Setting up a new user - Revision history

Prabuanand: rephrased elogind

2025-10-31T05:39:19Z

rephrased elogind

← Older revision		Revision as of 05:39, 31 October 2025
Line 60:		Line 60:
	If Alpine Linux is used as desktop OS with a GUI, the group memberships depend on whether and which [[Seat manager]] is used:		If Alpine Linux is used as desktop OS with a GUI, the group memberships depend on whether and which [[Seat manager]] is used:
	* For a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality along with '''audio''', if [[Sound Setup\|sound access]] is required.		* For a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality along with '''audio''', if [[Sound Setup\|sound access]] is required.
	* If [[elogind]] is used as a [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''', '''video''' and '''audio''' group.
	* If [[seatd]] is used as [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''' and '''video''' in most cases except when one needs [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. '''audio''' group is still required for [[Sound Setup\|sound access]].		* If [[seatd]] is used as [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''' and '''video''' in most cases except when one needs [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. '''audio''' group is still required for [[Sound Setup\|sound access]].
			* If [[elogind]] is used as a [[Seat manager]], then membership of '''input''', '''video''' and '''audio''' groups are not required as it handles device access permissions automatically through its session management.

	Use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.		Use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.

Prabuanand: fixed typo and added comment to future editors

2025-10-31T05:14:17Z

fixed typo and added comment to future editors

← Older revision		Revision as of 05:14, 31 October 2025
Line 55:		Line 55:
	=== Groups for desktop usage ===		=== Groups for desktop usage ===

			<!--- Note to editors: Please be thoughful before adding content here, so as not to overwhelm new Alpine Linux users -->
	'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. '''netdev''' group is required for unprivileged network configuration.		'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. '''netdev''' group is required for unprivileged network configuration.

	If Alpine Linux is used as desktop OS with a GUI, the group memberships ~~depends~~ on whether and which [[Seat manager]] is used:		If Alpine Linux is used as desktop OS with a GUI, the group memberships depend on whether and which [[Seat manager]] is used:
	* For a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality along with '''audio''', if [[Sound Setup\|sound access]] is required.		* For a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality along with '''audio''', if [[Sound Setup\|sound access]] is required.
	* If [[elogind]] is used as a [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''', '''video''' and '''audio''' group.		* If [[elogind]] is used as a [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''', '''video''' and '''audio''' group.
	* If [[seatd]] is used as [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''' and '''video''' in most cases except when one ~~need~~ [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. '''audio''' group is still required for [[Sound Setup\|sound access]].		* If [[seatd]] is used as [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''' and '''video''' in most cases except when one needs [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. '''audio''' group is still required for [[Sound Setup\|sound access]].

	Use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.		Use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.

Prabuanand: rephrased sentence to clarify all the groups and seat manager exceptions

2025-10-31T05:04:14Z

rephrased sentence to clarify all the groups and seat manager exceptions

← Older revision		Revision as of 05:04, 31 October 2025
Line 55:		Line 55:
	=== Groups for desktop usage ===		=== Groups for desktop usage ===

	'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. ~~If Alpine Linux~~ is ~~used as desktop OS, use the [[#Group management\|Group management commands]] to verify and add above groups, as needed~~.		'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. '''netdev''' group is required for unprivileged network configuration.

	~~For~~ desktop ~~users not using [[elogind]] as~~ [[Seat manager]] ~~and need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group.~~ For ~~users that want~~ a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.		If Alpine Linux is used as desktop OS with a GUI, the group memberships depends on whether and which [[Seat manager]] is used:
			* For a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality along with '''audio''', if [[Sound Setup\|sound access]] is required.
			* If [[elogind]] is used as a [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''', '''video''' and '''audio''' group.
			* If [[seatd]] is used as [[Seat manager]], then membership of '''seat''' group replaces the need for '''input''' and '''video''' in most cases except when one need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. '''audio''' group is still required for [[Sound Setup\|sound access]].

	~~As noted in~~ {{~~Issue~~\|~~15409}}, adding~~ users to the '''video''' has negative security concerns.		Use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.

			{{Note\| Adding users to the '''video''' has negative security concerns as explained in {{Issue\|15409}}.}}

	To add all newly created users to groups that may come in handy for desktop usage, you can run the below command as root: {{cmd\|# for u in $(ls /home); do for g in disk lp input audio cdrom dialout video netdev games users; do addgroup $u $g; done;done}}		To add all newly created users to groups that may come in handy for desktop usage, you can run the below command as root: {{cmd\|# for u in $(ls /home); do for g in disk lp input audio cdrom dialout video netdev games users; do addgroup $u $g; done;done}}

Prabuanand: removed wikilink to reduce distraction

2025-10-30T09:16:01Z

removed wikilink to reduce distraction

← Older revision		Revision as of 09:16, 30 October 2025
Line 55:		Line 55:
	=== Groups for desktop usage ===		=== Groups for desktop usage ===

	'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. If Alpine Linux is ~~[[Tutorials_and_Howtos#Desktop\|~~used as desktop OS]] , use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.		'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. If Alpine Linux is used as desktop OS, use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.

	For desktop users not using [[elogind]] as [[Seat manager]] and need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. For users that want a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.		For desktop users not using [[elogind]] as [[Seat manager]] and need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. For users that want a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.

Prabuanand: added wikilink and suggestion to add groups

2025-10-30T06:53:39Z

added wikilink and suggestion to add groups

← Older revision		Revision as of 06:53, 30 October 2025
Line 55:		Line 55:
	=== Groups for desktop usage ===		=== Groups for desktop usage ===

	'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation.		'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. If Alpine Linux is [[Tutorials_and_Howtos#Desktop\|used as desktop OS]] , use the [[#Group management\|Group management commands]] to verify and add above groups, as needed.

	For desktop users not using [[elogind]] as [[Seat manager]] and need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. For users that want a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.		For desktop users not using [[elogind]] as [[Seat manager]] and need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. For users that want a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.

Prabuanand: fixed formatting mistakes made by me earlier

2025-09-22T03:43:09Z

fixed formatting mistakes made by me earlier

← Older revision		Revision as of 03:43, 22 September 2025
Line 35:		Line 35:

	== Group management ==		== Group management ==

			Adding an user to a group allows the user to utilize the [[#Common permission groups\|privileged access]] it grants. Changes in group membership does not affect current login session.
			{{Note\|One needs to log out and log in again for the group change(s) to take effect.}}

	To see what group(s) one belong to, command {{ic\|$ groups}} can be used. To check what group(s) another user belongs to:{{Cmd\|$ groups <username>}}		To see what group(s) one belong to, command {{ic\|$ groups}} can be used. To check what group(s) another user belongs to:{{Cmd\|$ groups <username>}}
Line 48:		Line 51:
	Removing an user from a group can be done in the following ways using the inbuilt tools:		Removing an user from a group can be done in the following ways using the inbuilt tools:
	* To remove an user <username> from a group (for e.g '''seat'''), use the following command: {{Cmd\|# delgroup <username> seat}}		* To remove an user <username> from a group (for e.g '''seat'''), use the following command: {{Cmd\|# delgroup <username> seat}}
	* To remove the currently logged in user from a group (for e.g '''seat''') ~~Using~~ [[#doas\|doas]], issue the command: {{Cmd\|$ doas delgroup $USER seat}}		* To remove the currently logged in user from a group (for e.g '''seat''') using [[#doas\|doas]], issue the command: {{Cmd\|$ doas delgroup $USER seat}}

	~~{{Note\|You need to log out and log in again for the group change(s) to take effect.~~}}

	=== Groups for desktop usage ===		=== Groups for desktop usage ===
Line 56:		Line 57:
	'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation.		'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation.

	For desktop users not using elogind as Seat manager and need PipeWire to access a webcam, the user needs to be in video group. For users that want a X11 based desktop without a Seat manager, the user needs to be in both input and video groups to ensure proper keyboard, mouse, and display functionality.		For desktop users not using [[elogind]] as [[Seat manager]] and need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group. For users that want a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.

	As noted in {{Issue\|15409}}, adding users to the '''video''' has negative security concerns.		As noted in {{Issue\|15409}}, adding users to the '''video''' has negative security concerns.

Prabuanand: reverted some sentence to avoid confusion

2025-09-21T19:30:11Z

reverted some sentence to avoid confusion

← Older revision		Revision as of 19:30, 21 September 2025
Line 54:		Line 54:
	=== Groups for desktop usage ===		=== Groups for desktop usage ===

	'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation~~. So ensure that [[#User management\|users created]] later also belong to those groups for a trouble free user experience~~.		'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation.

	~~If you are wary of adding your~~ users to ~~so many~~ groups ~~from security perspective~~, ~~please be aware of~~ the ~~following:~~		For desktop users not using elogind as Seat manager and need PipeWire to access a webcam, the user needs to be in video group. For users that want a X11 based desktop without a Seat manager, the user needs to be in both input and video groups to ensure proper keyboard, mouse, and display functionality.
			As noted in {{Issue\|15409}}, adding users to the '''video''' has negative security concerns.

	* For using a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.
	* For desktop users not using [[elogind]] and still need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group.
	* As noted in {{Issue\|15409}}, adding users to the '''video''' has negative security concerns.

	To add all newly created users to groups that may come in handy for desktop usage, you can run the below command as root: {{cmd\|# for u in $(ls /home); do for g in disk lp input audio cdrom dialout video netdev games users; do addgroup $u $g; done;done}}		To add all newly created users to groups that may come in handy for desktop usage, you can run the below command as root: {{cmd\|# for u in $(ls /home); do for g in disk lp input audio cdrom dialout video netdev games users; do addgroup $u $g; done;done}}

Prabuanand: added information on the groups added during installation

2025-09-21T18:54:23Z

added information on the groups added during installation

← Older revision		Revision as of 18:54, 21 September 2025
Line 54:		Line 54:
	=== Groups for desktop usage ===		=== Groups for desktop usage ===

	~~For desktop users not using [[elogind]] as [[Seat manager]] and need [[PipeWire]] to access a webcam~~, ~~the user needs to be in~~ '''~~video~~''' ~~group. For users that want a X11 based desktop without a [[Seat manager]]~~, ~~the user needs to be in both~~ '''~~input~~''' and '''~~video~~''' groups to ensure ~~proper keyboard, mouse, and display functionality~~.		'''audio''', '''input''', '''video''' and '''netdev''' are the groups a user gets added to by the [[Alpine_setup_scripts#setup-alpine\|{{ic\|setup-alpine}}]] script during installation. So ensure that [[#User management\|users created]] later also belong to those groups for a trouble free user experience.

	As noted in {{Issue\|15409}}, adding users to the '''video''' has negative security concerns.		If you are wary of adding your users to so many groups from security perspective, please be aware of the following:

			* For using a X11 based desktop without a [[Seat manager]], the user needs to be in both '''input''' and '''video''' groups to ensure proper keyboard, mouse, and display functionality.
			* For desktop users not using [[elogind]] and still need [[PipeWire]] to access a webcam, the user needs to be in '''video''' group.
			* As noted in {{Issue\|15409}}, adding users to the '''video''' has negative security concerns.

	To add all newly created users to groups that may come in handy for desktop usage, you can run the below command as root: {{cmd\|# for u in $(ls /home); do for g in disk lp input audio cdrom dialout video netdev games users; do addgroup $u $g; done;done}}		To add all newly created users to groups that may come in handy for desktop usage, you can run the below command as root: {{cmd\|# for u in $(ls /home); do for g in disk lp input audio cdrom dialout video netdev games users; do addgroup $u $g; done;done}}

	Please pay attention to the groups in above command and proceed only if you want to add all the users in your system to above groups.		Please pay attention to the groups in above command and proceed only if you want to add all the users in your system to above groups.

Line 71:		Line 76:
	=== SSH root login ===		=== SSH root login ===

	For security reasons, '''root account''' is provided with local log-in access only and [[Setting_up_a_SSH_server\|SSH]] login is disabled by default. To change this, edit the file {{Path\|/etc/ssh/sshd_config}} and add ~~'''~~PermitRootLogin yes~~'''.~~ [[OpenRC\|Restart]] the {{ic\|sshd service}} for the change to take effect immediately.		For security reasons, '''root account''' is provided with local log-in access only and [[Setting_up_a_SSH_server\|SSH]] login is disabled by default.

			To change this default setting, edit the file {{Path\|/etc/ssh/sshd_config}} and add an entry as follows:{{Cat\|/etc/ssh/sshd_config\|...
			PermitRootLogin yes
			}}

			[[OpenRC\|Restart]] the {{ic\|sshd service}} for the change to take effect immediately.

	== Securing root account ==		== Securing root account ==

Prabuanand: moved doas-sudo-shim to note

2025-07-27T04:47:29Z

moved doas-sudo-shim to note

← Older revision		Revision as of 04:47, 27 July 2025
Line 94:		Line 94:

	=== sudo ===		=== sudo ===
	{{Note\| Sudo has been deprecated in favour of [[#doas\|doas]] in Alpine Linux since [[Release_Notes_for_Alpine_3.15.0#Move_from_sudo_to_doas\|v3.15.0]]}}		{{Note\| Sudo has been deprecated in favour of [[#doas\|doas]] in Alpine Linux since [[Release_Notes_for_Alpine_3.15.0#Move_from_sudo_to_doas\|v3.15.0]]. Consider using {{pkg\|doas-sudo-shim}}, as it provides a shim for the sudo command that utilizes doas.}}
	Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. The {{pkg\|doas-sudo-shim}} package provides a shim for the sudo command that that utilizes doas, but supports only a subset of the sudo options (both short and long variants) that have an equivalent in doas, plus option -i (--login).		Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.

	Sudo may be used as follows:{{Cmd\|<nowiki># apk add sudo		Sudo may be used as follows:{{Cmd\|<nowiki># apk add sudo

Prabuanand: moved doas-sudo-shim to sudo section

2025-07-27T04:34:10Z

moved doas-sudo-shim to sudo section

← Older revision		Revision as of 04:34, 27 July 2025
Line 92:		Line 92:

	To allow the members of the [[#Wheel group\|wheel]] group to use root privileges with {{ic\|doas}} command, a config file {{Path\|/etc/doas.d/20-wheel.conf}} can be created as follows: {{Cat\|/etc/doas.d/20-wheel.conf\|<nowiki>permit persist :wheel</nowiki>}}		To allow the members of the [[#Wheel group\|wheel]] group to use root privileges with {{ic\|doas}} command, a config file {{Path\|/etc/doas.d/20-wheel.conf}} can be created as follows: {{Cat\|/etc/doas.d/20-wheel.conf\|<nowiki>permit persist :wheel</nowiki>}}

	For users used to {{ic\|sudo}} command, {{pkg\|doas-sudo-shim}} package provides a shim for the sudo command that that utilizes doas. It supports only a subset of the sudo options (both short and long variants) that have an equivalent in doas, plus option -i (--login).

	=== sudo ===		=== sudo ===
	{{Note\| Sudo has been deprecated in favour of [[#doas\|doas]] in Alpine Linux since [[Release_Notes_for_Alpine_3.15.0#Move_from_sudo_to_doas\|v3.15.0]]}}		{{Note\| Sudo has been deprecated in favour of [[#doas\|doas]] in Alpine Linux since [[Release_Notes_for_Alpine_3.15.0#Move_from_sudo_to_doas\|v3.15.0]]}}
	Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. The {{pkg\|sudo}} package is a ~~much larger package than its alternative~~ i~~.e {{pkg\|doas}}~~.		Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. The {{pkg\|doas-sudo-shim}} package provides a shim for the sudo command that that utilizes doas, but supports only a subset of the sudo options (both short and long variants) that have an equivalent in doas, plus option -i (--login).

	Sudo may be used as follows:{{Cmd\|<nowiki># apk add sudo		Sudo may be used as follows:{{Cmd\|<nowiki># apk add sudo

← Older revision		Revision as of 04:34, 27 July 2025
Line 92:		Line 92:

	To allow the members of the [[#Wheel group\|wheel]] group to use root privileges with {{ic\|doas}} command, a config file {{Path\|/etc/doas.d/20-wheel.conf}} can be created as follows: {{Cat\|/etc/doas.d/20-wheel.conf\|<nowiki>permit persist :wheel</nowiki>}}		To allow the members of the [[#Wheel group\|wheel]] group to use root privileges with {{ic\|doas}} command, a config file {{Path\|/etc/doas.d/20-wheel.conf}} can be created as follows: {{Cat\|/etc/doas.d/20-wheel.conf\|<nowiki>permit persist :wheel</nowiki>}}

	For users used to {{ic\|sudo}} command, {{pkg\|doas-sudo-shim}} package provides a shim for the sudo command that that utilizes doas. It supports only a subset of the sudo options (both short and long variants) that have an equivalent in doas, plus option -i (--login).

	=== sudo ===		=== sudo ===
	{{Note\| Sudo has been deprecated in favour of [[#doas\|doas]] in Alpine Linux since [[Release_Notes_for_Alpine_3.15.0#Move_from_sudo_to_doas\|v3.15.0]]}}		{{Note\| Sudo has been deprecated in favour of [[#doas\|doas]] in Alpine Linux since [[Release_Notes_for_Alpine_3.15.0#Move_from_sudo_to_doas\|v3.15.0]]}}
	Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. The {{pkg\|sudo}} package is a ~~much larger package than its alternative~~ i~~.e {{pkg\|doas}}~~.		Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments. The {{pkg\|doas-sudo-shim}} package provides a shim for the sudo command that that utilizes doas, but supports only a subset of the sudo options (both short and long variants) that have an equivalent in doas, plus option -i (--login).

	Sudo may be used as follows:{{Cmd\|<nowiki># apk add sudo		Sudo may be used as follows:{{Cmd\|<nowiki># apk add sudo