Users and Groups in Operating Systems

What are Users?

Users are entities allowed to perform actions on processes and files in an operating system. Modern desktop operating systems are multiuser, meaning multiple users can execute programs simultaneously.

User Capabilities

When a user logs in, the system provides an environment with access to:

File Operations

Read files
Modify content
Change ownership
Delete files

Process Execution

Launch applications
Access configurations
Use hardware resources
All within permission bounds

Multi-user Environment

Modern systems support multiple concurrent login sessions:

Console logins (tty1-6 in Linux)
Graphical sessions (tty7 in Linux)
Remote connections (SSH, RDP)

What are Groups?

Groups are collections of users that can be assigned permissions collectively. Why use groups?

Create a Group

Define a group for a specific purpose (e.g., “developers”)

Assign Permissions

Grant permissions to the group (e.g., access to /var/www)

Add Users

Add all relevant users to the group

Automatic Inheritance

Users automatically receive group permissions

This is much more efficient than assigning permissions to individual users.

Windows Users and Groups

Built-in Users

User	Description
Administrator	Full system access, created during installation
Guest	Limited access for temporary users
DefaultUser0	Template for new user profiles

Built-in Groups

Group	Description
Administrators	Complete and unrestricted access to computer/domain
Users	Can run most applications but cannot make system changes
Power Users	Compatibility group with limited admin rights
Remote Desktop Users	Can log in remotely
Backup Operators	Can override security for backup/restore operations
Guests	Same access as Users, but more restricted
Network Configuration Operators	Can manage network features
IIS_IUSRS	Used by Internet Information Services
Hyper-V Administrators	Full access to Hyper-V features
Event Log Readers	Can read event logs
Performance Monitor Users	Can access performance counter data

Access Control in Windows

How Access Control Works

User Authentication

User logs in and receives an authentication token from the security subsystem

Resource Access Attempt

User tries to access an object (file, printer, etc.)

Token Presentation

User’s token is presented to the system

ACL Comparison

System compares token with object’s Access Control List (ACL)

Decision

Access granted or denied based on Access Control Entries (ACE)

ACE Types

For Files:

Read (r): View file contents
Write (w): Modify files
Execute (x): Run programs

For Printers:

Print documents
Manage printers
Manage documents

ACL Evaluation Order

The system checks ACEs in descending order:

Check each ACE sequentially
First allow or deny match returns immediately
If no match found at end, deny access

Explicit deny permissions always override allow permissions.

NTFS Permissions

NTFS (NT File System) supports detailed permissions: Standard Permissions:

Full Control
Modify
Read & Execute
Read
Write

Permission Targets:

Groups
Users
Computer accounts (in domains)
Domain users and groups
Local users and groups

Permission Inheritance

Objects inherit permissions from parent containers:

Owner: Creator of object (can always change permissions)
Child objects: Automatically inherit parent permissions (if enabled)
Benefit: Easier administration and consistent security

Example: When you create files in a folder, they inherit the folder’s permissions.

User Rights

User rights differ from permissions:

Aspect	Permissions	User Rights
Apply to	Objects (files, printers)	User accounts
Examples	Read, Write, Execute	Log on locally, Backup files
Location	Object properties	Security Policy → User Rights Assignment

Best Practice: Assign user rights to groups rather than individual users.

Linux Users and Groups

User Management

Linux is a multiuser system that uses different users for secure management of applications and services.

Login name (username)
Password

Don’t confuse login name with full name. Login is typically lowercase, no spaces.

The root User

The root user (UID 0) is the superuser:

Full system access
Can create/delete users
Unrestricted file system access
Can modify any system setting

Ubuntu Approach:

root account is disabled by default
Use sudo for administrative tasks
Adds security layer (must know specific user account)

Other Distributions:

root account enabled
Direct root login disabled via SSH
Must log in as regular user first

User Information Storage

File	Contents
`/etc/passwd`	User account information
`/etc/shadow`	Encrypted passwords and password policies
`/etc/group`	Group information and memberships

User Directories

Regular users: /home/username
root user: /root

Group Management

Groups allow assigning privileges to multiple users:

Primary group: Created automatically with same name as user
Secondary groups: Users can belong to multiple groups
Group ID (gid): Numeric identifier
User ID (uid): Numeric identifier (root is always 0)

Check User ID and Groups

id

Output:

uid=1000(violin) gid=1000(violin) groups=1000(violin),27(sudo),100(users)

User Administration Commands

Creating Users

# Basic user creation
sudo useradd violonchelo

# Show defaults
useradd -D

adduser is preferred as it creates home directory, sets up shell, and provides interactive prompts.

Setting Passwords

# Set password for user
sudo passwd violin
# Prompts twice for password

Using chpasswd in scripts is risky - passwords are known to multiple people. Force password change on first login for security.

Modifying Users

# Change home directory
sudo usermod -d /home/primer_violin violin

# Change shell
sudo usermod -s /bin/zsh violin

# Add to secondary groups
sudo usermod -G users,disk violin

# Set account expiry
sudo usermod -e 2025-12-31 violin

# Lock account
sudo passwd -l violin

# Unlock account
sudo passwd -u violin

Deleting Users

# Delete user (keep home directory)
sudo userdel viola

# Delete user and home directory
sudo userdel -r viola

Group Management

# Create new group
sudo groupadd metal
sudo addgroup viento

User Information Commands

# Show user IDs and groups
id violin

# List logged-in users
who
who am i

# Detailed user activity
w
w violin

# Last logins
last

# Active user database (includes LDAP)
getent passwd
getent group

Switching Users

# Switch to root (login shell)
su -

# Switch to specific user
su violin

# Run single command as root
su -c "cat /etc/shadow"

File Permissions

Linux Permission System

Owner and Group

Every file has:

User owner: Creator of the file
Group owner: Primary group of creator

ls -l

Output:

-rw-r--r-- 1 violin cuerda 359 2024-03-06 18:02 apuntes.doc

Owner: violin
Group: cuerda

Permission Types

Read Permission (r)

For files:

View file contents
Open with applications

For directories:

List directory contents
See files and subdirectories

Write Permission (w)

For files:

Modify file contents
Delete file
Change permissions (chmod)
Change ownership (chown)

For directories:

Create files and subdirectories
Delete files and subdirectories

Execute Permission (x)

For files:

Run as program/script

For directories:

Enter directory (cd)
Access files within (if you know names)

Permission Targets

Permissions can be granted to:

User owner (u)
Group owner (g)
Others (o) - all other users

You cannot assign permissions to specific users or groups beyond owner/group owner. To grant access to specific users, add them to the group owner.

Viewing Permissions

ls -l

Output format:

-rw-r--r-- 1 violin cuerda 11 2024-03-06 19:26 examen.txt
│││││││││
│└┬┘└┬┘└┬┘
│ │  │  └─ Others: read
│ │  └──── Group: read
│ └─────── User: read, write
└────────── File type (- = regular file)

File type indicators:

- : Regular file
d : Directory
l : Symbolic link
s : Socket
p : Pipe
b : Block device

Changing Permissions (chmod)

Symbolic Method

# Add permission
chmod u+w examen.txt      # User: add write
chmod g+x script.sh       # Group: add execute
chmod o+r doc.txt         # Others: add read

# Remove permission
chmod o-w examen.txt      # Others: remove write
chmod g-r doc.txt         # Group: remove read

# Multiple changes
chmod u+w,g-r,o-r examen.txt

# Multiple targets
chmod ug+w examen.txt     # User and group: add write

# Set exact permissions
chmod u=rwx,g=rx,o=r file.txt

Numeric Method

Permissions as octal numbers:

Number	Binary	Permissions
0	000	---
1	001	—x
2	010	-w-
3	011	-wx
4	100	r—
5	101	r-x
6	110	rw-
7	111	rwx

# rwx r-x r-- (755)
chmod 755 script.sh

# rw- r-- r-- (644)
chmod 644 document.txt

# rwx ------ (700)
chmod 700 private.sh

# Recursive
chmod -R 755 /var/www

Changing Ownership (chown)

# Change owner
sudo chown viola examen.txt

# Change owner and group
sudo chown viola:viola examen.txt
sudo chown violonchelo:instrumentos examen.txt

# Recursive
sudo chown -R www-data:www-data /var/www

Special Permissions

SUID (Set User ID)

File executes with owner’s permissions:

# Set SUID
chmod u+s program
chmod 4755 program

SUID on root-owned files is a security risk. Use carefully.

SGID (Set Group ID)

On files: Execute with group’s permissions On directories: New files inherit directory’s group

# Set SGID
chmod g+s directory
chmod 2755 directory

Use case: Shared project directory where all files should belong to project group.

Sticky Bit

On directories: Only file owner can delete files

# Set sticky bit
chmod +t directory
chmod 1777 /tmp

Example: /tmp directory - users can create files but only delete their own.

umask

Default permissions for new files/directories:

Default file: 666 (rw-rw-rw-)
Default directory: 777 (rwxrwxrwx)
umask: Subtracts from defaults

# View current umask
umask

# Set umask (022 = u=rwx,g=rx,o=rx)
umask 022
# New files: 644 (rw-r--r--)
# New dirs: 755 (rwxr-xr-x)

# Set umask (002 = u=rwx,g=rwx,o=rx)
umask 002
# New files: 664 (rw-rw-r--)
# New dirs: 775 (rwxrwxr-x)

Windows NTFS Permissions

NTFS supports detailed permissions, but basic concepts are similar:

Read: View files and folders
Write: Create and modify files
Execute: Run programs, access folders

FAT32 file system does NOT support permissions - all users have full access to all files.

Key differences from Linux:

More granular permission control
Explicit deny permissions
Permission inheritance settings
Can assign to specific users (not just owner/group/others)

Best Practices

Principle of Least Privilege

Grant minimum permissions necessary for tasks

Use Groups

Assign permissions to groups, not individual users

Regular Audits

Review user accounts and permissions periodically

Document Everything

Keep records of permission structures and reasons

Test Changes

Verify permissions work as intended before deploying

UD01 - Operating Systems Introduction

UD02 - Virtualization

UD03 - Installation & Boot

UD04 - Processes & Networking

UD05 - Users, Groups & Permissions

UD06 - File Systems

UD07 - Software & Updates

UD08 - Security

UD09 - Domain Administration

UD10 - Domain Access

UD11 - Performance & Auditing

UD12 - Incident Management

​Users and Groups in Operating Systems

​What are Users?

​User Capabilities

File Operations

Process Execution

​Multi-user Environment

​What are Groups?

​Windows Users and Groups

​Built-in Users

​Built-in Groups

​Access Control in Windows

​How Access Control Works

​ACE Types

​ACL Evaluation Order

​NTFS Permissions

​Permission Inheritance

​User Rights

​Linux Users and Groups

​User Management

​User Login Requirements

​The root User

​User Information Storage

​User Directories

​Group Management

​Check User ID and Groups

​User Administration Commands

​Creating Users

​Setting Passwords

​Modifying Users

​Deleting Users

​Group Management

​User Information Commands

​Switching Users

​File Permissions

​Linux Permission System

​Owner and Group

​Permission Types

​Read Permission (r)

​Write Permission (w)

​Execute Permission (x)

​Permission Targets

​Viewing Permissions

​Changing Permissions (chmod)

​Symbolic Method

​Numeric Method

​Changing Ownership (chown)

​Special Permissions

​SUID (Set User ID)

​SGID (Set Group ID)

​Sticky Bit

​umask

​Windows NTFS Permissions

​Best Practices

Build docs developers (and LLMs) love

Users and Groups in Operating Systems

What are Users?

User Capabilities

Multi-user Environment

What are Groups?

Windows Users and Groups

Built-in Users

Built-in Groups

Access Control in Windows

How Access Control Works

ACE Types

ACL Evaluation Order

NTFS Permissions

Permission Inheritance

User Rights

Linux Users and Groups

User Management

User Login Requirements

The root User

User Information Storage

User Directories

Group Management

Check User ID and Groups

User Administration Commands

Creating Users

Setting Passwords

Modifying Users

Deleting Users

Group Management

User Information Commands

Switching Users

File Permissions

Linux Permission System

Owner and Group

Permission Types

Read Permission (r)

Write Permission (w)

Execute Permission (x)

Permission Targets

Viewing Permissions

Changing Permissions (chmod)

Symbolic Method

Numeric Method

Changing Ownership (chown)

Special Permissions

SUID (Set User ID)

SGID (Set Group ID)

Sticky Bit

umask

Windows NTFS Permissions

Best Practices