Server User Permission Management

Why Permission Management Matters

Giving root access to every user on a server is a security disaster. The Principle of Least Privilege states: each user gets only the permissions needed to perform their job — nothing more. Applying this principle protects your server from human errors and breaches.

Understanding Linux Permission System

Users and Groups

Every file in Linux has three permission levels:

# View file permissions
ls -la /var/www/app/

# Output:
# -rw-r--r-- 1 www-data www-data 1234 Jan 15 index.php
# │││ │││ │││
# │││ │││ └── Others
# │││ └──── Group
# └────── Owner

Symbol	On File	On Directory
r (4)	Read contents	List directory contents
w (2)	Modify contents	Create/delete files inside
x (1)	Execute as program	Enter the directory

Creating and Managing Users

Create a New User

# Create user with home directory
sudo useradd -m -s /bin/bash developer1

# Set password
sudo passwd developer1

# Create user with specific groups
sudo useradd -m -s /bin/bash -G www-data,developers developer2

Manage Groups

# Create groups
sudo groupadd developers
sudo groupadd devops

# Add user to group
sudo usermod -aG developers developer1
sudo usermod -aG devops developer1

# View user's groups
groups developer1

# View group members
getent group developers

Delete a User

# Delete user with home directory
sudo userdel -r developer1

# Lock a user account (without deleting)
sudo usermod -L developer1

# Unlock
sudo usermod -U developer1

Setting File Permissions

Basic Commands

# Change owner
sudo chown www-data:www-data /var/www/app/ -R

# Change permissions with numbers
sudo chmod 755 /var/www/app/
sudo chmod 644 /var/www/app/index.php

# Change permissions with symbols
sudo chmod u+x script.sh # Add execute for owner
sudo chmod g+w file.txt # Add write for group
sudo chmod o-r file.txt # Remove read from others

Common Permissions for Web Applications

# Laravel / PHP Application
sudo chown -R www-data:developers /var/www/app

# Directories: 775 (owner and group full access)
sudo find /var/www/app -type d -exec chmod 775 {} \;

# Files: 664 (read/write for owner and group)
sudo find /var/www/app -type f -exec chmod 664 {} \;

# Storage and cache directories
sudo chmod -R 775 /var/www/app/storage
sudo chmod -R 775 /var/www/app/bootstrap/cache

# Environment file (sensitive — owner only)
sudo chmod 600 /var/www/app/.env

Configuring sudo

The sudoers File

# Edit sudoers file (always use visudo — never edit directly)
sudo visudo

Rule Examples

# Full sudo access
developer1 ALL=(ALL:ALL) ALL

# Sudo without password (for automation)
deploy ALL=(ALL) NOPASSWD: ALL

# Specific commands only
developer2 ALL=(ALL) /usr/bin/systemctl restart nginx, /usr/bin/systemctl restart php8.3-fpm

# Entire group gets sudo
%devops ALL=(ALL:ALL) ALL

# Group with specific permissions
%developers ALL=(ALL) /usr/bin/git pull, /usr/bin/composer install

Separate Permission Files

# Create a file per role instead of editing sudoers directly
sudo visudo -f /etc/sudoers.d/developers
# Content:
%developers ALL=(www-data) /usr/bin/php artisan *

sudo visudo -f /etc/sudoers.d/devops
# Content:
%devops ALL=(ALL) NOPASSWD: /usr/bin/systemctl, /usr/bin/docker

SSH Configuration Per User

# Generate SSH keys for user
sudo -u developer1 ssh-keygen -t ed25519

# Add public key for user
sudo mkdir -p /home/developer1/.ssh
sudo nano /home/developer1/.ssh/authorized_keys
# Paste public key here

# Set permissions
sudo chmod 700 /home/developer1/.ssh
sudo chmod 600 /home/developer1/.ssh/authorized_keys
sudo chown -R developer1:developer1 /home/developer1/.ssh

Restrict SSH in sshd Configuration

# File: /etc/ssh/sshd_config

# Allow specific users only
AllowUsers admin developer1 developer2

# Or allow a group
AllowGroups devops developers

# Prevent root SSH login
PermitRootLogin no

# Force key-based authentication (no passwords)
PasswordAuthentication no

sudo systemctl restart sshd

Permission Structure Template

Role	User	Groups	sudo Permissions	SSH Access
Sysadmin	admin	devops, sudo	Full	SSH key
Lead Dev	dev-lead	developers, www-data	nginx, php, git, composer	SSH key
Developer	developer	developers, www-data	git, composer only	SSH key
Auto Deploy	deploy	www-data	Deploy commands only	SSH key (no password)
Backup	backup	backup	mysqldump only	SSH key (restricted)

Permission Auditing

# File: /opt/scripts/audit-permissions.sh
#!/bin/bash

echo "=== Users with sudo access ==="
grep -E '^[^#].*ALL' /etc/sudoers /etc/sudoers.d/* 2>/dev/null

echo ""
echo "=== Files with SUID bit ==="
find / -perm -4000 -type f 2>/dev/null

echo ""
echo "=== World-writable files ==="
find /var/www -perm -o+w -type f 2>/dev/null

echo ""
echo "=== Last 10 logins ==="
last -10

CLOUD Servers and Permissions

CLOUD (cloud.net.sa) servers come with full root access via SSH. From there, you build a secure permission structure — create users with specific permissions and disable direct root login. CLOUD provides KVM-based VPS instances that are fully isolated — what happens inside your server stays inside your server.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.