Understanding Linux User and Group Accounts
Linux systems use user and group accounts to manage access control and file ownership. Every user has a unique User ID (UID) and belongs to at least one group with a Group ID (GID).
The Root User and Account Hierarchy
The root user (superuser) has UID 0 and possesses unrestricted access to all system resources. Regular users typically have UIDs starting from 1000, while system users have UIDs between 1 and 999. This hierarchy ensures system processes run with minimal necessary permissions.
User Account Storage and Structure
User account information is stored in the /etc/passwd file with seven fields separated by colons:
- Username
- Password placeholder (x)
- UID
- GID
- GECOS field (user description)
- Home directory
- Login shell
Group information is stored in /etc/group with four fields: group name, password placeholder, GID, and member list.
Shadow Files and Security
Shadow files (/etc/shadow and /etc/gshadow) store encrypted passwords and additional security information. Only root can read these files, protecting sensitive authentication data. This separation prevents regular users from accessing password hashes.
Understanding this structure is fundamental because it underpins all user management operations and helps you troubleshoot access issues effectively.
Essential User Management Commands and Tools
The useradd command creates new user accounts with syntax: useradd [options] username. Common options include -u for UID, -g for primary group, -G for supplementary groups, -d for home directory, -s for login shell, and -m to create the home directory automatically.
Modifying and Removing Users
The usermod command modifies existing user accounts using similar options. This allows administrators to change group memberships, home directories, shells, or lock accounts. The userdel command removes users, with the -r option also deleting their home directories and mail spool.
Group Management Commands
For group operations, use these core commands:
- groupadd: Creates new groups
- groupmod: Modifies existing group properties
- groupdel: Removes groups from the system
Password and User Information Commands
The passwd command manages passwords with options like -l to lock accounts, -u to unlock, and -e to expire passwords immediately. The id command displays user and group information, while whoami shows the current user.
User Switching and Privilege Commands
The su command switches users (requires the target user's password). The sudo command allows authorized users to execute commands with elevated privileges (requires the current user's password). Use groups to list all groups for a user.
These commands form the core toolkit for user management, and proficiency with their syntax is tested extensively on the Linux+ exam.
File Permissions and Ownership in Linux
Linux implements a three-level permission system: owner (user), group, and others. Each level has three permission types: read (r or 4), write (w or 2), and execute (x or 1).
Symbolic and Numeric Permission Notation
File permissions are displayed in symbolic notation like -rw-r--r--, where the first character indicates file type, followed by three triads representing owner, group, and other permissions. Numeric notation uses sums of permission values, so rwxr-xr-x equals 755, meaning the owner has full permissions while group and others can read and execute.
Changing Ownership and Permissions
The chown command changes file ownership with syntax: chown user:group filename. The chmod command changes permissions using either symbolic (chmod u+x file) or numeric (chmod 755 file) notation. The chgrp command changes group ownership alone.
Directory Permissions and Special Cases
For directories, execute permission means the ability to enter the directory. Read permission allows listing contents. Special permissions include setuid (4000), setgid (2000), and sticky bit (1000).
The Umask Value
The umask value determines default permissions for newly created files and directories. A typical umask of 0022 creates files with 644 permissions and directories with 755 permissions. Understanding umask is crucial because improper defaults create security vulnerabilities.
Improper permissions create security vulnerabilities or prevent legitimate users from accessing needed files. Understanding file permissions protects system integrity.
Sudoers Configuration and Privilege Escalation
The sudo mechanism allows designated users to execute commands with elevated privileges, typically root access, without sharing the root password. This is fundamental to modern Linux security practices.
Editing the Sudoers File Safely
Configuration is managed in the /etc/sudoers file. Always edit this file using the visudo command to prevent syntax errors that could lock you out of administrative access. Visudo validates syntax before saving and prevents concurrent edits.
Sudoers File Syntax and Specifications
The sudoers file uses user specifications with format: user host=(run as user) commands. Example: 'alice localhost=(root) /bin/apt-get' allows user alice to run apt-get as root on localhost. Group specifications use %groupname syntax, allowing all group members access.
Host specifications let you control where privileges apply in multi-system environments. The NOPASSWD option allows passwordless execution, while PASSWD requires authentication each time.
Advanced Sudoers Features
Sudoers supports command aliases, user aliases, and host aliases for managing complex privilege structures. The sudo -l command lists available commands for the current user. The sudo -u username command specifies which user to run as.
Logging and Security
Logging is automatic in /var/log/auth.log, providing audit trails for compliance. The sudo timeout (default 15 minutes) allows subsequent commands without reauthentication. Proper sudoers configuration enables principle of least privilege while maintaining administrative flexibility.
User Account Management Best Practices and Security
Effective user management requires understanding the account lifecycle: creation, modification, and deletion. When creating users, assign appropriate UIDs and use descriptive GECOS fields for identification.
Account Creation Best Practices
System accounts should use nologin or false shells to prevent interactive logins, increasing security. Set appropriate umask values to ensure new files don't have excessive permissions. Choose login shells based on user type (bash for regular users, nologin for system accounts).
Account Audits and Verification
Regular audits using getent passwd and getent group verify account integrity and identify orphaned accounts. These commands display the current user and group databases, helping detect inconsistencies. Review entries regularly to catch unauthorized additions.
Password Management and Policies
Password policies should enforce complexity requirements and expiration through PAM (Pluggable Authentication Modules) configuration files in /etc/pam.d/. The chage command manages password aging parameters, including expiration dates and warning periods. This automates compliance with security requirements.
User Deletion and Deactivation
When deleting users, ensure their files are reassigned or removed appropriately. Verify no running processes belong to that user with ps. Account locking using usermod -L or -e prevents access without deletion, preserving data for auditing.
Access Control and Compliance
Implement principle of least privilege by granting users only necessary permissions for their roles. Regularly review /var/log/auth.log to identify suspicious login attempts. Multi-factor authentication and SSH key management supplement password-based authentication.
Compliance requirements like HIPAA or PCI-DSS may require specific password aging, complexity, and audit policies. These practices protect system integrity and prevent unauthorized access.