The root account should only be used for local administrative purposes that require its elevated access permissions.

This page shows the creation of regular user accounts, that may be used for the daily work, including desktop usage and remote logins.

Overview

Creating user accounts provides the users their own $HOME directory and allows you (the root administrator) to limit the access that these user accounts have to the operating system's configuration.

Using them increases the security, because they limit possible actions and thus the possible damage (even from accidental errors).

Creating a new user

Note: If using a "diskless" or "data" disk mode installation, either

the /home filesystem needs to be mounted from a writable partition, or
the /home directories have to be added to the lbu backup, and a new local backup needs to be committed after creating the user:

# lbu include /home # lbu commit

Regular user accounts can be created with:

# adduser [-d "<Full Name>"] <username>

By default, adduser will:

prompt to set a password for the new user.
create a home directory in /home/<username>
set the shell to the one used by the root account (ash by default)
assign user ID and group ID at 1000+
set the GECOS (full name) field to "Linux User,,,".

Tip: The optional -d "<Full Name>" above sets the GECOS field.

This can be very useful to specify. Setting this string --at least equal to the username-- makes the users distinguishable, e.g. when they are listed at the login screen of a display manager.

If a user really must be allowed to have access to the root account, the <username> can be added to the wheel group, doas ("do as") may be installed, and the group "wheel" be allowed to become root:

adduser -d "<username>" <username>
adduser <username> wheel
apk add doas
apk add nano
nano /etc/doas.conf

Warning: Do not run complete applications like editors as root, just to modify administrative files!

Many desktop environments and file browsers support using admin:/// in their address bars, to access files through a local gvfs-admin mount.
And doasedit or sudoedit allow to start an editor for a temporary copy, which overwrites the original file after the user modified and closed it. For example, sudoedit /etc/apk/lbu.conf

The sudo package is an alternative to using the BSD-like doas, but is a much larger package. It may be used as follows, adding a custom user configuration file.

apk add sudo
NEWUSER='yourUserName'
adduser -d "${NEWUSER}" $NEWUSER
echo "$NEWUSER ALL=(ALL) ALL" > /etc/sudoers.d/$NEWUSER && chmod 0440 /etc/sudoers.d/$NEWUSER

The new user gets listed in

Contents of /etc/passwd

root:x:0:0:root:/root:/bin/ash
.
.
.
<username>:x:1000:1000:Linux User,,,:/home/<username>:/bin/ash

And it's now possible to exit and login to the new account.

Options

adduser

Usage (from "man busybox"):

adduser [OPTIONS] USER [GROUP]

Create new user, or add USER to GROUP

     -h --home DIR           Home directory
     -g --gecos GECOS        GECOS field
     -s --shell SHELL        Login shell named SHELL by example /bin/bash
     -G --ingroup GRP        Group (by name)
     -S --system             Create a system user
     -D --disabled-password  Don't assign a password so cannot login in
     -H --no-create-home     Don't create home directory
     -u --uid UID            User id
     -k SKEL                 Skeleton directory (/etc/skel)

Tip: Multi-user collaboration

If --ingroup isn't set (default) the new user is assigned a new GID that matches the UID. And if the GID corresponding to a provided UID already exists, adduser will fail.

This ensures new users default to having a "user's private group" (UPG) as primary group. These allow the system to use a permissive umask (002), with which new files are automatically created group-writable but to just the user's private group. And which allows that in special set-group-id group (collaboration) directories, new files can automatically be created writable by the directory's group.

addgroup

Usage (from "man busybox"):

addgroup [-g GID] [-S] [USER] GROUP

Create a group or add a user to a group

    -g --gid GID    Group id
    -s --system     Create a system group

Legacy

Common permission groups

(Taken from https://git.alpinelinux.org/alpine-baselayout/tree/group)

disk:x:6:root,adm Only if need usage vith virtual machines and access to other partitions over new disks for
lp:x:7:lp IF will need to use printing services and printers management
wheel:x:10:root Administrators group, members can use sudo to run commands as root if enabled in sudo configuration.
floppy:x:11:root Backguard compatible group, use only if need access to external special devices
audio:x:18: Need for audio listening and management of sound volumes as normal user
cdrom:x:19: For access to disck writers and mounting DVD, BR or CD rom disk as normal user
dialout:x:20:root Need for dial private connections and use of modems as normal users
tape:x:26:root Need have into this if plan to use special devices for backup.. rarelly in no servers
video:x:27:root For usage of cameras, mor thant one GPU special features, as normal user
netdev:x:28: For network connections management as normal user
kvm:x:34:kvm Only if as normal user will manage graphically virtual machines.. rarelly on no servers
games:x:35: Need if you want to play games also specially need if will share score between users
cdrw:x:80: To write RW-DVD, RW-BR or RW-CD disk on a disk writing device
apache:x:81: Need if you will perfom development as normal user and want to publish locally on web server
usb:x:85: Need to access to special usb devices, deprecated group
users:x:100:games If you plan to used common files for all users, mandatory as desktop usage

Old newbie notes

Users creation and defaults

So the following commands will first setup root environment login and then assing a new password:

cat > /root/.cshrc << EOF
unsetenv DISPLAY || true
HISTCONTROL=ignoreboth
EOF

cp /root/.cshrc /root/.profile

echo "secret_new_root_password" | chpasswd

The remote management cannot be done with root directly by default, due ssh security, so we need to setup an remote connection account to made "su" once connected.

The most recommended it's having a access user here named "remote" and normal general usage user here named "general" for convenience, in the next commands we will setup a very hardened limited environment for any new user and created those two users:

mkdir -p /etc/skel/

cat > /etc/skel/.logout << EOF
history -c
/bin/rm -f /opt/remote/.mysql_history
/bin/rm -f /opt/remote/.history
/bin/rm -f /opt/remote/.bash_history
EOF

cat > /etc/skel/.cshrc << EOF
set autologout = 30
set prompt = "$ "
set history = 0
set ignoreeof
EOF

cp /etc/skel/.cshrc /etc/skel/.profile

adduser -D --home /opt/remote --shell /bin/ash remote

echo "secret_new_remote_user_password" | chpasswd

adduser -D --shell /bin/bash general

echo "secret_new_general_user_password" | chpasswd

Tip: "general" are the name of the user, that name MUST be only lowercase letters and no spaces with no symbols

Note that those users are created with minimal settings.

Users management and system access

But this user will not have enough privileges for a desktop made purposes, Alpine comes with high security so administrator (the root account owner) must perform the management of that user. Take care, for a server made there's no similar procedure!

Now we can changes some defaults and added to proper groups to access devices or perform connections so, those are the recommended groups where the user must have in:

for u in $(ls /home); do for g in disk lp floppy audio cdrom dialout video netdev games users; do addgroup $u $g; done;done