Linux Users and Groups
How Users and Groups Identify Who Is Acting
Linux users are accounts that identify who is doing something on the system, and groups collect users so that access can be granted to several of them at once. Every running process acts as a user, and every file belongs to one user and one group.
Each account has a numeric user ID (UID) and each group a group ID (GID). Names are a readable label for those numbers. The system keeps the list of accounts in /etc/passwd and group membership in /etc/group. Password hashes are stored separately in a restricted file, not in the readable account list.
A user has one primary group and can belong to any number of supplementary groups. Membership gives access to the files that group is allowed to use. This is how a team, or a service, can share a folder without every person being given full control over it. Only the root account can override these rules, as described in the article on the root user.
System Accounts, Regular Users and File Ownership
Linux separates two kinds of accounts. Regular users are people who log in, with a home directory and an interactive shell. System accounts run services such as a web server, mail system or database. They usually have low UIDs, no login password and no login shell, so nobody can sign in as them directly.
Ownership links accounts to files. Each file has an owner, normally the user who created it, and an owning group. These are checked alongside the permission bits that decide what the owner, the group and everyone else may do. The command that changes a file's owner or group is chown, short for change owner.
Example: A Web Server and Its Site Files
On a typical Debian or Ubuntu server, the web server process runs as the system account www-data. Site files are often owned by the administrator's account, with a group that the web server account is a member of. The server can then read the site and, where needed, write to an upload folder, while other accounts on the machine cannot change the files.
Some Red Hat-family systems use different account names for the same role, so the exact name depends on the distribution. The principle is the same. If one site is compromised, the damage is limited to the files that its account and the web server account can reach. Administrative rights can also be granted through sudo, without making an account root.
Frequently asked questions
What Is the Difference Between a User and a Group in Linux?
A user is an account that performs actions and owns files. A group is a named collection of users used to share access. A user can belong to several groups, while a file has exactly one owning user and one owning group.
Can an Ordinary User Change a File's Owner?
Generally, no. Changing a file's owner normally requires root privileges, which is why ordinary users cannot hand their files to someone else. A file's owner can usually change its group to any group that the owner belongs to, which is a common way to share files within a team.