Users and Groups

The account and group model behind Linux's ownership and permission system - who a user is, how groups grant shared access, and the commands for managing both.

Users & Security Updated August 28, 2026

  • users-and-security
  • users
  • groups

Every process runs as some user, and every file has an owning user and group (see File Permissions and Ownership). Understanding where that identity actually comes from makes both permissions and access control much less mysterious.

/etc/passwd: the user database

Despite the name, this file hasn't held actual passwords in decades - those live separately in /etc/shadow, readable only by root, precisely so that a file every process can read (/etc/passwd is world-readable, since plenty of ordinary tools need to look up usernames) doesn't also expose password hashes.

grep alice /etc/passwd

alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash

Fields, colon-separated: username, x (placeholder - the real hash is in /etc/shadow), UID, primary GID, a comment field (often the full name), home directory, and login shell.

UIDs below 1000 (varies slightly by distro - sometimes 500) are conventionally reserved for system accounts (root is always UID 0; services like www-data or postgres get their own low UID so they can own files without being real login accounts) - regular human users typically start at 1000.

Groups

groups alice
id alice

alice : alice sudo docker
uid=1001(alice) gid=1001(alice) groups=1001(alice),27(sudo),999(docker)

Every user has exactly one primary group (usually a group created just for them, matching their username) and any number of supplementary groups, which is how group-based access actually gets granted in practice - being in the docker group is what lets a user run docker commands without sudo, for instance, because the Docker daemon's socket is owned by that group.

Creating and modifying accounts

sudo useradd -m -s /bin/bash alice   # -m creates a home directory, -s sets the shell
sudo passwd alice                     # set/change the password
sudo usermod -aG docker alice         # add alice to the docker group
sudo userdel -r alice                 # remove alice, -r also removes her home directory

Always use -a (append) with -G when adding to a group. Without it, usermod -G docker alice replaces alice's entire supplementary group list with just docker, silently removing every other group membership she had - a common and easy mistake.

sudo groupadd developers
sudo usermod -aG developers alice

Distro differences worth knowing

  • The primary "administrator" group is named differently across distros: sudo on Debian/Ubuntu, wheel on Fedora/RHEL and Arch - see Sudo and Privilege for how that group actually grants elevated access.
  • Some distros create a private group per user by default (Debian/Ubuntu, "user private groups"); others put all regular users in a shared users group instead. Check id on an unfamiliar system rather than assuming.

Checking who's currently logged in

who
w
last

who/w show current sessions; last shows login history from /var/log/wtmp, useful when investigating unexpected access - see Logs and journald for auditing login activity more broadly.