Each Linux user is assigned a unique number, called a user ID, or UID. Of course, when you log in, you use a username rather than a user ID. The system converts your username to a particular user ID, and from then on it's only the user ID that counts.
You can actually have more than one username for the same user ID. As far as the system is concerned, the user IDs, not the usernames, matter. There's no way to give one username more power than another if they both correspond to the same user ID.
You can control access to a file or other resource by associating it with a particular user ID. Then only the user corresponding to that user ID can access the resource. For example, you can create a file that only you can read, or a directory in which only you can create new files. That's good enough for many simple cases.
Sometimes, however, you want to share a resource among multiple users. For example, if you're a manager, you might want to create a file that any manager can read but that ordinary employees cannot. Linux doesn't allow you to associate multiple user IDs with a file, so you can't just create a list of all the people to whom you want to give access and attach them all to the file.
You can, however, create a group. Each group is assigned a unique number, called a group ID, or GID. Every group contains one or more user IDs. A single user ID can be a member of lots of groups, but groups can't contain other groups; they can contain only users. Like users, groups have names. Also like usernames, however, the group names don't really matter; the system always uses the group ID internally.
Continuing our example, you could create a managers group and put the user IDs for all the managers in this group. You could then create a file that can be read by anyone in the managers group but not by people who aren't in the group. In general, you can associate only one group with a resource. There's no way to specify that users can access a file only if they're in either group 7 or group 42, for example.
If you're curious to see what your user ID is and what groups you are in, you can use the id command. For example, the output might look like this:
% id
uid=501(mitchell) gid=501(mitchell) groups=501(mitchell),503(csl)
The first part shows you that the user ID for the user who ran the command was 501. The command also figures out what the corresponding username is and displays that in parentheses. The command shows that user ID 501 is actually in two groups: group 501 (called mitchell) and group 503 (called csl). You're probably wondering why group 501 appears twice: once in the gid field and once in the groups field. We'll explain this later.
One user account is very special. [1] This user has user ID 0 and usually has the username root. It is also sometimes referred to as the superuser account. The root user can do just about anything: read any file, remove any file, add new users, turn off network access, and so forth. Lots of special operations can be performed only by processes running with root privilege—that is, running as user root.
[1] The fact that there is only one special user gave AT&T the name for its UNIX operating system. In contrast, an earlier operating system that had multiple special users was called MULTICS. GNU/Linux, of course, is mostly compatible with UNIX.
The trouble with this design is that a lot of programs need to be run by root because a lot of programs need to perform one of these special operations. If any of these programs misbehaves, chaos can result. There's no effective way to contain a program when it's run by root; it can do anything. Programs run by root must be written very carefully.