Unit 7: User and Group Administration - Subjective Questions

A user account in Linux is an identity that allows a person or process to log in and interact with the system. Each account is associated with a unique User ID (UID) and has attributes like a home directory, login shell, and group membership.

System Accounts:

• Used by services and daemons rather than humans (e.g., daemon, bin, mail).
• Typically have UIDs in the range 0–999 (0 is reserved for root).
• Often have /usr/sbin/nologin or /bin/false as their shell to prevent interactive login.

Normal User Accounts:

• Created for actual human users.
• UIDs usually start from 1000 and above.
• Have a valid login shell (e.g., /bin/bash) and a home directory under /home.

The key distinction lies in purpose (service vs human), UID range, and whether interactive login is permitted.

The useradd command is used to create a new user account or update default new-user information in Linux.

Basic Syntax:
bash
useradd [options] username

Commonly Used Options:

• -m : Creates the user's home directory.
  bash
  useradd -m john

• -d : Specifies a custom home directory.
  bash
  useradd -d /data/john john

• -s : Sets the login shell.
  bash
  useradd -s /bin/bash john

• -g : Sets the primary group.
  bash
  useradd -g developers john

• -G : Adds the user to supplementary groups.
  bash
  useradd -G sudo,docker john

• -u : Assigns a specific UID.
  bash
  useradd -u 1500 john

After creation, a password must usually be set with passwd username before the account can be used.

The usermod command modifies an existing user account's properties.

Basic Syntax:
bash
usermod [options] username

Key Options:

• -l newname : Changes the login name.
  bash
  usermod -l johnny john

• -d newdir : Changes the home directory (use -m to move contents).
  bash
  usermod -d /home/johnny -m johnny

• -s shell : Changes the login shell.
  bash
  usermod -s /bin/zsh johnny

• -g group : Changes the primary group.
  bash
  usermod -g staff johnny

• -aG groups : Appends the user to supplementary groups (the -a flag prevents removal from other groups).
  bash
  usermod -aG sudo,docker johnny

• -L / -U : Lock / unlock the account.

Important: Omitting -a with -G will replace all existing supplementary groups, which is a common mistake.

The userdel command removes a user account from the system.

Basic Syntax:
bash
userdel [options] username

The -r Option:

• Removes the user's home directory and mail spool along with the account.
  bash
  userdel -r john

• Without -r, only the account entry is removed while files remain on disk.

The -f Option:

• Forces removal even if the user is currently logged in (use with caution).

Precautions:

• Back up important data before deletion, as -r is irreversible.
• Ensure the user is not logged in or running critical processes.
• Check for files owned by the user elsewhere in the filesystem (e.g., using find / -user john) to avoid orphaned files.
• Reassign ownership of any shared files the user owned.

The /etc/passwd file stores essential information about each user account. Each line represents one user, with seven colon-separated fields.

Example Entry:

john:x:1001:1001:John Doe:/home/john:/bin/bash

Field Breakdown:

1. Username (john) : Login name of the user.
2. Password (x) : Placeholder; the actual encrypted password is stored in /etc/shadow.
3. UID (1001) : Numeric User ID.
4. GID (1001) : Primary Group ID.
5. GECOS (John Doe) : Comment field, usually the full name or contact info.
6. Home Directory (/home/john) : User's home directory.
7. Login Shell (/bin/bash) : The shell executed on login.

The file is world-readable but only editable by root, which is why passwords are stored separately in the protected /etc/shadow file.

The /etc/group file defines the groups on a Linux system. Each line represents one group and contains four colon-separated fields.

Example Entry:

developers:x:1005:john,mary,alex

Field Breakdown:

1. Group Name (developers) : The name of the group.
2. Password (x) : Group password placeholder; actual value (if any) is in /etc/gshadow.
3. GID (1005) : Numeric Group ID.
4. Member List (john,mary,alex) : Comma-separated list of usernames who are supplementary members of the group.

Key Points:

• A user's primary group is defined in /etc/passwd, not necessarily listed here.
• The member field lists only secondary/supplementary memberships.
• The file is world-readable and managed via commands like groupadd, groupmod, and usermod.

Primary Group:

• Every user has exactly one primary group.
• Defined by the GID field in /etc/passwd.
• Files created by the user are owned by this group by default.
• Assigned during account creation (e.g., useradd -g developers john).

Secondary (Supplementary) Group:

• A user can belong to multiple secondary groups.
• Membership is recorded in the member list of /etc/group.
• Grants additional access permissions beyond the primary group.
• Assigned using useradd -G or appended later with usermod -aG.

Comparison Table:

Use the id username command to view both primary and secondary group memberships.

These three commands manage groups in Linux.

1. groupadd — Create a new group:
bash
groupadd [options] groupname
groupadd developers # create group
groupadd -g 1500 developers # create with specific GID

2. groupmod — Modify an existing group:
bash
groupmod [options] groupname
groupmod -n devteam developers # rename group
groupmod -g 1600 devteam # change GID

3. groupdel — Delete a group:
bash
groupdel groupname
groupdel devteam

Important Notes:

• A group cannot be deleted if it is the primary group of any existing user.
• Changing a GID with groupmod -g does not automatically update file ownership for files owned by the old GID.
• These operations require root privileges.

The passwd command manages user passwords in Linux.

Basic Usage:
bash
passwd # change your own password
passwd john # root changes john's password

Useful Options:

• -l : Lock a user's password (disables login via password).
  bash
  passwd -l john

• -u : Unlock a locked password.
  bash
  passwd -u john

• -e : Expire the password immediately, forcing a change at next login.
  bash
  passwd -e john

• -d : Delete the password (makes it passwordless — risky).

• -S : Show password status information.

How It Works:

• Passwords are hashed (using algorithms like SHA-512) and stored in /etc/shadow, not /etc/passwd.
• Related aging policies (min/max days, warnings) can be tuned using the chage command.
• Only root can change another user's password.

The /etc/shadow file stores encrypted password hashes and password aging information for user accounts. It is readable only by root, unlike the world-readable /etc/passwd.

Example Entry:

john:abc123$xyz...:19500:0:99999:7:::

Major Fields:

1. Username : Login name.
2. Encrypted Password : Hashed password ($6$ indicates SHA-512).
3. Last Change : Days since Jan 1, 1970 when password was last changed.
4. Minimum Age : Minimum days before password can be changed.
5. Maximum Age : Maximum days the password is valid.
6. Warning Period : Days before expiry to warn the user.
7. Inactivity Period : Days after expiry before the account is disabled.
8. Expiration Date : Account expiry date.

Security Advantage:

• Moving hashes out of the world-readable /etc/passwd prevents ordinary users from performing offline password-cracking attacks on the hashes.

Although similar in purpose, useradd and adduser differ significantly.

useradd:

• A low-level binary utility available on virtually all Linux distributions.
• Non-interactive by default; requires explicit options (-m, -s, etc.).
• Does not automatically create a home directory unless -m is specified (behavior may depend on defaults).

adduser:

• A high-level Perl script (mainly on Debian/Ubuntu systems).
• Interactive — prompts for password, full name, and other details.
• Automatically creates the home directory, copies skeleton files from /etc/skel, and sets sensible defaults.

Comparison Table:

Preference: Administrators favor adduser for quick interactive setup on Debian systems, while useradd is preferred for scripting and automation across all distributions.

Likely Cause:
The administrator used usermod -G without the -a (append) flag. The -G option replaces the entire list of supplementary groups, so any groups not listed in the command are silently removed.

Incorrect (destructive) command:
bash
usermod -G docker john

This makes docker the only supplementary group, removing john from all others.

Correct Approach — use -aG:
bash
usermod -aG docker,sudo john

The -a flag appends the specified groups to the existing set, preserving prior memberships.

Verification:
bash
id john # lists all current groups
groups john # alternative check

Recovery Tip: If groups were lost, re-add them explicitly:
bash
usermod -aG groupA,groupB,groupC john

Best Practice: Always include -a when using -G unless you deliberately intend to reset all supplementary memberships.

UID 0 is reserved for the root superuser in Linux. The kernel grants unrestricted privileges to any account whose UID is 0, regardless of the account's name.

Significance:

• Root can read, write, and delete any file, kill any process, and modify system configuration.
• Access control checks are effectively bypassed for UID 0.

Security Implications of Duplicate UID 0:

• If a normal account is assigned UID 0 (e.g., useradd -o -u 0 hacker), it gains full root privileges while appearing to be an ordinary user.
• This is a classic backdoor technique used by attackers to hide privileged access.
• Such accounts can escalate privileges without using the root login, making detection harder.

Best Practices:

• Regularly audit /etc/passwd for multiple UID 0 entries:
  bash
  awk -F: '1}' /etc/passwd

• Ensure only root legitimately holds UID 0.

• Use sudo for delegated privileges instead of shared root accounts.

The /etc/skel (skeleton) directory contains template files and directories that are automatically copied into a new user's home directory when the account is created.

How It Works:

• When useradd -m (or adduser) creates a home directory, the contents of /etc/skel are copied into it.
• Typical files include .bashrc, .bash_profile, .profile, and default configuration folders.

Example:
bash
useradd -m -k /etc/skel john

The -k option explicitly specifies the skeleton directory to use.

Purpose / Benefits:

• Provides a consistent environment for all new users.
• Allows administrators to preconfigure shell settings, aliases, and welcome files organization-wide.

Customization:

• Adding a file to /etc/skel (e.g., a company usage policy) ensures every future user receives it automatically. Existing users are not affected retroactively.

The chage (change age) command manages password aging and account expiration policies for users. The information it controls is stored in /etc/shadow.

Basic Syntax:
bash
chage [options] username

Key Options:

• -l : List current aging information.
  bash
  chage -l john

• -M days : Set maximum number of days a password is valid.
  bash
  chage -M 90 john

• -m days : Set minimum number of days between password changes.
  bash
  chage -m 7 john

• -W days : Set the warning period before expiry.
  bash
  chage -W 5 john

• -E date : Set an account expiration date.
  bash
  chage -E 2026-12-31 john

• -d 0 : Force password change at next login.

Use Case: chage enforces security compliance by ensuring passwords are rotated periodically and accounts expire when access is no longer needed.

The user account lifecycle involves several stages, each touching specific system files.

1. Creation:
bash
useradd -m -s /bin/bash john

• Files affected: /etc/passwd, /etc/shadow, /etc/group, and the home directory (/home/john) populated from /etc/skel.

2. Setting a Password:
bash
passwd john

• File affected: /etc/shadow (stores the hash).

3. Modification (e.g., add to groups, change shell):
bash
usermod -aG sudo john
usermod -s /bin/zsh john

• Files affected: /etc/group, /etc/passwd.

4. Password Aging / Policy Enforcement:
bash
chage -M 90 john

• File affected: /etc/shadow.

5. Locking (temporary disable):
bash
usermod -L john # or passwd -l john

6. Deletion:
bash
userdel -r john

• Files affected: entries removed from /etc/passwd, /etc/shadow, /etc/group; home directory and mail spool deleted.

Summary: Throughout the lifecycle, the four core files — /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow — are continuously updated to reflect the account's state.

These four files together form the core of Linux user and group administration.

Key Observations:

• passwd and group are world-readable because many programs need to map UIDs/GIDs to names.
• shadow and gshadow are restricted to root because they contain sensitive password hashes.
• The separation of readable metadata from sensitive hashes is a fundamental security design in Linux.

Consistency Check: Tools like pwck and grpck verify the integrity of these files.

Account Locking temporarily prevents a user from logging in without deleting the account.

Methods:

1. passwd -l username:

• Prepends a ! to the password hash in /etc/shadow, making the hash invalid.
• Prevents password-based login.
• Does not block SSH key-based login or other authentication methods.

2. usermod -L username:

• Functionally similar to passwd -l; locks the password field.
• Use usermod -U to unlock.

3. Setting shell to /sbin/nologin or /bin/false:
bash
usermod -s /sbin/nologin john

• Prevents an interactive shell, so even if authentication succeeds, no shell session starts.
• /sbin/nologin politely displays a message; /bin/false exits silently.

Comparison Table:

Best Practice: For a complete lockout, combine password locking with a nologin shell.

When creating users, Linux relies on default configuration files to fill in unspecified attributes.

1. /etc/default/useradd:

• Contains default settings used by the useradd command, such as:
  • GROUP : Default primary group.
  • HOME : Base directory for home folders (e.g., /home).
  • SHELL : Default login shell.
  • SKEL : Skeleton directory (/etc/skel).
  • INACTIVE and EXPIRE : Default aging settings.
• View/modify defaults:
  bash
  useradd -D # display defaults
  useradd -D -s /bin/bash # change default shell

2. /etc/login.defs:

• Defines system-wide policy for user and password management, including:
  • UID_MIN / UID_MAX : Range for normal user UIDs.
  • GID_MIN / GID_MAX : Range for group GIDs.
  • PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_WARN_AGE : Default password aging.
  • CREATE_HOME : Whether to create home directories automatically.

Together, these files ensure consistent and policy-compliant account creation across the system.

Objective: Set up a collaborative directory /project for a team of users.

Step 1 — Create the group:
bash
groupadd projectteam

Step 2 — Add users to the group:
bash
usermod -aG projectteam alice
usermod -aG projectteam bob
usermod -aG projectteam carol

Step 3 — Create the shared directory:
bash
mkdir /project

Step 4 — Set group ownership:
bash
chgrp projectteam /project

Step 5 — Set permissions with the SGID bit:
bash
chmod 2770 /project

• The leading 2 sets the SGID (Set Group ID) bit.
• 770 grants full access to owner and group, none to others.

Why the SGID Bit Matters:

• With SGID on a directory, all files created inside inherit the directory's group (projectteam) rather than the creator's primary group.
• This ensures every team member can access newly created files.

Step 6 — Verify:
bash
ls -ld /project # should show drwxrws--- projectteam
id alice # confirm group membership

Result: All team members can collaboratively create and edit files, with consistent group ownership maintained automatically.