Linux Users and Groups Simplified | Generated by AI

Home 2026.02 English 中文

---

Question: I’m always confused by groups and users in the previous explanations. Is this normal? How do Linux user groups actually work?

Answer:

Yes, it’s completely normal to be confused about users and groups in Linux at first — even people who have used Linux for years sometimes need to double-check how they interact. The concepts are powerful but not very intuitive when you first meet them.

Here’s a clear, step-by-step explanation of how Linux users and groups work, especially in the context of why we used www-data group for nginx.

1. Every file and folder has an owner user + an owner group

Run this command to see it:

ls -l /home/lzw/qDownloads

Example output:

-rw-r--r--  1 lzw    lzw      1234 Feb 10 02:00 movie.mp4
drwxr-xr-x  2 lzw    lzw      4096 Feb 10 01:00 Series/

Columns explained:

• lzw lzw → owner user = lzw, owner group = lzw
• The three sets of rwx permissions mean:
  • First rwx → permissions for the owner (user lzw)
  • Second r-x → permissions for the group (group lzw)
  • Third r-- → permissions for everyone else (other users)

2. Every user can belong to multiple groups

Your user lzw probably belongs to these groups (check with):

groups lzw
# or just: groups   (when logged in as lzw)

Typical output:

lzw adm cdrom sudo dip plugdev lpadmin sambashare

→ lzw is member of his own group lzw + several others.

The nginx user (usually named www-data) belongs to:

groups www-data
# usually just: www-data

But we can add www-data to other groups if needed.

3. How nginx gets access to your files (the two main ways we used)

Way A – Give permission to “others” (o+rx)

chmod -R o+rx /home/lzw/qDownloads

→ Everyone on the system (including www-data) can read and list the folder.
→ Simple, but less secure — any service or user can see your downloads.

Way B – Use the group mechanism (recommended)

We do this:

sudo chgrp -R www-data /home/lzw/qDownloads
sudo chmod -R g+rx /home/lzw/qDownloads
sudo chmod g+x /home/lzw

What actually happens:

1. The group owner of the files becomes www-data
2. The group permissions (g+rx) are set to read + execute
3. Because www-data is in group www-data, nginx can use the group permissions
4. nginx does not need to be the file owner (lzw), and it does not need “others” permission

Result: Only nginx (and other processes in group www-data) can read the folder — much safer.

Quick analogy – real life

• Your house = /home/lzw
• Your movie collection = /home/lzw/qDownloads
• You = user lzw
• Your family = group family
• Nginx = a delivery person named www-data

Options:

• Leave the gate open for everyone to walk in (chmod o+rx) → easy but anyone can enter
• Give the delivery person a family key (chgrp family + chmod g+rx) → only family + delivery person can enter

Linux groups = giving someone a “second key” without making them the homeowner.

Summary table – permission decision guide

Goal	Method used	Security	Convenience
Only you access files	Keep default (chmod 700)	Best	Only you
Nginx + you access files	chgrp www-data + chmod g+rx	Good	Recommended
Everyone on system can read	chmod -R o+rX	Bad	Easiest
Run nginx completely as yourself	user lzw in nginx.conf	Worst	Very easy (but dangerous)

Most people new to Linux start with “open to everyone” (o+r), then learn the group trick later — that’s normal.

If anything is still confusing, tell me which part (e.g. “what does chgrp actually change?” or “why do we need g+x on /home/lzw?”) and I’ll explain with more examples.

References:

• None needed – this is core Linux filesystem basics.

---

Back Donate