Gnu Group Learning AcademyGnu Group ↗
FreeBSD Fundamentals · Module 03 of 14

Users, groups and permissions

Administer local identities with pw, understand root delegation, ownership, modes and account hygiene.

Learning objectives

By the end of this module, you should be able to:

  • Create and modify users with pw.
  • Interpret Unix ownership and mode bits.
  • Apply least privilege to administrative access.

Accounts and groups

FreeBSD uses standard Unix users and groups. pw provides a scriptable interface for local account management. Root remains the unrestricted superuser account, so administrative delegation should be deliberate.

Permissions and ownership

Files have owner, group and other permissions. chmod changes mode bits; chown changes ownership. Additional controls such as file flags and ACLs exist but should be introduced only when needed.

Worked examples

See the idea in practice.

Create a lab user

pw useradd labuser -m -s /bin/sh
id labuser
ls -ld /home/labuser
  • -m creates the home directory.
  • id confirms UID and group membership.
Hands-on lab

Lab — Build a shared administration directory

Goal: Create users/groups and a directory with intentional ownership and group access.

Before you start

  • Root access on a disposable lab VM.
STEP 1

Create group and users

pw groupadd opslab || true
pw useradd alice -m -G opslab || true
pw useradd bob -m -G opslab || true
STEP 2

Create shared path

mkdir -p /usr/local/opslab
chown root:opslab /usr/local/opslab
chmod 2770 /usr/local/opslab
STEP 3

Verify

ls -ld /usr/local/opslab
id alice
id bob

Verify

  • Both users are members of opslab and the directory has the setgid bit.

Expected outcome

  • New files created by members can inherit the directory group.

If it fails

  • If a user does not show new group membership in an existing shell, start a fresh login session.
Real-world connection

Shared operational directories should encode group ownership rather than rely on repeated manual chown operations.

Avoid these traps

Common mistakes

  • Giving every operator direct root login.
  • Using chmod 777 to avoid understanding ownership.
Knowledge check

Can you explain it without looking back?

Open each answer only after you have tried to answer the question yourself.

1What tool is designed for local account management?

pw.

2What does the setgid bit on a directory commonly achieve?

New entries inherit the directory group, which helps shared-team workflows.

3Why avoid chmod 777?

It grants write access far more broadly than most operational requirements justify.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Attempt the core lab and knowledge checks before marking the module complete.