Learn FreeBSD - Users, Groups & Sudo

#Introduction

In the previous episode 4, you learned how to install software with pkg and ports. Now it's time for the most basic foundation of security: user, group, and privilege management. Without proper account management, your system — no matter how good the firewall is — remains fragile from within.

FreeBSD handles users in a very BSD way: flat files like /etc/passwd and /etc/master.passwd, the consistent pw tool, and a simple group system. This episode covers all of it, then dives into the age-old debate: sudo or doas?

#System Files for Users and Groups

#/etc/passwd and /etc/master.passwd

FreeBSD stores user accounts in two files. /etc/passwd holds data that can be read publicly. /etc/master.passwd holds sensitive data including password hashes, and can only be read by root. Each line represents one user, with columns separated by colons:

Melihat isi /etc/passwd

cat /etc/passwd

The columns include login name, UID, GID, comment, home directory, and shell. Passwords are never stored in /etc/passwd — only in /etc/master.passwd, or in a more modern database via pwd_mkdb.

#/etc/group

Groups are stored in /etc/group with the format name, password (usually *), GID, and member list:

Melihat isi /etc/group

cat /etc/group

The wheel group is very important — its members are allowed to su to root. This group is the administrative gateway on FreeBSD.

Warning

Never edit /etc/passwd or /etc/master.passwd with a regular editor. Inconsistent changes can corrupt the user database. Always use pw or vipw, and let pwd_mkdb update the binary index.

#Managing Users with pw

pw is FreeBSD's primary user management tool. Its syntax is consistent and supports many operations.

#Creating Users

Membuat user baru dengan pw

pw useradd john -c "John Doe" -d /home/john -m -G wheel -s /bin/sh

The command above creates user john, with home directory /home/john, member of the wheel group, and shell /bin/sh. The -m flag ensures the home directory is created as well.

#Removing and Modifying

Menghapus dan memodifikasi user

pw userdel john
pw usermod john -G wheel,www -s /bin/tcsh

pw usermod can change the group, shell, or comment. Verify the result with pw usershow:

Melihat detail user

pw usershow john
pw groupshow wheel

#adduser: The Interactive Alternative

If you prefer an interactive wizard approach, FreeBSD provides adduser:

Menjalankan adduser interaktif

adduser

adduser guides you through account creation with step-by-step questions and stores its presets in /etc/adduser.conf. It's well suited to new users who haven't memorized the pw flags yet.

#Managing Groups

Creating and managing groups is done with pw groupadd and pw groupmod:

Membuat dan mengelola grup

pw groupadd developers
pw groupmod developers -M john,jane
pw groupdel developers

Groups are the file-based permission mechanism. You can control file access by changing the group owner and permissions — a pattern you'll master in episode 7 when we cover the filesystem.

#Privilege Escalation: su, doas, and sudo

#su: Becoming Root

With su, users in the wheel group can become root after entering the root password:

Berpindah ke root dengan su

su -

su - starts a root login shell with a clean environment. The problem is that you need to know the root password — and sharing the root password between admins is a bad habit.

#sudo: Granular Control

sudo lets specific users run specific commands as root, without needing to know the root password. It's installed from pkg:

Menginstal sudo

pkg install sudo

Its configuration lives in /usr/local/etc/sudoers, which must be edited with visudo:

Mengedit sudoers dengan visudo

visudo

Info

Never edit /usr/local/etc/sudoers with a regular editor. visudo validates the syntax before saving — a small mistake in this file can lock you out of admin access.

#doas: The Lightweight OpenBSD-Style Alternative

doas is a modern alternative to sudo, popular because of its short configuration and smaller codebase. Install it and create its config:

Menginstal doas

pkg install doas

Create /usr/local/etc/doas.conf:

Membuat konfigurasi doas

echo "permit persist :wheel" > /usr/local/etc/doas.conf
chmod 0400 /usr/local/etc/doas.conf

After that, wheel members can run root commands with doas:

Memakai doas

doas pkg upgrade

The permit persist :wheel syntax grants the entire wheel group, and persist keeps your credentials cached for a few minutes so you aren't asked for the password repeatedly.

#Choosing Between sudo and doas

Criterion	sudo	doas
Configuration	Complex, granular	Short
Code size	Large	Small
Ecosystem	Very broad	Moderate
Best for	Enterprise, complex policies	Personal servers, simplicity

Success

For most learning labs, doas with a single line permit persist :wheel is more than enough. Move to sudo when your rule needs start getting complex — for example, restricting specific commands for specific users.

#Account Security Best Practices

A few habits you should adopt from the very beginning:

Disable direct root login over SSH; use a user + doas or sudo (details in episode 14).
Limit wheel membership to only the admins who really need it.
Use strong passwords for users, and never share the root password.
Check login activity periodically in /var/log/auth.log or with last:

Memeriksa riwayat login

last
last -f /var/log/utx.lastlogin

#Closing

In this episode 5, you mastered user and group management on FreeBSD: the passwd, master.passwd, and group system files, using pw to create, remove, and modify accounts, and a comparison of su, sudo, and doas for privilege escalation.

Key takeaways:

Use pw, not manual editing, to change user accounts.
wheel is the administrative gateway group for su access.
sudo gives granular control; doas offers simplicity.
Edit sudoers only with visudo; doas.conf must be mode 0400.
Don't share the root password — use personal accounts with privilege escalation.

In the next episode, episode 6, we'll cover system services & the rc system — how FreeBSD manages services from boot to shutdown, the structure of /etc/rc.conf, rc scripts, the service command, and sysrc for managing configuration without manually editing files. This is the heart of your system automation.