# View current user -- the identity your shell session is running as
whoami

# View all users on the system
# Each line follows the format: username:password:UID:GID:comment:home:shell
# The password field shows 'x' because actual hashes live in /etc/shadow
cat /etc/passwd

# Add a new user (creates home directory, sets default shell)
# adduser is the interactive, user-friendly wrapper around useradd
sudo adduser username

# useradd is the low-level tool -- you must specify options manually
# Use this in scripts where you need precise control
sudo useradd -m -s /bin/bash -G docker,sudo username

# Delete user and optionally their home directory
sudo deluser username
sudo deluser --remove-home username  # Also removes /home/username

# Switch to another user's session (the dash loads their environment)
su - username
# Without the dash, you keep your own environment variables -- a common gotcha
su username

# Switch to root (use sparingly -- prefer sudo for individual commands)
sudo su

# See which groups your user belongs to
groups

# See groups for a specific user
groups username

# Create a new group
sudo groupadd developers

# Add a user to a group (-a means append, without it you REPLACE all groups)
sudo usermod -aG developers username

# Remove a user from a group
sudo gpasswd -d username developers

# View group membership details
cat /etc/group

# View permissions with ls -l
ls -l
# Example output:
# -rw-r--r-- 1 alice developers 4096 Mar 15 10:00 report.txt
#  │││ │││ │││  │  │      │        │     │           │
#  │││ │││ │││  │  │      │        │     │           └─ Filename
#  │││ │││ │││  │  │      │        │     └─ Last modified date
#  │││ │││ │││  │  │      │        └─ File size in bytes
#  │││ │││ │││  │  │      └─ Group owner
#  │││ │││ │││  │  └─ User owner
#  │││ │││ │││  └─ Number of hard links
#  │││ │││ └└└─ Others: r-- (read only)
#  │││ └└└───── Group:  r-- (read only)
#  └└└───────── Owner:  rw- (read + write, no execute)

# Numeric (octal) mode -- set all three audiences at once
chmod 755 script.sh   # rwxr-xr-x  Owner: full, Group: read+execute, Others: read+execute
chmod 644 config.txt  # rw-r--r--  Owner: read+write, everyone else: read only
chmod 600 secret.key  # rw-------  Owner only, nobody else can even read it
chmod 700 private/    # rwx------  Only owner can enter this directory

# Symbolic mode -- modify specific permissions without affecting others
chmod u+x script.sh   # Add execute for owner (u=user/owner)
chmod g-w file.txt    # Remove write for group (g=group)
chmod o-r secret.txt  # Remove read for others (o=others)
chmod a+r public.txt  # Add read for all (a=all)

# Change file owner
chown alice file.txt

# Change file owner and group at the same time
chown alice:developers file.txt

# Change recursively for an entire directory tree
chown -R alice:developers project/

# Change only the group (useful when you just need group access)
chgrp developers file.txt

# SUID (Set User ID) -- file runs as the file OWNER, not the user who launched it
# Analogy: A valet key that starts the car as if the owner is driving, even when someone
# else turns the key. This is how /usr/bin/passwd can modify /etc/shadow (owned by root)
# even when run by a normal user -- the binary has SUID set and is owned by root.
chmod u+s /usr/local/bin/special-tool
ls -l /usr/bin/passwd
# -rwsr-xr-x  (notice the 's' in owner execute position -- 's' means SUID + execute)
# If you see 'S' (capital), it means SUID is set but execute is NOT -- usually a mistake

# SGID (Set Group ID) -- on directories, new files inherit the DIRECTORY'S group
# Without SGID, new files inherit the creator's primary group, which breaks shared folders.
# Analogy: A shared team folder where everything automatically gets stamped with the team
# name, regardless of who put it there.
chmod g+s /shared/project/
# Now files created inside inherit the 'project' group automatically
# Without this, Alice's files belong to group 'alice' and Bob cannot read them

# Sticky bit -- on directories, only file OWNERS can delete their own files
# Without sticky bit, anyone with write permission to a directory can delete any file in it.
# Analogy: A shared bulletin board where everyone can post, but only you can remove your own notes.
chmod +t /shared/uploads/
ls -ld /tmp
# drwxrwxrwt  (notice the 't' in others execute position)
# /tmp is the canonical example: world-writable, but you cannot delete other users' temp files

# Run a single command with root privileges
sudo apt update

# Edit the sudoers file safely (validates syntax before saving)
# NEVER edit /etc/sudoers directly with a text editor -- a syntax error locks you out
sudo visudo

# Open a root shell (use this sparingly and exit when done)
sudo -i

# Run a command as a different user (not just root)
sudo -u postgres psql

# Check what sudo permissions you have
sudo -l

# In /etc/sudoers (always edit with visudo):

# Allow user to run all commands as root
username ALL=(ALL:ALL) ALL

# Allow user to restart nginx without a password (common for deploy scripts)
deployer ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx

# Allow an entire group to use sudo
%developers ALL=(ALL:ALL) ALL

# Create a shared directory where the 'developers' group can collaborate
sudo mkdir /opt/project
sudo chown root:developers /opt/project
sudo chmod 2775 /opt/project
# 2 = SGID (new files inherit group), 775 = owner+group full, others read+execute

# Now any developer can create files, and all files belong to the 'developers' group

# SSH is strict about permissions -- it refuses to use keys with lax permissions
chmod 700 ~/.ssh           # Only you can enter the directory
chmod 600 ~/.ssh/id_rsa    # Private key: owner read+write only
chmod 644 ~/.ssh/id_rsa.pub  # Public key: anyone can read
chmod 600 ~/.ssh/authorized_keys  # Controls who can SSH into your account

# Web files owned by deploy user, readable by web server group
sudo chown -R deploy:www-data /var/www/mysite
sudo find /var/www/mysite -type d -exec chmod 755 {} \;  # Directories: enter + list
sudo find /var/www/mysite -type f -exec chmod 644 {} \;  # Files: read only