Should a User class only contain attributes and no methods apart from getters/setters?
If you have the feeling your classes are too big, you are usually right. Of course there are always different approaches how you could split classes and your idea seems to be reasonable.

So you will have some plain Value Objects (the User), some UserRepository class for getting/updating the data in the database and some kind of UserAccessCheck/PermissionManager/... class for checking the actual user rights.

In case you store your permission also in the database, you can of course extract a PermissionRepository to collect all the SQL statements in one location and don't mix your level of abstractions.

To sum this up, the decision is up to you. A class with 4 properties, some Getters and 4 can...()-methods might be suitable in one scenario and splitting it up into 5 classes might be suitable in an other scenario. In general "good" (tm) developer tend to make there code more general/abstract than necessary and wasting there time or there clients money in premature optimization. "Bad" (tm) developer will never feel the need to split a class. Find the right way in between.