User and Group Management¶

Commands for User Management¶

Commands for user management: | Command | Description | ---------- | ------------ | sudo | Execute command as a different user | su | The su utility requests appropriate user credentials via PAM and switches to that user ID | useradd | Creates a new user or update default user information | userdel | Deletes a user account and related files | usermod | Modifies a user account | addgroup | Adds a group to the system | delgroup | Removes a group from the system | passwd | Changes user password | chage | Changes user password expiration date | gpasswd | Change the password or membership of groups

Creating and modifying users¶

useradd username  # Add a new user
usermod -aG groupname username  # Add user to a supplementary group
userdel username  # Delete a user account
passwd username  # Set or change password for a user
groupadd groupname  # Add a new group
groupdel groupname  # Delete a group
id username  # Display user and group IDs
whoami  # Display your current username
su - username  # Switch to another user account
sudo command  # Run command as superuser (or another user)

Permissions and ownership¶

ls -l filename  # View file permissions
chmod 644 file  # Change permissions (owner=read/write, group=read, others=read)
chown user:group file  # Change owner and group of a file
chgrp groupname file  # Change the group ownership of a file
umask 022  # Set default file permissions for new files

Creating a New User¶

To create a new user using commands, use useradd:

useradd user1

Setting a Password for the New User¶

Use the passwd command to set a user password:

sudo passwd user1

Then check that the entry was added to /etc/passwd:

tail -n 1 /etc/passwd

This will show you the new user with the format:

username:password:UID:GID:GECOS:home_dir:login_shell

* The password field usually has an x (if a password exists).
The UID and GID (user/group ID) fields are assigned automatically.
The GECOS field stores information about the user.
home_dir is usually /home/username.
The login_shell is /bin/bash for users. * Set to /sbin/nologin to not allow the user to login with bash.

When a user is created, the default files are pulled from /etc/skel and put in the new user's home directory.

Example of Creating a New User and Home Directory¶

useradd -m -d /custom/home/dir -s /bin/bash user1

* -m creates the home directory if there isn't one already.
-d /custom/home/dir specifies the home directory for the new user.
-s /bin/bash sets the login shell for the user to /bin/bash.

User Files¶

Main user files:
/etc/passwd * Users are stored in this file as:

username:password:user_id:group_id:user_info:home_dir:login_shell

* The password field usually has an x (if a password exists).
/etc/group * Groups are stored in this file as:

group_name:password:group_id:group_members

* Just like /etc/passwd, the password field usually has an x (if a password exists).
/etc/shadow * Stores encrypted password hashes and password aging information.
* Accessible only by privileged users (e.g., root). * /etc/gshadow * Stores secure group information, such as group passwords and group administrators. * /etc/login.defs * Contains system-wide settings for user and group creation, password policies, and other login-related configurations. * /etc/skel * Contains default files that are copied to a new user's home directory when it's created.
/etc/sudoers and /etc/sudoers.d/ * Config files for managing sudo permissions.

Permissions:

-rw-r--r--. 1 root root 3435 Oct 17 16:59 /etc/passwd  
-rw-r--r--. 1 root root 1399 Oct 17 16:59 /etc/group  
----------. 1 root root  614 Jul  8 01:06 /etc/shadow  
----------. 1 root root  361 Jul  6 05:16 /etc/gshadow  
-rw-r--r--. 1 root root 7778 Oct 30  2023 /etc/login.defs

Passwords are hashed into /etc/shadow based on the algo in /etc/login.defs.
They're never stored in /etc/passwd.

grep -i 'encrypt_method' /etc/login.defs

The Shadow Password Suite¶

Four files compromise the shadow password suite.
* /etc/passwd * /etc/group * /etc/shadow * /etc/gshadow

One other file is used to store the hashing algorithm: * /etc/login.defs

`/etc/login.defs`¶

Permissions and Ownership¶

ls -l filename  # View file permissions
chmod 644 file  # Change permissions (owner=read/write, group=read, others=read)
chown user:group file  # Change owner and group of a file
chgrp groupname file  # Change the group ownership of a file
umask 022  # Set default file permissions for new files