Users and Groups¶

Every account on a Linux machine is a line in one file. Once you can read that file, unauthorized users have nowhere to hide.

/etc/passwd¶

Despite the name, this file hasn't held passwords in decades. It holds account information, and everyone can read it.

cat /etc/passwd

Each line is one account, with seven fields separated by colons:

student:x:1000:1000:Student Account:/home/student:/bin/bash

Field	Value here	Meaning
Username	`student`	The login name
Password	`x`	Placeholder. The real hash is in `/etc/shadow`.
UID	`1000`	User ID. The system tracks users by number, not name.
GID	`1000`	ID of the user's primary group
Comment	`Student Account`	Usually the person's full name
Home directory	`/home/student`	Where `cd` with no argument goes
Shell	`/bin/bash`	The program that runs when they log in

man 5 passwd documents the format.

Reading it for an audit¶

Regular users have UIDs of 1000 and up. Compare that list to the README.
UID 0 is root. Any other account with UID 0 is root under another name. Remove it.
System accounts (UIDs below 1000) usually have a shell of /usr/sbin/nologin or /bin/false, meaning they can't log in. A system account with /bin/bash is suspicious.

A quick list of who can actually log in:

grep -v -E 'nologin|false' /etc/passwd

/etc/shadow¶

Holds the password hashes and password aging for each account. Readable only by root and the shadow group.

sudo cat /etc/shadow

student:$6$rounds...:19600:1:90:7:::

The second field is the hash. If it's empty, the account has no password. If it starts with ! or *, the account is locked. On an image, an empty second field is a finding.

Who is logged in right now¶

whoami     # your current effective username
logname    # the name you logged in as (differs from whoami in a root shell)
users      # usernames of everyone logged in
who        # logged-in users with terminal and login time
w          # same, plus what each user is running

Managing users¶

sudo adduser alice                    # create, with home folder and password prompt
sudo deluser alice                    # remove the account, keep the home folder
sudo deluser --remove-home alice      # remove both
sudo passwd alice                     # set or change a password
sudo passwd -l alice                  # lock the account
sudo passwd -u alice                  # unlock it
sudo usermod -s /usr/sbin/nologin alice   # stop them logging in without deleting

adduser and deluser are Debian-family convenience wrappers around the lower-level useradd and userdel, which exist on every distribution.

Groups¶

Groups work like Windows groups. Membership is in /etc/group, one group per line: name, placeholder, GID, comma-separated members.

cat /etc/group
getent group sudo         # one group
groups alice              # every group alice is in

sudo groupadd astronomical               # create a group
sudo gpasswd -a ggalilei astronomical    # add a user to it
sudo gpasswd -a csagan astronomical
getent group astronomical                # verify
sudo gpasswd -d csagan astronomical      # remove a user from it
sudo groupdel astronomical               # delete the group

adduser ggalilei astronomical (two arguments) also adds a user to a group and you'll see it in older guides.

The group that matters most for security is sudo. See the previous lesson.

The GUI¶

Settings → Users on Ubuntu shows the same accounts. Click Unlock and authenticate to make changes. From here you can switch an account between Administrator (in the sudo group) and Standard, set passwords, and remove users. Keep Automatic Login off for every account; if it's on, anyone who boots the machine is logged in without a password.

Try it¶

Print /etc/passwd. Count the accounts with a UID of 1000 or more.
Find every account whose shell is /bin/bash or /bin/sh. Are they all supposed to be there?
Create a group physics, add two users to it, verify with getent, then delete the group and check that groups for those users no longer lists it.

Next¶

File Permissions