TopolearnEvery permission decision, service account and sudo prompt is based on users and groups.
Every process runs as a user with a numeric UID and belongs to a primary group (GID) plus any number of supplementary groups. Names are just labels for these numbers. id shows yours; whoami just the name.
Accounts are defined in plain text files:
/etc/passwd: one line per user,name:x:UID:GID:comment:home:shell,/etc/shadow: password hashes, readable only by root,/etc/group: groups and their members.
getent passwd name and getent group name query them, including accounts from LDAP or other directories.
root (UID 0) bypasses permission checks and can do anything, which is exactly why you should not work as root. Instead, administrators use sudo to run a single command with root privileges: sudo apt update. sudo asks for your own password, checks the rules in /etc/sudoers (often "members of the sudo or wheel group may run anything"), and logs every command. sudo -i opens a root shell when you really need several commands; su - user switches user with that user's password.
Besides people, systems have many system users (UIDs below 1000) such as www-data, postgres or nobody. Services run as these unprivileged users so a compromised service cannot take over the whole machine.
Example
whoami # ada
id # uid=1000(ada) gid=1000(ada) groups=1000(ada),27(sudo),998(docker)
grep '^ada:' /etc/passwd # ada:x:1000:1000:Ada,,,:/home/ada:/bin/bash
getent group sudo # sudo:x:27:ada
sudo -l # which commands may I run with sudo?
sudo apt update # one command as root (asks for YOUR password)
sudo -i # root login shell; type exit to leave
su - bob # become bob (needs bob's password)
ps -o user= -p "$(pgrep -o nginx)" # nginx master runs as root, workers as www-dataRemember
- Users and groups are numbers (UID/GID); root is UID 0
- /etc/passwd, /etc/shadow and /etc/group define accounts
- Use sudo for single admin commands rather than working as root
Watch out for
- Running everything as root, so one typo or compromised script can destroy the system.