SRJahirTech

AWS Linux Tutorial -- Part 4: Users & Permissions on EC2

By Suraj Ahir 2025-10-13 11 min read

Every production EC2 instance needs proper user management and file permissions. Running everything as root is a security disaster waiting to happen. Setting up dedicated users for applications, configuring sudo access correctly, and applying proper file permissions are foundational security practices for any cloud server.

User Management on EC2

# Check who is logged in
whoami
id
w

# Create a new user
sudo adduser deploy           # Interactive, creates home dir
sudo useradd -m -s /bin/bash webuser  # Non-interactive

# Add user to sudo group (Ubuntu)
sudo usermod -aG sudo deploy

# Add user to docker group (to run docker without sudo)
sudo usermod -aG docker ubuntu

# View all users
cat /etc/passwd
getent passwd     # All users including system users

# Switch to another user
sudo su - deploy  # Switch with environment
sudo -u deploy bash  # Run command as another user

Setting Up SSH Key for Additional Users

# As the new user
sudo su - deploy

mkdir -p ~/.ssh
chmod 700 ~/.ssh

# Add the team member's public key
echo "ssh-ed25519 AAAA... teammate@company.com" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Now the team member can connect:
# ssh deploy@your-server-ip
# (using their private key)

File Permissions on EC2

# Web server files
sudo chown -R www-data:www-data /var/www/html
find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;

# Application directory
sudo mkdir /opt/myapp
sudo chown ubuntu:ubuntu /opt/myapp

# Logs directory writable by app user
sudo mkdir /var/log/myapp
sudo chown deploy:deploy /var/log/myapp

# SSH private key -- MUST be 600
chmod 600 ~/.ssh/id_rsa
chmod 700 ~/.ssh

# Scripts that need to be executed
chmod 755 /usr/local/bin/myapp-start.sh

sudo Configuration

# Edit sudoers safely (never edit /etc/sudoers directly!)
sudo visudo

# Common sudo configurations:
# Full sudo access:
ubuntu ALL=(ALL:ALL) ALL

# Passwordless sudo for ubuntu user:
ubuntu ALL=(ALL) NOPASSWD:ALL

# Specific commands only:
deploy ALL=(ALL) NOPASSWD: /bin/systemctl restart myapp
deploy ALL=(ALL) NOPASSWD: /usr/bin/docker

# Add to /etc/sudoers.d/ instead of main file
echo "deploy ALL=(ALL) NOPASSWD: /bin/systemctl" | sudo tee /etc/sudoers.d/deploy

Frequently Asked Questions

In Part 5, we install and configure Nginx web server on EC2 -- serving your first web application from the cloud.

Written by

Suraj Ahir

Cloud & DevOps engineer running four live production services on my own AWS infrastructure. I write everything on this site myself — no ghostwriters, no AI filler.

More about me → GitHub LinkedIn

Advanced User Management Scenarios

# Create system user for an application (no login, no home)
sudo useradd --system --no-create-home --shell /usr/sbin/nologin appuser

# Create user for a web service
sudo useradd -r -s /bin/false -d /var/www/myapp www-appuser
sudo mkdir -p /var/www/myapp
sudo chown www-appuser:www-appuser /var/www/myapp

# List all users with login shells (real users)
grep -v "nologin\|false" /etc/passwd | cut -d: -f1

# Lock an account when employee leaves
sudo passwd -l former_employee    # Lock
sudo usermod -L former_employee   # Lock (alternative)
sudo usermod -e 1 former_employee # Expire immediately

# Check login history
last ubuntu             # Show login history
lastb                   # Failed login attempts
who                     # Currently logged in users

Sudoers Configuration for DevOps Teams

# /etc/sudoers.d/devops-team
# NEVER edit /etc/sudoers directly -- use visudo or sudoers.d/

# Allow ubuntu user full sudo (standard EC2 setup)
ubuntu ALL=(ALL:ALL) NOPASSWD:ALL

# Allow deploy user to only restart specific services
deploy ALL=(ALL) NOPASSWD: /bin/systemctl restart myapp
deploy ALL=(ALL) NOPASSWD: /bin/systemctl status myapp
deploy ALL=(ALL) NOPASSWD: /usr/bin/docker ps

# Allow monitoring user to read logs
monitor ALL=(ALL) NOPASSWD: /usr/bin/tail -f /var/log/*
monitor ALL=(ALL) NOPASSWD: /bin/journalctl

# Verify sudoers file is valid before saving
sudo visudo -c    # Check for syntax errors

Securing EC2 Access with AWS Systems Manager

AWS Systems Manager Session Manager is the modern, more secure alternative to SSH for EC2 access. It requires no open SSH port (22), no key pair management, and provides full audit logging of every command through CloudTrail.

# Install SSM agent (pre-installed on Amazon Linux and Ubuntu 20.04+)
sudo snap install amazon-ssm-agent --classic
sudo systemctl enable --now snap.amazon-ssm-agent.amazon-ssm-agent

# Attach IAM role with AmazonSSMManagedInstanceCore policy to EC2

# Connect from your machine (no SSH port needed):
aws ssm start-session --target i-1234567890abcdef

# Port forward through SSM (no SSH needed)
aws ssm start-session   --target i-1234567890abcdef   --document-name AWS-StartPortForwardingSession   --parameters portNumber=5432,localPortNumber=5432