Learn NetBSD - Users, Groups & Privileges

#Introduction

In episode 4 we filled the system with software via pkgsrc and pkg_add. But a good system isn't run as root all the time — it needs structured inhabitants. In this episode we'll set up users, groups, and privileges on NetBSD: creating accounts, dividing users into groups, and limiting administrative access with su, doas, and sudo.

#Users and Groups: Basic Concepts

On NetBSD, every process runs on behalf of a user (identity) and one or more groups (collectives). Users and groups are defined in two text files:

File	Contents
`/etc/passwd`	List of users: username, UID, GID, home, shell
`/etc/group`	List of groups: name, GID, members

You can read both directly:

Reading the user and group definitions

cat /etc/passwd
cat /etc/group

Example /etc/passwd lines

root:*:0:0:Charlie &:/root:/bin/sh
bin:*:1:1:Bin:/bin:/sbin/nologin
arman:*:1000:100:Arman Dwi:/home/arman:/bin/ksh

Notice the colon-separated fields: username, password (stored in /etc/master.passwd — /etc/passwd only contains *), UID, GID, GECOS (full name), home directory, and shell. This is the classic UNIX structure NetBSD inherited.

Warning

Never edit /etc/passwd manually to change passwords. Passwords are stored in the protected /etc/master.passwd file and must be changed via passwd or chpass. Editing the wrong file can make the system unable to log in.

#Creating Users: useradd

The useradd command creates a user in one line and automatically updates /etc/passwd, /etc/master.passwd, and /etc/group:

Creating a new user with a home directory

useradd -m -s /bin/ksh -G wheel,oper -c "Arman Dwi" arman

Example output

arman

Explanation of the commonly used options:

Option	Function
`-m`	Creates the home directory (`/home/arman`)
`-s`	Sets the login shell (e.g. `/bin/ksh`)
`-G`	Adds to additional groups (comma-separated)
`-c`	Comment/GECOS: the user's full name

After the user is created, set a password with passwd:

Setting a user's password

passwd arman

The interactive alternative is adduser, which guides you through creating a user step by step — convenient for beginners:

Interactive user creation

adduser

#Removing Users: userdel

To remove a user, use userdel. The -r option also removes the home directory and mail spool:

Removing a user along with their home directory

userdel -r arman

Before deleting, make sure no processes are running under that user. Use ps -u arman to check.

#Managing Groups: groupadd, groupdel, groupmod

Groups are created with groupadd, modified with groupmod, and removed with groupdel. Here's an example of creating a group for a developer team and adding members:

Creating a group and adding members

groupadd devteam
groupmod -A arman,budi devteam

Check the contents of /etc/group

devteam:*:100:arman,budi

Another way to add a user to groups is with usermod -G:

Adding a user to several groups at once

usermod -G wheel,devteam,oper arman

#Privileges: Limiting Root Power

Once users and groups are in place, the question is: how do you grant administrative access without sharing the root password? Three common answers on NetBSD: su, doas, and sudo.

#wheel: The Key Group

NetBSD follows the BSD tradition: only members of the wheel group may su to root. This is the first security layer — not everyone can become root just by knowing the password.

#su: User Switcher

su switches to another user. From a wheel member, su to root by entering the root password:

Switching to root from a wheel account

su - root

Prompt after su

Password:
# whoami
root

#doas: Simple and Secure

doas is a modern lightweight tool — your pick if you want minimalism. It's available as a pkgsrc package:

Install doas from pkgsrc

cd /usr/pkgsrc/security/doas
make install clean

The doas configuration is written in /etc/doas.conf. Grant full access to wheel members:

Contents of /etc/doas.conf

permit keepenv :wheel

After that, wheel members just type:

Running a command as root with doas

doas sysctl kern.ostype

#sudo: Flexible and Complete

sudo gives finer control — it can restrict commands per user, per host, and log every execution. Install from pkgsrc:

Install sudo from pkgsrc

cd /usr/pkgsrc/security/sudo
make install clean

Configure it in /usr/pkg/etc/sudoers with visudo (never edit it directly):

Editing sudoers with visudo

visudo

A line in /etc/... sudoers

%wheel ALL=(ALL:ALL) ALL

With that line, all members of wheel can run any command as root with sudo. To restrict specific commands (e.g. only restarting services):

Example command restriction in sudoers

arman ALL=(ALL) /usr/sbin/service

#Quick Comparison

Tool	Basis	Strengths	Weaknesses
`su`	Built into the base system	Always available	Needs the root password
`doas`	pkgsrc package	Simple, lightweight config	Limited features
`sudo`	pkgsrc package	Command control, audit log	More complex config

#Best Practices

Rule	Reason
Don't log in as root directly	A single mistake is enough to break the system
Limit `wheel` members	Only those who genuinely need admin access
Use `doas`/`sudo` and log activity	Audit and accountability
Use separate users for services	Principle of least privilege

#Closing

In this episode 5, you've managed NetBSD users and groups with useradd, userdel, groupadd, and usermod, understood the structure of /etc/passwd and /etc/group, and limited root access with su, doas, and sudo — with the wheel group as the gateway.

Key takeaways:

Users are defined in /etc/passwd, groups in /etc/group; change passwords via passwd, not by hand-editing files.
useradd -m -s /bin/ksh -G wheel arman creates a complete account with a home directory.
Only members of the wheel group can su to root.
doas for a lightweight solution (permit keepenv :wheel), sudo for granular command control.
Apply least privilege: root only for things that truly need root.

In the next episode, episode 6, we'll bring the service machinery to life: system services and the rc system — understanding /etc/rc.conf, the scripts in /etc/rc.d, the service command, and how rcorder determines the boot order. See you in episode 6!