AlmaLinux Administration Basics - Users

Adding Users with Sudo Access

#

You want people to actually use your server, and you probably don’t want to hand everyone the root password. This post covers adding users and giving them sudo access so they can do admin work without having all the power.

Create the user

#

sudo useradd myuser

Replace “myuser” with something real. That’s it for creating the account.

Set a password

#

passwd myuser

It’ll ask you for a new password twice. Make it strong. At least 12 characters. Mix uppercase, lowercase, numbers, symbols. If you can’t remember it, use a password manager.

Give them sudo access

#

Linux uses groups to control permissions. The “wheel” group has sudo access by default. Put your new user in that group:

sudo usermod -aG wheel myuser

That’s all. They can now run commands with sudo.

Test it

#

Switch to the new user:

su - myuser

Try running something with sudo:

sudo ls /root

If it asks for the user’s password and then runs, it worked.

Service accounts are different

#

User accounts are for people. Service accounts are for programs and services running on your system. They need to do specific things but don’t need a login shell. Most of the time they have /usr/sbin/nologin as their shell so nobody can actually log in as them.

The difference matters. User accounts should have real passwords. Service accounts should have minimal permissions and no way to actually log in.

Security stuff that matters

#

Only give people the minimum permissions they actually need. If someone’s account gets compromised, limiting their permissions limits the damage.

Use strong passwords. Don’t share them between accounts.

Don’t let people log in as root directly. Make them use sudo. It leaves a trace of who did what.

Keep your system updated. Security vulnerabilities get patched regularly and you need those patches.

Check your logs once in a while. If someone’s trying to break in, you’ll see it.