ユーザーと権限

# Create a user with a home directory
sudo useradd -m -s /bin/bash username
 
# Set the password
sudo passwd username

sudo adduser username

# Change the default shell
sudo usermod -s /bin/zsh username
 
# Change home directory (and move files)
sudo usermod -d /home/newdir -m username
 
# Lock a user account
sudo usermod -L username
 
# Unlock a user account
sudo usermod -U username
 
# Rename a user
sudo usermod -l newname oldname

# Delete a user but keep the home directory
sudo userdel username
 
# Delete a user and their home directory
sudo userdel -r username

# Check the current user
whoami
 
# View user ID and group information
id username
 
# List all users
cat /etc/passwd
 
# View currently logged-in users
who
w

# Create a new group
sudo groupadd developers
 
# Add a user to a group (preserving existing groups)
sudo usermod -aG developers username
 
# Add a user to multiple groups
sudo usermod -aG docker,sudo,developers username
 
# View the groups a user belongs to
groups username
 
# View all members of a group
getent group developers
 
# Delete a group
sudo groupdel developers

# Change a user's primary group
sudo usermod -g newgroup username
 
# Modify supplementary groups (-a means append; without -a, all supplementary groups are replaced)
sudo usermod -aG extragroup username

# Execute a command with root privileges
sudo apt update
 
# Switch to the root user
sudo -i
 
# Execute a command as another user
sudo -u www-data command

# In Ubuntu, members of the sudo group have administrator privileges
sudo usermod -aG sudo username

sudo visudo

# Allow a user to execute all commands without a password
username ALL=(ALL) NOPASSWD: ALL

# Allow a user to execute only specific commands
username ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl status nginx

# Allow group members to execute apt without a password
%developers ALL=(ALL) NOPASSWD: /usr/bin/apt

sudo visudo -f /etc/sudoers.d/developers

# View file permissions
ls -la
 
# Example output:
# -rwxr-xr-- 1 user group 4096 Jan 1 12:00 script.sh
# │├─┤├─┤├─┤
# │ │   │  └── Others: r-- (read only)
# │ │   └── Group: r-x (read and execute)
# │ └── Owner: rwx (read, write, execute)
# └── File type: - regular file, d directory, l symlink

# Numeric mode
chmod 755 script.sh    # rwxr-xr-x
chmod 644 config.txt   # rw-r--r--
chmod 600 secret.key   # rw-------
 
# Symbolic mode
chmod u+x script.sh        # Add execute permission for the owner
chmod g+w file.txt          # Add write permission for the group
chmod o-r file.txt          # Remove read permission for others
chmod a+r file.txt          # Add read permission for everyone
 
# Recursively change directory permissions
chmod -R 755 /var/www/html

# Change the file owner
sudo chown newuser file.txt
 
# Change both owner and group
sudo chown newuser:newgroup file.txt
 
# Change only the group
sudo chgrp newgroup file.txt
 
# Recursively change directory ownership
sudo chown -R www-data:www-data /var/www

# SUID - Execute as the file owner
chmod u+s executable
chmod 4755 executable
 
# SGID - Execute as the file group / new files in directory inherit the group
chmod g+s directory
chmod 2755 directory
 
# Sticky Bit - Only the file owner can delete files (commonly used on /tmp)
chmod +t directory
chmod 1777 directory

# View current umask
umask
 
# Set umask (new file default = 0666 - umask, new directory = 0777 - umask)
umask 022    # New files 644, new directories 755
umask 077    # New files 600, new directories 700

# Install ACL tools
sudo apt install acl
 
# Grant permissions to a specific user
setfacl -m u:username:rwx /path/to/file
 
# Grant permissions to a specific group
setfacl -m g:groupname:rx /path/to/dir
 
# View ACL settings
getfacl /path/to/file
 
# Recursively set ACL
setfacl -R -m u:username:rwx /path/to/dir
 
# Set default ACL (newly created files inherit automatically)
setfacl -d -m u:username:rwx /path/to/dir
 
# Remove ACL
setfacl -x u:username /path/to/file