We've taken care of the initial configuration; let's wrap up this chapter by covering a few finishing touches in the configuration, creating users, and giving them power!
Before logging on as your new user, you might want to give them the ability to do superuser things, like the pi
account does. Let's take a look at how to give your new user more powers!
Note
What is this sudo
thing anyway? If you are new to Linux, it probably seems strange to see a lot of these commands start with sudo
. This command means superuser-do,
which puts the command in a temporary elevated state. sudo
is intended to prevent regular users from being able to do something they shouldn't (such as formatting a disk or deleting a filesystem), but it gives certain users powers to do those things if they specifically ask for elevation. It also logs attempts at trying to run things with elevated permissions that users were not given permission to do. It should become more clear as we move through the cookbook, but if you find yourself typing a command, failing, and then typing it again with sudo
when you realize your mistake, you are already living the life of many experienced Linux users.
To give your user the ability to run as a superuser, use the visudo
tool:
sudo visudo
This opens an edit window of the sudoers
file, which will allow you to give your new user special permissions. Look down to where the pi
user is already set up, and add rpz ALL=(ALL) ALL
, like this:
#includedir /etc/sudoers.d
pi ALL=(ALL) NOPASSWD: ALL
rpz ALL=(ALL) ALL
This gives your user the same permissions as the pi
user, but requires that you enter a password when executing something that requires elevated permissions. This way, you can prevent the unauthorized execution of things that only a superuser should execute.
You can try logging in as our new user and trying to sudo
. The touch
command creates an empty file wherever you tell it to. If you don't have permissions to write, the touch
command will fail. We will try logging on as our rpz
user and trying touch
with and without sudo
, in a directory that requires elevated permission to write to. Use the su
command to log on as another user:
pi@rpz14101:~ $ sudo su - rpz
rpz@rpz14101:~ $ touch /opt/testsudo.deleteme
touch: cannot touch '/opt/testsudo.deleteme':
Permission denied
rpz@rpz14101:~ $ sudo touch /opt/testsudo.deleteme
[sudo] password for rpz:
rpz@rpz14101:~ $ ls /opt
minecraft-pi pigpio sonic-pi testsudo.deleteme
vc Wolfram
Excellent! You now have superuser abilities (but remember, Spider-Man, with great power comes great responsibility), and whoever is executing them needs to know your password (which is only you, of course). If you'd prefer to keep the permissions the same as the pi
user, you can sudo visudo
the permissions again and set your user's settings to NOPASSWD: ALL
, just like for the pi
user.
There is a collection of user and group commands you can use beyond adduser
: addgroup
, usermod
, and userdel
are all good things to put in your administrator's toolbox. For pretty much any Linux command, adding --help
(for example, useradd --help
) or prefixing with man
(man useradd
) will provide you with instructions and options for what you can do with it:
rpz@rpz14101:~ $ useradd --help
Usage: useradd [options] LOGIN
useradd -D
useradd -D [options]
Options:
-b, --base-dir BASE_DIR base directory for
the home directory of the
new account
-c, --comment COMMENT GECOS field of the
new account
-d, --home-dir HOME_DIR home directory of
the new account
-D, --defaults print or change
default useradd configuration
-e, --expiredate EXPIRE_DATE expiration date of
the new account
-f, --inactive INACTIVE password inactivity
period of the new account
-g, --gid GROUP name or ID of the
primary group of the new
account
-G, --groups GROUPS list of
supplementary groups of the new
account
-h, --help display this help
message and exit
-k, --skel SKEL_DIR use this alternative
skeleton directory
-K, --key KEY=VALUE override
/etc/login.defs defaults
-l, --no-log-init do not add the user
to the lastlog and
faillog databases
-m, --create-home create the user's
home directory
-M, --no-create-home do not create the
user's home directory
-N, --no-user-group do not create a
group with the same name as
the user
-o, --non-unique allow to create
users with duplicate
(non-unique) UID
-p, --password PASSWORD encrypted password
of the new account
-r, --system create a system
account
-R, --root CHROOT_DIR directory to chroot
into
-s, --shell SHELL login shell of the
new account
-u, --uid UID user ID of the new
account
-U, --user-group create a group with
the same name as the user
-Z, --selinux-user SEUSER use a specific
SEUSER for the SELinux user mapping