Users, Groups, and File Permissions: chmod, chown, and sudo

Every file on Linux records who may read, write, and run it. Getting comfortable with this model is the first step to running your server confidently—without leaving files wide open or locking yourself out.

Reading Permissions: rwx and Numbers

Run ls -l on your server and each line starts with something like -rwxr-xr-x. The first character is the type (- for a file, d for a directory). The next nine characters form three groups—for the owner (u), the group (g), and everyone else (o):

• r read = 4
• w write = 2
• x execute (or, for a directory, permission to enter it) = 1

Add the values in each group and you get the familiar numeric permissions:

| Number | Bits | Typical use | |--------|------|-------------| | 755 | rwxr-xr-x | Directories, executable scripts | | 644 | rw-r--r-- | Regular files, configs | | 600 | rw------- | Private keys, secrets |

So 644 means the owner can read and write (6), while the group and others can only read (4).

chmod: Change Permissions

chmod 644 config.yaml        # set exactly, using numbers
chmod u+x deploy.sh          # add execute for the owner
chmod go-w file.txt          # remove write for group and others
chmod -R 755 /var/www/site   # apply recursively to a directory

The numeric form sets permissions absolutely; the u/g/o plus +/- form nudges them up or down. Always chmod 600 a private key—SSH refuses to use one that's readable by others.

chown: Change Ownership

Where chmod handles permissions, chown handles who a file belongs to:

chown alice file.txt              # change the owner
chown alice:developers file.txt   # change owner and group together
chown -R www-data:www-data /var/www   # recurse through a directory

Changing ownership usually requires admin rights, so prefix these with sudo.

Creating Users and Granting sudo

Don't do daily work as root. Create a regular account for yourself—on Ubuntu/Debian the interactive adduser is the friendly choice:

sudo adduser alice           # prompts for a password and details
sudo passwd alice            # change the password later, on its own

To let that account escalate privileges, add it to the sudo group:

sudo usermod -aG sudo alice

The a in -aG means append—leave it out and you'll wipe the user's existing groups. On CentOS/Rocky the equivalent is the wheel group: sudo usermod -aG wheel alice. Log out and back in for the change to take effect.

sudo: Escalate When You Need To

sudo runs a single command as the administrator. It's safer than logging in as root, and every action is logged:

sudo apt update              # run one command as root
sudo systemctl restart nginx
sudo -i                      # open an interactive root shell (exit when done)

Summary

rwx and numeric modes like 755 and 644 describe who can do what; chmod changes permissions and chown changes ownership. Create a day-to-day account with adduser, grant it power via usermod -aG sudo, and reach for sudo only when a task truly needs it. With these few commands, you can manage your server's files and accounts cleanly and safely.