Users, groups and sudo on openSUSE, Fedora and Ubuntu

Who am I, and in which groups?

id                       # uid=1000(alice) gid=1000(alice) groups=1000(alice),477(wheel)
groups alice             # just the group names
getent group wheel       # who is in the wheel group
getent passwd alice      # home directory and login shell

Every user has a number (UID) and a primary group; the kernel only cares about the numbers. Regular users start at 1000. The users below 1000 are system accounts that run services. getent reads the same databases the system uses, so it also works when accounts come from somewhere other than /etc/passwd.

On an openSUSE laptop that kept the default sudo policy, the wheel group exists but is empty; why is explained under sudo per distribution:

$ id
uid=1000(user) gid=1000(user) groups=1000(user),459(vboxusers)

$ getent passwd root nobody; getent group wheel
root:x:0:0:root:/root:/bin/zsh
nobody:x:65534:65534:nobody:/var/lib/nobody:/usr/sbin/nologin
wheel:x:477:

Creating and removing users

sudo useradd -m -s /bin/bash alice    # -m: create /home/alice
sudo passwd alice                     # set a password
sudo userdel -r alice                 # remove the user and the home directory

useradd works the same on every distribution. Debian and Ubuntu also ship adduser, a friendlier script that asks questions and creates the home directory for you. Think twice before userdel -r: the home directory is gone, and there is no trash can. The options are in useradd(8).

Groups: sharing without chmod 777

Say two users and a media server container all need the same folder. Create a group, put everyone in it, and give the folder to the group:

sudo groupadd media
sudo usermod -aG media alice
sudo usermod -aG media bob
sudo chown -R alice:media /srv/media
sudo chmod 2775 /srv/media            # 2 = setgid: new files get the media group
sudo gpasswd -d bob media             # later: remove bob from the group again

The -a in usermod -aG means append. Without it, -G sets the list of groups and removes the user from every group you did not name. Membership takes effect at the next login. What the modes mean is explained in the file permissions guide, and the chmod calculator translates 2775 for you.

sudo per distribution

sudo command runs one command as root and logs it. Which users may do that is set in the sudoers configuration, and the defaults differ:

openSUSE's default comes from Defaults targetpw in /usr/etc/sudoers: sudo asks for the password of the target user, which is root. For your own rules, never edit the main file. Create a drop-in with visudo, which checks the syntax before saving, so a typo cannot lock you out:

# openSUSE Tumbleweed: sudo asks for root's password
$ grep -E '^[^#]*targetpw' /usr/etc/sudoers
Defaults targetpw   # ask for the password of the target user i.e. root

# Debian 12: admins are the members of the sudo group
$ getent group sudo
sudo:x:27:user

sudo visudo -f /etc/sudoers.d/alice
# contents, one line:
# alice ALL=(ALL:ALL) ALL
sudo visudo -c                        # check every sudoers file

The rule syntax is documented in sudoers(5). Need a root shell for a longer job? sudo -i, and exit as soon as you are done.

Users for services and rootless podman

A service that runs as root can do anything when it is compromised. Two better options:

• A system user for a classic daemon: sudo useradd --system --no-create-home --shell /usr/sbin/nologin backupd, then User=backupd in its systemd unit.
• A normal user for rootless podman, which needs a home directory and a range of sub-UIDs. useradd adds that range to /etc/subuid and /etc/subgid automatically on current distributions; check with grep alice /etc/subuid.

grep alice /etc/subuid /etc/subgid      # alice:100000:65536 in both
sudo loginctl enable-linger alice       # user services start at boot, keep running after logout
# log in as alice over SSH (not with su or sudo -u), then:
systemctl --user status

Both checks on a working rootless podman account:

$ grep "^$(id -un):" /etc/subuid /etc/subgid
/etc/subuid:user:100000:65536
/etc/subgid:user:100000:65536

$ loginctl show-user $(id -un) -p Linger
Linger=yes

systemctl --user needs a real login session. su alice and sudo -u alice do not create one, so they fail with "Failed to connect to bus". Log in over SSH, or use sudo machinectl shell alice@ (package systemd-container). The SSH key and config helper sets up key login for that user in a few steps.

Common mistakes

Frequently asked questions