# View the current user
whoami
# View user information
id <username>
# Output example: uid=1001(alice) gid=1001(alice) groups=1001(alice),10(wheel)
# View all users (including system users)
cat /etc/passwd
# View logged-in users
who
w
# View recent login records
last

# Change the primary group of a user
usermod -g <groupname> <username>
# Add a user to a supplementary group (-a appends, otherwise the group will be replaced)
usermod -aG wheel <username>
usermod -aG docker <username>
# Change the home directory of a user
usermod -d /new/home -m <username>
# Change the default Shell of a user
usermod -s /bin/zsh <username>
# Change the username (login name)
usermod -l <newname> <oldname>
# Lock a user account (prohibit login)
usermod -L <username>
passwd -l <username>
# Unlock a user account
usermod -U <username>
passwd -u <username>

# Delete a user (keep the home directory)
userdel <username>
# Delete a user and their home directory (use with caution!)
userdel -r <username>

# Set a password
passwd <username>
# Set a password expiration policy
chage -M 90 <username>    # Valid for a maximum of 90 days
chage -l <username>       # View password expiration information
# Force users to change their passwords at next login
passwd --expire <username>
chage -d 0 <username>

# Create a group
groupadd <groupname>
# Create a group with a specified GID
groupadd -g 2000 <groupname>
# Add a user to a group
usermod -aG <groupname> <username>
gpasswd -a <username> <groupname>
# Remove a user from a group
gpasswd -d <username> <groupname>
# View group information
groups <username>
cat /etc/group | grep <groupname>
# Delete a group
groupdel <groupname>

# Add a user to the wheel group (by default, members of the wheel group can use sudo on TencentOS)
usermod -aG wheel <username>
# Verification
su - <username>
sudo whoami   # Outputs root

visudo

# Allow alice to run all commands (password required)
alice   ALL=(ALL)  ALL
# Allow alice to run all commands (no password required, for example, CI/CD accounts)
alice   ALL=(ALL)  NOPASSWD: ALL
# Allow members of the developers group to run all commands
%developers   ALL=(ALL)  ALL
# Allow only specific commands to be run (principle of least privilege)
bob     ALL=(ALL)  /usr/bin/systemctl restart nginx, /usr/bin/systemctl status nginx
# Allow alice to run commands as the mysql user
alice   ALL=(mysql)  /usr/bin/mysqldump

# Create sudo configuration for alice
echo "alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx" > /etc/sudoers.d/alice
chmod 440 /etc/sudoers.d/alice

# Change file permissions
chmod 755 /opt/myapp/start.sh    # rwxr-xr-x
chmod 644 /etc/myapp/config.yaml  # rw-r--r--
# Recursively change directory permissions
chmod -R 755 /opt/myapp/
# Change permissions using symbolic notation
chmod u+x script.sh   # Add execute permission for the owner
chmod go-w file.txt   # Remove write permission for group and others
chmod a+r file.txt    # Add read permission for everyone
# Change owner and group
chown <username>:<groupname> /opt/project/
chown -R <username>:<groupname> /opt/project/  # Recursively

# SUID (run with the file owner's permissions)
chmod u+s /usr/bin/passwd   # Example: The passwd command requires SUID to modify /etc/shadow
# SGID (run with the file's group permissions; for directories = new files inherit the directory's group)
chmod g+s /shared/project/
# Sticky Bit (for directories: only the file owner can delete their own files)
chmod +t /tmp
ls -la /tmp  # Displays as drwxrwxrwt

# Install the acl tool
dnf install -y acl
# Set permissions for a specific user
setfacl -m u:bob:rw /shared/file.txt
# Set permissions for a specific group
setfacl -m g:developers:rx /opt/project/
# View ACL
getfacl /shared/file.txt
# Delete ACL
setfacl -x u:bob /shared/file.txt
# Set ACL recursively
setfacl -R -m u:bob:rX /opt/project/

# Verify user creation
id <username>
cat /etc/passwd | grep <username>
# Verify group members
groups <username>
# Verify sudo permissions
sudo -l -U <username>    # List the sudo permissions of a user
# Verify file permissions
ls -la /opt/myapp/
getfacl /shared/file.txt  # View ACL

# Takes effect in the current session (no re-login required)
newgrp <groupname>

# Add a user to the wheel group with root privileges
usermod -aG wheel <username>
# Or add the configuration in /etc/sudoers.d/