Good user management keeps a server secure and makes it easy to see who did what. On Debian, a few commands cover almost everything you’ll need.

Users and groups basics

  • Every user has a UID, a primary group and a home directory.
  • Users can belong to additional groups, which grant shared access to files and privileges (e.g. sudo, www-data, docker).
  • Account details live in /etc/passwd, password hashes in /etc/shadow, groups in /etc/group.
id                  # your UID, GID and groups
getent passwd deploy
getent group sudo

Create, modify and delete users

# Interactive: creates home directory, asks for password
adduser alice

# Add to a supplementary group
usermod -aG www-data alice       # -a is important: append, don't replace

# Change login shell, lock / unlock
chsh -s /bin/bash alice
passwd -l alice                  # lock password login
passwd -u alice

# Account expiry (temporary contractors)
chage -E 2026-12-31 alice

# Remove user and home directory
deluser --remove-home alice

System accounts for services (no login, no home):

adduser --system --group --no-create-home appsvc

Granting sudo

The simplest way is the sudo group:

usermod -aG sudo alice

For limited rights, create a file in /etc/sudoers.d/ — always edit with visudo, which checks syntax:

visudo -f /etc/sudoers.d/deploy
# Allow 'deploy' to restart only the app service, without a password
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp.service

Avoid NOPASSWD: ALL on accounts that log in with SSH.

File permissions

ls -l /var/www
-rw-r----- 1 www-data www-data  4120 Nov  4 10:00 wp-config.php
drwxr-xr-x 5 www-data www-data  4096 Nov  4 10:00 wp-content

The three triplets are owner, group, others; r=4, w=2, x=1.

Mode Meaning Typical use
644 owner read/write, others read Normal files
640 owner read/write, group read, others nothing Config files with secrets
600 owner only SSH keys, .env files
755 everyone can enter/list, owner writes Directories, scripts
750 group can enter, others can’t Private app directories 
chown -R www-data:www-data /var/www/example.com
find /var/www/example.com -type d -exec chmod 755 {} +
find /var/www/example.com -type f -exec chmod 644 {} +
chmod 640 /var/www/example.com/wp-config.php

Never use chmod 777 to “fix” a permissions error — it lets any process on the server modify the files.

Shared folders for a team

Let several users edit the same files, with new files automatically owned by the group:

groupadd webdev
usermod -aG webdev alice
usermod -aG webdev bob
chgrp -R webdev /srv/project
chmod -R g+rwX /srv/project
find /srv/project -type d -exec chmod g+s {} +    # setgid: new files inherit the group

Set umask 002 for those users (in ~/.profile) so new files are group-writable.

ACLs for finer control

When owner/group/others isn’t enough, use access control lists:

apt install -y acl
setfacl -m u:alice:rx /var/log/myapp          # give alice read access
setfacl -d -m g:webdev:rwX /srv/project       # default ACL for new files
getfacl /srv/project

Auditing

last -n 20                     # recent logins
lastlog                        # last login per user
journalctl _COMM=sudo          # sudo usage
awk -F: '$3 >= 1000 {print $1}' /etc/passwd   # regular users

Review accounts regularly and remove those no longer needed.

Summary

Use individual accounts, grant sudo narrowly, keep secrets at 600/640, use groups and setgid for shared work, and audit regularly. Combine this with key-only SSH — see SSH security on Debian — for a solid baseline on any Debian VPS.

  • Debian
  • Linux
  • Security