Managing users, updates and permissions

Whenever more than one person, or more than one device, depends on a computer, somebody has to look after it. That person is the system administrator. In a small family or a small shop it may be you, one evening a month. The work is not magic: it is deciding who may log in, how much they may do, keeping the software current and checking that nobody can see files they should not. This lesson turns the account, update and permission ideas from earlier modules into a routine you can follow.

What a system administrator actually does

Think of a caretaker of a block of flats. The caretaker gives out keys, fixes the lights, checks the locks and keeps a list of who lives where. A system administrator does the same for computers. The job has a few repeating parts: giving each person an account, deciding what that account may do, keeping the software up to date, watching that services are running, and making backups. This lesson covers the first three. The next lesson covers the rest.

Administration is mostly careful, boring routine, and that is good. A computer that is looked after by a short checklist every month is safer than one that is rescued in a panic once a year. Good administrators also write things down, so that a colleague, or you in six months, can see what was decided and why.

Accounts: one person, one account

Every person who uses a computer should have a separate User account. Separate accounts keep each person's files private, make it possible to see who did what, and allow you to remove one person's access without disturbing anybody else. Sharing one login between several people removes all three benefits. It also means a mistake or a stolen password affects everybody.

There are two main kinds of account. A Standard user can use programs and manage their own files, but cannot change the whole system. An Administrator can install software, change system settings and see or change other people's accounts. The safest habit follows the rule of Least privilege: give each account only the power it needs for its job, and no more. Your own everyday account should usually be a standard one, and you should use administrator power only for the moment you need it.

On Ubuntu, the first account made during installation is an administrator, which means it can use sudo to run one command with extra power. On Windows 11, the first account made is also an administrator by default, and Windows asks for confirmation (called User Account Control) before an administrator-level change. In both systems, a careful household might keep one administrator account for setting things up and standard accounts for daily use.

id
groups

uid=1000(amina) gid=1000(amina) groups=1000(amina),4(adm),27(sudo),100(users)
amina adm sudo users

Get-LocalUser
whoami /groups

When people arrive, change jobs or leave

Accounts need a life cycle. When someone arrives, you create an account with the least power that lets them do the job. When their job changes, you adjust the account instead of adding extra power on top. When they leave, you disable or remove the account on the same day, and you move any files that the business still needs. Old accounts that nobody uses are a common weakness, because nobody notices if a stranger starts using them.

Updates: write the policy down

An Update replaces software with a newer version. Many updates are security patches: they fix weaknesses that attackers already know about. Not updating is like leaving a known broken lock on your door. On the other hand, an update can occasionally cause a new problem, so a careful administrator has a short update policy. A policy is a written rule that answers four questions: what gets updated, how often, who checks that it worked, and what happens if something goes wrong.

apt list --upgradable
tail -n 20 /var/log/apt/history.log

Permissions in practice

An account only matters if the files and folders behind it are protected. A Permission says who may read, write or run a file. On Linux the Permission string shown by ls -l has three groups of three letters: for the owner, for the group and for everybody else. The letters are r for read, w for write and x for run. A dash means that permission is missing. The rule of least privilege applies here too: a private note should not be readable by every user of the computer.

The command chmod changes permissions. In chmod o-rwx notes.txt, o means others, the minus sign means remove, and rwx names the three permissions removed. So the command removes every permission from everybody who is not the owner or in the file's group. Always run permission commands on named files in your practice folder, and never on whole system folders.

On Windows, permissions are set on a file or folder through Properties, then the Security tab. This lists users and groups and the permissions each has, such as Read or Modify. Look and read first. Change settings only on your own practice folder, because wrong changes to system folders can stop Windows from working.