Setting up a new user

This page shows how to create non-privileged user accounts. i.e. those used for daily work, including desktop use and remote logins, and how to grant admin access to such accounts if needed.
== Overview ==
Creating user accounts provides users with their own directory and allows you (the root user) to limit the access those user accounts have to the operating system configuration files.
Using them increases security, because they limit possible actions and thus possible damage (even from accidental errors).
=== Creating a new user ===
The root account should be used only for local administrative purposes that require elevated access permissions. Regular or non-privileged user accounts can be created in two ways:
=== setup-user ===
The setup-user script allows quick and simple setup of user accounts. To create a regular user account using the above script:
 
User will be prompted for options. This script uses adduser in the backend.
=== adduser ===
By default, adduser will:
* prompt you to set a password for the new user
* create a home directory in 
* set the shell to the one used by the root account (ash by default)
* assign user ID and group ID starting at 1000
* set the GECOS (full name) field to "Linux User,,,"
Usage (from "man busybox"):
<nowiki>adduser [OPTIONS] USER [GROUP]
Create new user, or add USER to GROUP
 -h --home DIR Home directory
 -g --gecos GECOS GECOS field
 -s --shell SHELL Login shell named SHELL by example /bin/bash
 -G --ingroup GRP Group (by name)
 -S --system Create a system user
 -D --disabled-password Don't assign a password, so cannot login
 -H --no-create-home Don't create home directory
 -u --uid UID User id
 -k SKEL Skeleton directory (/etc/skel)
</nowiki>
The new user gets listed at the last line:
Now you should be able to issue the command exit and login to the newly created account.
== Group management ==
To see what group(s) you belong to, use the following command:
To add your user to a group (for e.g seat) you can use the following commands:
The above command is a variation of adduser.
To add your user to a group you can also use the following command:
Usage (from "man busybox"): 
<nowiki>addgroup [-g GID] [-S] [USER] GROUP
Create a group or add a user to a group
 -g --gid GID Group id
 -S --system Create a system group
</nowiki>
== Admin user ==
If a user really must be allowed to have access to the root account, the <username> must be added to the wheel group. Also ensure that doas is available.
=== wheel group ===
The setup-user script allows quick and simple setup of admin user accounts. To Create a new user as admin user, using the above script:
 
The above command will create an admin user, by adding the user to wheel group and installs , if not already installed.
To add an existing user as admin user:
 
After adding the user as to wheel group using adduser, remember to install and configure doas, if not already done. 
=== doas ===
The doas command provides a way to perform commands as another user. It aims to be a simplified and lightweight replacement for sudo. As mentioned earlier, the setup-user script automatically installs package.
You will want to allow members of the wheel group to use root privileges with doas. To do this, your doas config file should be as follows:
=== sudo ===
Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.
The sudo package is an alternative to using the BSD-like doas, but is a much larger package.
It may be used as follows: adding a custom user configuration file to avoid having to deal with manually changing configuration files later during package upgrades.
== Securing root account ==
It's recommended to not run complete applications, like editors, as root just to modify administrative files.
* Use doasedit from available in the testing repository. It can be safely installed by following the guidelines. 
* If using sudo, use sudoedit.
These tools enables starting an editor with a temporary copy of a file, which overwrites the original file after the user modifies and saves it. For example, doasedit /etc/apk/lbu.conf
* Many desktop environments and file browsers support using admin:/// in their address bars, to access files through a local gvfs-admin mount.
Once doas or sudo is properly configured and tested thoroughly, root account can be disabled by locking it.
To lock the root account you need to log into your root account and then lock it using the passwd command: 
== Home directory permissions ==
`adduser` creates home directories with permissions `rwxr-sr-x`. This makes the directory readable by all other users on the system. If you prefer to not allow other users to read your home directory, the permissions can be changed:
 
== Persistent Home directory ==
If using a "diskless" or "data" disk mode installation, it's important to make the /home directory persistent:
* Either the /home filesystem needs to be mounted from a writable partition, or
* the /home directories have to be added to the lbu backup, and a new local backup needs to be committed after creating the user:
 (Not recommended, as reverting to an older .apkovl will also revert the files in /home).
== Common permission groups ==
The following groups are needed for certain operations on your system. The group names were taken from https://git.alpinelinux.org/alpine-baselayout/tree/group
== Desktop usage ==
If setup-desktop is used to install your desktop environment elogind is up and running automatically. If you installed your desktop manually and facing difficulties in using desktop or if seatd is used, then users that want a graphical environment need to be added to the video and seat groups. 
Refer to understand about the security concerns regarding the video group. 
To add newly created users to groups that may come in handy for desktop usage, you can run the below command as root:
Please pay attention to the groups in above command and proceed only if you want to add all the users in your system to above groups.
== See also ==
* Users and groups - Archwiki
* SystemGroups
Category: System_Administration
Category: Security