Learn Alpine Linux - Users, Groups & Privileges

#Introduction

Every multi-user system needs identity management, and Alpine provides it in a simple way. Episode 6 covers users and groups with adduser, addgroup, and deluser, then moves into the topic that most often surprises newcomers: doas as a sudo replacement.

When the setup-alpine wizard created the admin user in episode 3, it automatically set up the access-rights configuration. This episode explains what actually happened behind the scenes and how to manage it yourself.

#Creating and Deleting Users

#adduser and deluser

Alpine uses BusyBox's adduser (not Debian's adduser). The basic syntax:

adduser arman
adduser -s /bin/bash -h /home/arman arman
adduser -G wheel arman
deluser arman
deluser arman --remove-home

Explanation:

• adduser arman creates an interactive user with a home in /home.
• -s sets the shell, -h sets the home directory.
• -G wheel adds the user to the wheel group.
• deluser --remove-home removes the user along with their home.

Users created via setup-alpine in episode 3 are automatically placed in the wheel group, so they can get administrative privileges.

#addgroup and delgroup

Groups are managed in a similar way:

addgroup developers
addgroup arman developers
delgroup developers

adduser arman developers adds an existing user to a new group. To view membership, read the /etc/group file.

#Reading /etc/passwd and /etc/group

#The Format of Two Important Files

The /etc/passwd file stores user accounts, one line per user:

root:x:0:0:root:/root:/bin/ash
arman:x:1000:1000:arman:/home/arman:/bin/ash

The columns are username, password (x means it's stored in /etc/shadow), UID, GID, description, home, and shell. Note that Alpine's default shell is /bin/ash — the BusyBox shell.

The /etc/group file stores groups:

wheel:x:10:root,arman
developers:x:1001:arman

The columns are group name, password, GID, and member list. When troubleshooting file permissions, check the UID in /etc/passwd and the GID in /etc/group:

cat /etc/passwd
cat /etc/group
id arman

The id arman output shows the UID, GID, and all the groups the user belongs to.

#doas versus sudo

#Why Alpine Uses doas

Alpine uses doas as its default privilege elevation tool — not sudo. doas comes from OpenBSD: it's much smaller, uses a single configuration file, and has a smaller attack surface. Users created by setup-alpine automatically get a doas configuration.

The doas configuration lives at /etc/doas.d/doas.conf:

permit persist :wheel

The permit persist :wheel line lets all members of the wheel group run commands as root without being asked for the password repeatedly (thanks to persist). Use doas for admin commands:

doas apk update
doas -u arman whoami

doas -u arman whoami runs a command as another user. doas's default behavior asks for the password of the currently active user, not the root password.

#If You Still Want sudo

Even though doas is the default, sudo is still available in the community repository:

apk add sudo
adduser -G wheel arman
vi /etc/sudoers.d/arman

Just run apk add sudo if your project needs compatibility with scripts that expect sudo. But for fresh installs, doas is the choice that fits Alpine's philosophy better.

#The wheel Group and Privilege Policy

#Designing Access Privileges

The wheel group is the door to administrative privileges. A good policy:

• Only trusted users should be in the wheel group.
• Direct root access via SSH should be disabled (covered in episode 9).
• Manage groups by function, for example developers for the app team and docker for container users.

Manage wheel membership carefully:

adduser -G wheel arman
deluser arman wheel

deluser arman wheel removes arman from the wheel group, which also revokes their doas privileges.

#Closing

Episode 6 covered user and group management in Alpine: creating users with adduser, managing groups with addgroup and delgroup, reading /etc/passwd and /etc/group, configuring doas in /etc/doas.d, and leveraging the wheel group for administrative privileges.

Key takeaways:

• adduser, addgroup, deluser, and delgroup are the identity management tools.
• /etc/passwd stores accounts; /etc/group stores groups and members.
• doas is Alpine's default elevation tool, not sudo.
• /etc/doas.d/doas.conf holds rules like permit persist :wheel.
• The wheel group is the door to administrative privileges.
• sudo is available in community if you truly need it.

In the next episode, episode 7, we'll cover basic networking and the filesystem — OpenRC-style /etc/network/interfaces configuration, the ifup, ifdown, and ip commands, DNS setup in /etc/resolv.conf, and the filesystem layout, /etc/fstab, and support for ext4, btrfs, and xfs.