5.6 Users, Groups and sudo
| Command | Purpose |
|---|---|
whoami |
Current user name |
id |
UID, GID and groups of the current user |
sudo useradd -m -s /bin/bash raja |
Create user with home dir and bash shell (adduser raja on Ubuntu is interactive) |
sudo passwd raja |
Set password |
sudo usermod -aG wheel raja |
Add to admin group (wheel on AL2023/CentOS, sudo on Ubuntu) |
sudo groupadd devops |
Create group |
sudo usermod -aG devops raja |
Add user to extra group (-a = append — never forget it!) |
groups raja |
Show user's groups |
sudo userdel -r raja |
Delete user and home folder |
su - raja |
Switch to another user |
sudo -i |
Become root (use carefully, type exit to return) |
User information lives in /etc/passwd (accounts), /etc/shadow (hashed passwords) and /etc/group (groups). Sudo rules live in /etc/sudoers — always edit with sudo visudo.
Why sudo instead of logging in as root?
sudo gives admin power only for one command, logs who did what (/var/log/secure or /var/log/auth.log), and reduces accidents. On EC2, the default user (ec2-user/ubuntu) has password-less sudo, and direct root login over SSH is disabled.
sudo cat /etc/shadow | head -3 # hashes: $6$ = SHA-512, $y$ = yescrypt
sudo -l # what am I allowed to run with sudo?
last -n 10 # recent logins
Why this matters for security
sudo -l is one of the first commands an attacker runs after getting a shell – a rule like "NOPASSWD: /usr/bin/vim" gives root in seconds. Defenders audit /etc/sudoers and group membership (wheel, sudo) regularly and remove users who leave.
Ravindra Bagale's Tip
If you forget -a with usermod -G, the user loses all their other groups – and sometimes sudo access too. Many students have locked themselves out like this. Always write -aG – remember, "a" means append.
Ravindra Bagale's Tip – मराठी
usermod -G मध्ये -a विसरला तर user चे बाकी सगळे groups निघून जातात – आणि कधी कधी sudo access पण. बऱ्याच students नी असं स्वतःला lock केलं आहे. नेहमी -aG लिहा – "a" म्हणजे append, लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
usermod -G में -a भूल गए तो user के बाकी सारे groups हट जाते हैं – और कभी-कभी sudo access भी. बहुत से students ने ऐसे ख़ुद को lock कर लिया है. हमेशा -aG लिखो – "a" यानी append, याद रखो.
Practice task
Create user shahrukh, set a password, add him to wheel (Amazon Linux) or sudo (Ubuntu), switch to him with su - and run sudo whoami. Then check sudo -l.