Users, Groups, and Who You're Logged In As

Who are you, right now

whoami       # your username
id             # your user ID, group ID, and every group you belong to

$ whoami
laborant

$ id
uid=1001(laborant) gid=1001(laborant) groups=1001(laborant),27(sudo),100(users)

id's output has a fixed shape: uid= is your numeric user ID and, in parentheses, your username. gid= is your primary group - normally one created automatically with the same name as you. groups= lists every group you belong to, primary group included - here, laborant is also in 27(sudo), which is exactly what grants permission to run sudo at all on this box, and 100(users), a generic group Linux ships by default. If sudo ever stops working for a user, id is the first command to run - the group it's missing is usually right there in that list.

Every user is listed in /etc/passwd, one line each, colon-separated:

grep laborant /etc/passwd

laborant:x:1001:1001:,,,:/home/laborant:/bin/bash

In order: username, a placeholder x (real passwords live elsewhere, in /etc/shadow, not here), UID, GID, a comment field (the ,,, here means the optional full-name/room/phone subfields were left blank), home directory, and default shell. You never need to edit this file by hand - the commands below do it correctly for you, and a hand-edited mistake here can lock every user out of the box at once.

Creating a user

sudo useradd -m -G groupname username

-m creates their home directory (/home/username) at the same time - without it, they'd have nowhere to log into. -G groupname adds them to an existing supplementary group at creation time, on top of their own personal group of the same name as their username.

Groups exist so permissions don't have to be per-person

Instead of granting access to individuals one at a time, you put people in a group and grant access to the group once. Create one with:

sudo groupadd groupname

Switching identity

su - username       # become that user, with their environment

Do it

A group called ops already exists on this box. Create a user named oncall and put them in it:

sudo useradd -m -G ops oncall
id oncall

uid=1002(oncall) gid=1003(oncall) groups=1003(oncall),1002(ops)

Two things to read here: oncall got its own personal group (gid=1003, named oncall), and the groups= list shows it's also in 1002(ops) - the supplementary group -G ops asked for. Both facts prove the setup worked. You can see the same relationship from the group side instead:

grep -E 'ops|oncall' /etc/group

ops:x:1002:oncall
oncall:x:1003:

The last field of each /etc/group line lists its supplementary members, comma-separated - ops lists oncall there, confirming the membership from the other direction. oncall's own personal group has nobody listed as a supplementary member, because being your primary group doesn't require being named in this list at all.