2
Managing Users and Permissions
In the previous chapter, we set up our very own Ubuntu Server installation, and we can now learn how to maintain it, starting with a look at managing who is able to use our server.
As an administrator of Ubuntu servers, users can be your greatest asset and also your biggest headache. During your career, you'll add countless new users, manage their passwords, remove their accounts when they leave the company, and grant or remove access to resources across the filesystem. Even on servers on which you're the only user, you'll still find yourself managing user accounts, since even system processes run as users. To be successful at managing Linux servers, you'll also need to know how to manage permissions, create password policies, and limit who can execute administrative commands on the machine. In this chapter, we'll work through these concepts so that you'll have a clear idea of how to manage users and their resources.
In particular, we will cover:
- Understanding users and groups
- Understanding when to use
root - Creating and removing users
- Understanding the
/etc/passwd and /etc/shadow files - Distributing default configuration files with
/etc/skel - Switching users
- Managing groups
- Managing passwords and password policies
- Configuring administrator access with
sudo - Setting permissions on files and directories
In the first section, we have a quick discussion of the nature of managing users.
Understanding users and groups
When it comes to a server, users are very important—without users to serve, then there's no real need for a server in the first place. The subject of user management itself within the world of IT is in and of itself quite vast. Entire books have been written on individual methods of authentication, and entire technologies (such as Lightweight Directory Access Protocol, or LDAP) exist around it. In this chapter, we'll look at managing users that exist locally to our server, and the groups that help define what they are able to do.
Since Ubuntu Server is a distribution of Linux, it adopts the Unix-style of managing user accounts, groups, and permissions. Although our focus is on Ubuntu, many of the same commands around user management that you'll learn in this chapter will apply to other platforms as well. There are commands that allow you to add, remove, and change users, as well as commands that allow you to alter permissions.
Users in the context of a server refer to who (or what) is able to use the server. For example, you may have an accountant named Susan, or an IT administrator named Haneef, who both need to access the server. Perhaps Susan only needs access to a file share directory for accounting-related files, and Haneef might have more access to the server as a system administrator. The user accounts we create on our server will represent the actual people that will use it.
Groups allow us to segregate access to be specific to a role. As we'll learn later, files and directories have user and group assignments. When combined with permissions, we'll be able to manage what our users are able to do with our server.
Users aren't always people, though. We also have system users on our server that applications and running processes might use for background or automated tasks. An example of this might be a backup job, and you may have a backup user that runs a task in the background to facilitate some sort of file copy task that copies important files to another place. You don't have to worry about system-related users for now, just know that they exist. You'll see more examples of this as we go through the book.
More advanced organizations may have a central login server, such as Active Directory (AD) or standard LDAP. There are also others aside from those, as well. In this book, we won't cover those technologies, but just keep in mind that central authentication servers are a possibility for your organization, should you choose to explore them.
The most powerful user of all, though, is root. This special user gives us the most control, but as you'll see in the next section, that comes with risks.
Understanding when to use root
In the last chapter, we set up our very own Ubuntu Server installation. During the installation process, we were instructed to create a user account to act as a system administrator. So, at this point, we should have at least two users on our server. We have the aforementioned administrative user, as well as root. We can certainly create additional user accounts with varying levels of access (and we will do so in this chapter), but before we get to that, some discussion is in order regarding the administrator account you created, as well as the root user that was created for you.
The root user account exists on all Linux distributions and is the most powerful user account on the planet. The root user account can be used to do anything within your server, and I do mean anything. Want to create files and directories virtually anywhere on the filesystem? Want to install software? These processes are easily performed with root. The root account can even be used to destroy your entire installation with one typo or ill-conceived command: if you instruct root to delete all the files on your entire hard disk, it won't hesitate to do so. It's always assumed on a Linux system that if you are using root, you are doing so because you know what you are doing. So, there's often not so much as a confirmation prompt while executing any command as root. It will simply do as instructed, for better or worse.
It's for this reason that every Linux distribution I've eve...
