{"id":230,"date":"2018-04-30T21:58:14","date_gmt":"2018-04-30T21:58:14","guid":{"rendered":"http:\/\/blog.staginginstance.com\/?p=230"},"modified":"2018-05-29T20:25:08","modified_gmt":"2018-05-29T20:25:08","slug":"add-new-users-linux-provide-appropriate-permissions","status":"publish","type":"post","link":"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/","title":{"rendered":"Add new users in linux and provide appropriate permissions using groups"},"content":{"rendered":"<p><img decoding=\"async\" loading=\"lazy\" class=\"wp-image-231\" src=\"http:\/\/blog.staginginstance.com\/wp-content\/uploads\/2018\/04\/linux-security-300x169.jpg\" alt=\"Add new users in linux and provide appropriate permissions using groups\" width=\"410\" height=\"231\" srcset=\"https:\/\/geekabhi.com\/blog\/wp-content\/uploads\/2018\/04\/linux-security-300x169.jpg 300w, https:\/\/geekabhi.com\/blog\/wp-content\/uploads\/2018\/04\/linux-security.jpg 750w\" sizes=\"(max-width: 410px) 100vw, 410px\" \/><\/p>\n<p>Why the need to add new users in linux? Well, we often work on a project with a large team having number of developers coding, deploying the code to the server constantly. Most of the team i have noticed uses single ssh key to log into the server. And that is definitely a security concern. Suppose if key gets compromised from one of the developer&#8217;s system during a hack or something, then your app can be hacked easily, which i am sure no team want.<\/p>\n<h5>How to AVOID This:<\/h5>\n<p>To avoid this situation, we can easily setup different linux users with different ssh keys to login with restricted access. This way even if one of the keys are compromised you won&#8217;t lose your server access and you can just delete user with ease.<\/p>\n<h5>Steps to Create linux users:<\/h5>\n<ul>\n<li style=\"text-align: left;\">Login to server user root user, assuming root user is ec2-user.<\/li>\n<li>Use the following\u00a0<b>adduser<\/b>\u00a0command to add the\u00a0<code class=\"code\">newuser<\/code>\u00a0account to the system (with an entry in the\u00a0<code>\/etc\/passwd<\/code>\u00a0file). This command also creates a group and a home directory for the account.\n<pre><code>[ec2-user ~]$ <strong>sudo adduser <\/strong><\/code><\/pre>\n<p>[Ubuntu] When adding a user to an Ubuntu system, include the\u00a0<code class=\"code\">--disabled-password<\/code>option with this command to avoid adding a password to the account.<\/p>\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[ubuntu ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">sudo<\/span> adduser <em class=\"replaceable\"><code>newuser<\/code><\/em><\/code><\/strong> --disabled-password<\/code><\/pre>\n<\/li>\n<li>Switch to the new account so that newly created files have the proper ownership.\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[ec2-user ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">sudo<\/span> su - <em class=\"replaceable\"><code>newuser<\/code><\/em><\/code><\/strong> <\/code><\/pre>\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[newuser ~]$<\/code><\/code><\/pre>\n<p>Notice that the prompt changes from\u00a0<code class=\"code\">ec2-user<\/code>\u00a0to\u00a0<code class=\"code\">newuser<\/code>\u00a0to indicate that you have switched the shell session to the new account.<\/li>\n<li>Create a\u00a0<code>.ssh<\/code>\u00a0directory in the\u00a0<code>newuser<\/code>\u00a0home directory and change its file permissions to\u00a0<code class=\"code\">700<\/code>\u00a0(only the owner can read, write, or open the directory).\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[newuser ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">mkdir<\/span> .ssh<\/code><\/strong> <\/code><\/pre>\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[newuser ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">chmod<\/span> <span class=\"\">700<\/span> .ssh<\/code><\/strong><\/code><\/pre>\n<div class=\"aws-note\">\n<p class=\"aws-note\"><strong>Important:\u00a0<\/strong>Without these exact file permissions, the user will not be able to log in.<\/p>\n<\/div>\n<\/li>\n<li>Create a file named\u00a0<code>authorized_keys<\/code>\u00a0in the\u00a0<code>.ssh<\/code>\u00a0directory and change its file permissions to\u00a0<code class=\"code\">600<\/code>\u00a0(only the owner can read or write to the file).\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[newuser ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">touch<\/span> .ssh\/authorized_keys<\/code><\/strong> <\/code><\/pre>\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[newuser ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">chmod<\/span> <span class=\"\">600<\/span> .ssh\/authorized_keys<\/code><\/strong><\/code><\/pre>\n<div class=\"aws-note\">\n<p class=\"aws-note\"><strong>Important:\u00a0<\/strong>Without these exact file permissions, the user will not be able to log in.<\/p>\n<\/div>\n<\/li>\n<li>Open the\u00a0<code>authorized_keys<\/code>\u00a0file using your favorite text editor (such as\u00a0<b>vim<\/b>\u00a0or\u00a0<b>nano<\/b>).\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[newuser ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">nano<\/span> .ssh\/authorized_keys<\/code><\/strong><\/code><\/pre>\n<p>Paste the public key for your key pair into the file and save the changes. For example:<\/p>\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClKsfkNkuSevGj3eYhCe53pcjqP3maAhDFcvBS7O6V\r\nhz2ItxCih+PnDSUaw+WNQn\/mZphTk\/a\/gU8jEzoOWbkM4yxyb\/wB96xbiFveSFJuOp\/d6RJhJOI0iBXr\r\nlsLnBItntckiJ7FbtxJMXLvvwJryDUilBMTjYtwB+QhYXUMOzce5Pjz5\/i8SeJtjnV3iAoG\/cQk+0FzZ\r\nqaeJAAHco+CY\/5WrUBkrHmFJr6HcXkvJdWPkYQS3xqC0+FmUZofz221CBt5IMucxXPkX4rWi+z7wB3Rb\r\nBQoQzd8v7yeb7OzlPnWOyN0qFU0XA246RA8QFYiCNYwI3f05p6KLxEXAMPLE<\/code><\/pre>\n<p>The user should now be able to log into the\u00a0<code class=\"code\">newuser<\/code>\u00a0account on your instance using the private key that corresponds to the public key that you added to the\u00a0<code>authorized_keys<\/code>\u00a0file.<\/p>\n<p>So this was easy right?<\/li>\n<\/ul>\n<h5 class=\"title\">To<b> remove a user from the system<\/b><\/h5>\n<p>If a user account is no longer needed, you can remove that account so that it may no longer be used. When you specify the\u00a0<code class=\"code\">-r<\/code>\u00a0option, the user&#8217;s home directory and mail spool are deleted. To keep the user&#8217;s home directory and mail spool, omit the\u00a0<code class=\"code\">-r<\/code>\u00a0option.<\/p>\n<pre class=\"programlisting\"><code class=\"nohighlight hljs\"><code class=\"\">[ec2-user ~]$ <\/code><strong class=\"userinput\"><code class=\"\"><span class=\"\">sudo<\/span> userdel -r <em class=\"replaceable\"><code>olduser<\/code><\/em><\/code><\/strong><\/code><\/pre>\n<p>Now we need to setup appropriate permissions to our newly create user. This can be done by creating linux group.<\/p>\n<h5>Steps to PROVIDE READ\/WRITE permissions on a folder to a linux user:<\/h5>\n<ul>\n<li>Create a new group:\n<pre class=\"programlisting\"><span style=\"color: #222222; font-family: Monaco, Consolas, 'Andale Mono', 'DejaVu Sans Mono', monospace;\"><span style=\"background-color: #e9ebec;\">sudo groupadd newgroup<\/span><\/span><\/pre>\n<\/li>\n<li>Add new user to this new group:\n<pre class=\"programlisting\">sudo usermod -a -G newgroup newuser<\/pre>\n<p>&nbsp;<\/li>\n<li>Add group read\/write permission to the directory which you want this new user to edit:\n<pre class=\"programlisting\">sudo chgrp -R newgroup \/var\/www\/newuser<\/pre>\n<\/li>\n<li>\n<pre class=\"programlisting\">sudo chmod 775 -R \/var\/www\/newuser<\/pre>\n<\/li>\n<\/ul>\n<p>And you are done.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Why the need to add new users in linux? Well, we often work on a project with a large team having number of developers coding, deploying the code to the server constantly. Most of the team i have noticed uses single ssh key to log into the server. And that is definitely a security concern.&hellip; <a class=\"more-link\" href=\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/\">Continue reading <span class=\"screen-reader-text\">Add new users in linux and provide appropriate permissions using groups<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[10,21],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Add new users in linux and provide appropriate permissions using groups<\/title>\n<meta name=\"description\" content=\"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to add new users in linux and provide appropriate permissions using groups\" \/>\n<meta property=\"og:description\" content=\"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups\" \/>\n<meta property=\"og:url\" content=\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/\" \/>\n<meta property=\"og:site_name\" content=\"Learner at life\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/abhij89\" \/>\n<meta property=\"article:published_time\" content=\"2018-04-30T21:58:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-05-29T20:25:08+00:00\" \/>\n<meta name=\"author\" content=\"Abhishek Jain\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"How to add new users in linux and provide appropriate permissions using groups\" \/>\n<meta name=\"twitter:description\" content=\"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups\" \/>\n<meta name=\"twitter:image\" content=\"http:\/\/blog.staginginstance.com\/wp-content\/uploads\/2018\/04\/linux-security.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@abhij89\" \/>\n<meta name=\"twitter:site\" content=\"@abhij89\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Abhishek Jain\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/\",\"url\":\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/\",\"name\":\"Add new users in linux and provide appropriate permissions using groups\",\"isPartOf\":{\"@id\":\"https:\/\/geekabhi.com\/blog\/#website\"},\"datePublished\":\"2018-04-30T21:58:14+00:00\",\"dateModified\":\"2018-05-29T20:25:08+00:00\",\"author\":{\"@id\":\"https:\/\/geekabhi.com\/blog\/#\/schema\/person\/75cf5ee8cc7d8c1a9ba81628bb57443e\"},\"description\":\"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups\",\"breadcrumb\":{\"@id\":\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/geekabhi.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Add new users in linux and provide appropriate permissions using groups\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/geekabhi.com\/blog\/#website\",\"url\":\"https:\/\/geekabhi.com\/blog\/\",\"name\":\"Learner at life\",\"description\":\"Blog to help you learn stuff\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/geekabhi.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/geekabhi.com\/blog\/#\/schema\/person\/75cf5ee8cc7d8c1a9ba81628bb57443e\",\"name\":\"Abhishek Jain\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/geekabhi.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/85387a40fe2c6954082743d1a8aa6c0f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/85387a40fe2c6954082743d1a8aa6c0f?s=96&d=mm&r=g\",\"caption\":\"Abhishek Jain\"},\"description\":\"Techie with 10+ years of experience and counting.\",\"sameAs\":[\"http:\/\/www.geekabhi.com\",\"https:\/\/twitter.com\/abhij89\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Add new users in linux and provide appropriate permissions using groups","description":"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/","og_locale":"en_US","og_type":"article","og_title":"How to add new users in linux and provide appropriate permissions using groups","og_description":"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups","og_url":"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/","og_site_name":"Learner at life","article_publisher":"http:\/\/abhij89","article_published_time":"2018-04-30T21:58:14+00:00","article_modified_time":"2018-05-29T20:25:08+00:00","author":"Abhishek Jain","twitter_card":"summary_large_image","twitter_title":"How to add new users in linux and provide appropriate permissions using groups","twitter_description":"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups","twitter_image":"http:\/\/blog.staginginstance.com\/wp-content\/uploads\/2018\/04\/linux-security.jpg","twitter_creator":"@abhij89","twitter_site":"@abhij89","twitter_misc":{"Written by":"Abhishek Jain","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/","url":"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/","name":"Add new users in linux and provide appropriate permissions using groups","isPartOf":{"@id":"https:\/\/geekabhi.com\/blog\/#website"},"datePublished":"2018-04-30T21:58:14+00:00","dateModified":"2018-05-29T20:25:08+00:00","author":{"@id":"https:\/\/geekabhi.com\/blog\/#\/schema\/person\/75cf5ee8cc7d8c1a9ba81628bb57443e"},"description":"How to fix security bug by adding new users in linux, setting up isolated groups and adding appropriate permissions to the folders using groups","breadcrumb":{"@id":"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/geekabhi.com\/blog\/add-new-users-linux-provide-appropriate-permissions\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/geekabhi.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Add new users in linux and provide appropriate permissions using groups"}]},{"@type":"WebSite","@id":"https:\/\/geekabhi.com\/blog\/#website","url":"https:\/\/geekabhi.com\/blog\/","name":"Learner at life","description":"Blog to help you learn stuff","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/geekabhi.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/geekabhi.com\/blog\/#\/schema\/person\/75cf5ee8cc7d8c1a9ba81628bb57443e","name":"Abhishek Jain","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/geekabhi.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/85387a40fe2c6954082743d1a8aa6c0f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/85387a40fe2c6954082743d1a8aa6c0f?s=96&d=mm&r=g","caption":"Abhishek Jain"},"description":"Techie with 10+ years of experience and counting.","sameAs":["http:\/\/www.geekabhi.com","https:\/\/twitter.com\/abhij89"]}]}},"_links":{"self":[{"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/posts\/230"}],"collection":[{"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/comments?post=230"}],"version-history":[{"count":5,"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/posts\/230\/revisions"}],"predecessor-version":[{"id":237,"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/posts\/230\/revisions\/237"}],"wp:attachment":[{"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/media?parent=230"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/categories?post=230"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekabhi.com\/blog\/wp-json\/wp\/v2\/tags?post=230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}