Users, groups and sudo

On Linux, every running program runs as some user, and that user decides what it can touch. The root user can do anything. That is exactly why you should rarely log in as root.

Instead, give each person their own account with useradd. Put people into groups with usermod -aG, so a whole group can share access to a folder. Let trusted users run single commands as root with sudo.

Each sudo command is also recorded in the logs, so you can see who did what. Services should get their own user with few rights, such as www-data or a dedicated app user. Then a hacked web app cannot read other users' files or rewrite the system.

This idea, giving only the access a job needs, comes back later as least privilege in IAM and as containers that do not run as root.