yourself doing quite a bit. New users will join your organization, while others will leave, so this is something that will become ingrained in your mental toolset. Even if you're the only person using your servers, you'll find yourself managing permissions for applications as well, given the fact that processes cannot function if they don't have access to their required resources. In this chapter, we took a lengthy dive into managing users, groups, and permissions. We worked through creating and removing users, assigning permissions, and managing administrative access with sudo. Practice these concepts on your server. When you get the hang of it, I'll see you in our next chapter, where we'll discuss all things related to storage. It's going to be awesome.

1. Which command should you place in front of commands that require root privileges?
2. Name at least one of the two commands you can use to create a new user on Ubuntu Server.
3. Which command can you use to remove a user?
4. Which two files on the Linux filesystem store information regarding user accounts?
5. What is the name of the directory that stores default configuration files for users?
6. Assuming you have a user named jdoe, what command would you type to switch to that user?
7. Assuming you want to create a group named accounting what command would you use to accomplish that?
8. To add an expiration date to a password, you would use the ____ command.
9. You should use the _____ command to give a user access to sudo.
10. The ______ command allows you to change permissions of a file or directory, and the ______ command allows you to change its ownership.

• User management (Ubuntu documentation): https://help.ubuntu.com/lts/serverguide/user-management.html
• File permissions (Ubuntu community wiki): https://help.ubuntu.com/community/FilePermissions