Learn DragonFlyBSD - Users, Groups & doas

#Introduction

In episode 4 you mastered package management with pkg and DPorts. Now we turn to who gets to use the system. In the Unix world, identity is everything: every process runs as a particular user, every file has an owner, and every privileged access goes through a privilege mechanism. Managing identity badly means managing security badly.

Think of the operating system as an office building. There's a receptionist (a regular user) who may enter the lobby, and managers with keys to the server room (root). This episode teaches you how to issue identity cards (users), arrange departments (groups), and create special doors for those allowed into restricted areas (doas, sudo, su).

#Users & Groups

#Creating Users: useradd and adduser

DragonFlyBSD provides two tools for creating users. useradd is a non-interactive tool — ideal for scripting and full control from the command line:

Create a user non-interactively

useradd -m -G wheel,operator -s /bin/sh dewi
passwd dewi

The -m option creates the home directory, -G wheel,operator adds the user to additional groups, and -s /bin/sh sets the default shell. passwd then sets the password.

adduser is an interactive tool with a guided menu — suitable for beginners and manual use. It asks for the username, full name, shell, and groups step by step, then offers to set the password right away.

#Removing Users: userdel

Users are removed with userdel. Use -r to also delete the home directory:

Remove a user along with the home directory

userdel -r dewi

Keep in mind: a user whose processes are still running can't be removed cleanly. Make sure the user's processes are stopped before userdel — or use pkill -u dewi first.

#Managing Groups: groupadd

Groups bring users together to share file access rights and privileges. Creating a new group:

Create a group and add members

groupadd developers
pw group mod developers -m dewi,raka

To see group membership and the list of all groups, read /etc/group:

View the group list

cat /etc/group
id dewi

id dewi shows the UID, GID, and all the groups dewi belongs to.

#Understanding /etc/passwd and /etc/group

These two files are the classic Unix identity "database". /etc/passwd holds one line per user, with fields separated by colons:

Field	Example	Description
Username	`dewi`	Login name
Password	`*`	Password hash (in /etc/master.passwd)
UID	`1001`	Numeric user ID
GID	`100`	Primary group ID
Gecos	`Dewi Lestari`	Full name and extra info
Home	`/home/dewi`	Home directory
Shell	`/bin/sh`	Login shell

Meanwhile /etc/group maps group names to GIDs and member lists. Understanding the format of these two files helps you read errors, troubleshoot login problems, and validate user management tools.

Info

The real password isn't stored in /etc/passwd, which everyone can read — it lives in /etc/master.passwd, readable only by root. The * in /etc/passwd is a placeholder indicating the hash is stored elsewhere.

#Privilege: su, doas, and sudo

#Becoming Another User with su

su is the classic way to switch identity. su - dewi logs in as dewi with a full login environment; su without arguments becomes root if you have the root password:

Switch to another user and back

su - dewi
exit

#doas: Simple and Minimal

doas is OpenBSD's privilege tool, also available on DragonFlyBSD. It's known for a configuration that's far simpler than sudo. Install it with pkg, then write your rules in /etc/doas.conf:

Install doas and set up its configuration

pkg install doas

plaintext

# /etc/doas.conf
permit persist :wheel
permit dewi as root

The first line lets every member of the wheel group run commands as root with a persistent session (no repeated password prompts). The second line grants a specific permission to user dewi. After that:

Run a command as root

doas pkg upgrade

The beauty of doas is its simplicity — one file, a few lines, easy to audit. For personal servers and small teams, it's often the best choice.

#sudo: Full-Featured

If you need granular control — per-command options, audit trails, aliases, and more — use sudo:

Install sudo

pkg install sudo

The sudo configuration lives in /etc/sudoers and must be edited via visudo to prevent syntax errors that would kill access:

Edit sudoers with visudo

visudo

Inside it, the line dewi ALL=(ALL) ALL gives dewi full rights, while dewi ALL=(ALL) NOPASSWD: /sbin/shutdown only allows specific commands without a password.

#The wheel Group: The Privilege Key

On BSD, membership in the wheel group traditionally determines who may su to root. That means putting a user in the wheel group is a serious security decision — not just a formality. In episode 13 we'll combine this with SSH hardening: there, remote login as root will be disabled, and access will only go through a wheel user with doas.

Warning

The principle of least privilege applies strictly: give users only the privileges they need. Don't put everyone in wheel, and use a regular user for day-to-day tasks — not root. Root is an emergency tool, not a work seat.

#Closing

In this episode 5 you learned DragonFlyBSD identity management: creating users with useradd and adduser, removing them with userdel, managing groups with groupadd, understanding the structure of /etc/passwd and /etc/group, and setting up privileges with su, doas, and sudo — including the role of the wheel group as the key to root access.

Key takeaways:

useradd -m -G wheel dewi followed by passwd dewi is the basic user creation pattern; userdel -r for removal.
/etc/passwd and /etc/group are identity databases you must understand.
doas offers simple privileges: one line permit persist :wheel in /etc/doas.conf.
sudo gives granular control; edit /etc/sudoers only through visudo.
wheel group membership is the key to root privileges — grant it sparingly.

In the next episode, episode 6, we'll set up system services & the rc system: dissecting /etc/rc.conf, /etc/defaults/rc.conf, the scripts in /etc/rc.d/, the service command, and rcorder, then learning to enable and disable services properly.