Users and groups

Every person, and many services, get their own user account, so each one only reaches its own files. Users are listed in /etc/passwd (one line each: name, user number, home folder, shell). The passwords themselves are kept, scrambled, in /etc/shadow, which only root can read.

On Debian and Ubuntu, adduser walks you through making a user, home folder and password included. The lower-level useradd works everywhere; give it -m to make the home folder and -s to set the shell.

$ sudo adduser dana
$ sudo useradd -m -s /bin/bash lee
$ sudo passwd lee
New password:

passwd on its own changes your own password; with sudo and a name it sets someone else's. sudo deluser dana (or userdel -r dana, where -r also removes the home folder) deletes an account. sudo passwd -l dana locks it instead, which is kinder when someone might come back.

Groups are managed with usermod. sudo usermod -aG docker dana adds dana to the docker group. The -a (append) matters: without it, -G replaces all of dana's groups with just that one. Group changes apply from the user's next login.

To let someone use sudo, add them to the admin group: sudo on Debian and Ubuntu, wheel on Fedora and Red Hat. The rules themselves live in /etc/sudoers; edit it only with sudo visudo, which checks for mistakes before saving, because a broken sudoers file can lock everyone out of sudo.