Linux Users, Permissions and Package Management

Every service you deploy needs an account to run as, the right file permissions, its packages installed, and a way to inspect it once it is running. This part covers that administration layer on Ubuntu: users and groups, sudo rules, permissions and special bits, links, APT and dpkg, archives, and process monitoring. Everyday file and text commands are in Essential Linux Commands for DevOps.

Users and groups

Linux is a multi-user system: many users can work on one machine at the same time, and permissions isolate each user from the others.

Types of users

System users are created by software packages (installing Apache creates www-data on Ubuntu) so services do not run as root. Only root can create or remove users.

The files behind users

/etc/passwd has one line per user with seven :-separated fields:

root:x:0:0:root:/root:/bin/bash

/etc/shadow stores password hashes and password ageing rules. Only root can read it.

root:*:19229:0:99999:7:::

/etc/group has one line per group, with the group's members at the end. Defaults for new users are in /etc/default/useradd (print them with useradd -D).

Creating and changing users

adduser (Debian and Ubuntu) is interactive: it creates the home directory, copies the default files from /etc/skel, and asks for a password. useradd is the low-level tool and does only what its options specify, which makes it the right choice for scripts.

$ sudo adduser dipen
$ sudo useradd -c "Dipendra" -m -d /var/dipen -e 2023-01-05 -g staff -G hr,admin -s /bin/bash -u 2000 dipendra

usermod takes the same options to change an existing user, plus a few of its own:

$ sudo usermod -e 2023-01-30 -s /bin/sh -u 3000 dipen
$ sudo usermod -l dipendra dipen
$ sudo usermod -L dipen
$ sudo usermod -U dipen
$ sudo usermod -aG docker dipen

-l renames the login, -L locks the account, -U unlocks it, and -aG adds a secondary group.

Other user commands:

Password ageing with chage

$ sudo chage -l dipen
$ sudo chage -m 1 -M 14 -W 2 -I 3 -E 2023-02-02 dipen

Run chage username without options to set each value interactively.

Groups

$ sudo groupadd staff
$ sudo groupdel staff
$ sudo gpasswd -d dipen staff

gpasswd -d removes a user from a group. Editing /etc/group by hand also works, but the commands validate the format and are safer.

sudo

sudo lets a normal user run a command as root, or as another user, after entering their own password. It is safer than sharing the root password: every use is logged, and each user can be limited to specific commands.

Giving a user sudo rights

On Ubuntu, members of the sudo group can run any command (older releases also used admin):

$ sudo usermod -aG sudo username

For finer control, write a rule file in /etc/sudoers.d/. Always edit sudoers files with visudo: it checks the syntax before saving, and a broken sudoers file can lock everyone out of sudo.

$ sudo visudo -f /etc/sudoers.d/dipen

A rule has this shape:

root ALL=(ALL:ALL) ALL

Examples:

# Only allow two specific commands
dipen ALL=(ALL:ALL) /usr/bin/df, /usr/bin/du
 
# Any program directly inside /usr/bin (note the trailing slash)
dipen ALL=(ALL:ALL) /usr/bin/
 
# A whole group, without a password prompt
%devops ALL=(ALL) NOPASSWD: ALL

Vagrant boxes ship with vagrant ALL=(ALL) NOPASSWD: ALL, which is why vagrant ssh users can run sudo without a password.

Aliases group users and commands so rules stay short:

User_Alias TRUSTED = rabindra, pankaj
Cmnd_Alias LIMITED = /usr/sbin/useradd, /usr/bin/passwd
TRUSTED ALL = ALL, !LIMITED

This lets rabindra and pankaj run everything except the commands in LIMITED. Host_Alias works the same way for groups of machines.

File permissions

Every file has an owner, a group, and three sets of permissions: for the user (owner), the group, and others.

The number form adds the values: 7 = rwx, 6 = rw-, 5 = r-x, 4 = r--. So -rw-r--r-- is 644.

chmod: change permissions

$ chmod 644 notes.txt
$ chmod 755 script.sh
$ chmod u+x script.sh
$ chmod o-x /path/file
$ chmod -R 755 /path/dir

• 644: owner can read and write; group and others can only read. The standard for files.
• 755: owner has full access; group and others can read and execute. The standard for directories and scripts.
• u+x / o-x change one permission and leave the rest. u user, g group, o others, a all.
• -R applies the change to everything inside a directory. chmod -R 755 also makes every regular file executable, so apply it deliberately.

chown and chgrp: change ownership

$ sudo chown -R dipen /home/dipen/testdir1
$ sudo chgrp -R testgroup1 testdir1
$ sudo chown -R apache:apache /data/dipen.com.np

chown user:group changes both at once. The old user.group form with a dot is deprecated; use the colon.

Special permissions

They show up in ls -l as t or s in place of x, for example drwxrwxrwt on /tmp.

Links and inodes

Inodes

An inode (index node) is the record the file system keeps for each file. It holds everything about the file except its name and contents: type and permissions, owner and group, size, timestamps, link count, and pointers to the data blocks on disk. A directory is a list that maps names to inode numbers. See inode numbers with ls -i or stat file.

Soft links and hard links

The syntax is ln [-s] TARGET LINK_NAME:

$ ln -s /home/student/abc.txt /tmp/slabc.txt
$ ln /home/student/xyz.txt /home/student/hlxyz.txt
$ ls -li /tmp/slabc.txt /home/student/hlxyz.txt
$ unlink /tmp/slabc.txt
$ unlink /home/student/hlxyz.txt

Package management

Ubuntu and Debian use .deb packages, with two layers of tools:

• dpkg is the low-level tool. It installs, removes and inspects .deb files, but it does not download packages or resolve their dependencies.
• APT (Advanced Package Tool) is the high-level tool. It downloads packages from repositories and installs their dependencies automatically.

apt

apt is the newer command designed for interactive use. apt-get and apt-cache cover the same operations with output that stays stable for scripts.

When an install fails because of a wrong package name, apt-cache search finds the correct one. In my lab it located the PyMySQL package for Python 3:

aptitude is another high-level front end with the same subcommands (install, remove, search, show) and a text menu interface. It is not installed by default.

dpkg

Files behind APT

To list every package installed with apt install, search the history log:

$ grep " install " /var/log/apt/history.log

Archiving and compressing

Archiving joins many files and folders into one file; it does not make them smaller. Compression makes a file smaller by removing repeated data. tar archives and can compress at the same time; zip always does both.

tar flags: c create, x extract, t list, v verbose, f archive file name (must come last before the name), z gzip. Other compression tools are bzip2 (j in tar) and xz (J in tar).

Without -r, zip adds only the empty directory and none of the files inside it.

Processes

top

top shows a live view of the system and its processes. The capture below comes from a lab VM running Jenkins and Tomcat:

How to read the header:

top - 04:10:44 up 1 day, 2:41, 3 users, load average: 0.09, 0.09, 0.06
Tasks: 196 total, 1 running, 195 sleeping, 0 stopped, 0 zombie
%Cpu(s): 0.2 us, 0.5 sy, 0.0 ni, 99.3 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 3843.4 total, 1682.4 free, 1658.1 used, 735.4 buff/cache

• up: time since boot. users: logged-in sessions.
• load average: average number of processes running or waiting for CPU over the last 1, 5 and 15 minutes. Compare it with the number of CPU cores (nproc): a load of 2.0 on a 2-core machine means it is fully busy.
• Tasks: sleeping processes are waiting for input or I/O; zombie processes have finished but are still in the process table.
• %Cpu: us user programs, sy kernel, ni low-priority (niced) processes, id idle, wa waiting for disk or network I/O, hi/si hardware/software interrupts, st time taken by the hypervisor on a VM.
• Mem: buff/cache is memory used for disk cache; the kernel gives it back when programs need it.

Process columns:

Keys inside top: M sort by memory, P sort by CPU, T sort by run time, R reverse the order, k kill a process by PID, h help, q quit.

ps

ps prints a snapshot of processes and exits.

Names in square brackets in ps aux, such as [kworker/0:1], are kernel threads.

Stopping processes

kill PID sends SIGTERM, which asks the process to shut down cleanly. kill -9 PID sends SIGKILL, which ends it at once with no clean-up, so use it only when SIGTERM does not work.

This pipeline kills every apache2 process. grep -v grep drops the grep command itself from the list, and awk prints the PID column:

$ ps -ef | grep apache2 | grep -v grep | awk '{print $2}' | xargs kill -9

sudo pkill apache2 does the same in one step. For anything managed by systemd, sudo systemctl stop apache2 is the correct method.

Zombie and orphan processes

• Zombie: a process that has finished, but its parent has not yet read its exit status, so it still has an entry in the process table.
• Orphan: a child process that is still running after its parent has exited. The init process (PID 1, systemd) adopts it.

Common mistakes

• usermod -G group user without -a removes the user from all other secondary groups.
• Editing /etc/sudoers with a normal editor: one typo can break sudo. Use visudo.
• Using double quotes around an awk program (awk "{print $2}"): the shell replaces $2 before awk sees it. Use single quotes.
• apt purge is not "remove plus clean": it removes the package's config files, while apt clean empties the download cache.

Key takeaways

• User data lives in /etc/passwd, password hashes in /etc/shadow, groups in /etc/group.
• Give sudo rights with group membership or a file in /etc/sudoers.d/, always edited with visudo.
• 644 for files and 755 for directories and scripts cover most cases; avoid 777.
• APT resolves dependencies, dpkg does not; apt install ./file.deb gives you both.
• top for a live view, ps for a snapshot, and SIGTERM before kill -9.

Next in this series: Bash Shell Scripting Basics with an EC2 Automation Script.