Rogue Security Wiki

Study notes covering Administering Users and Groups in Linux.

Author: Dylan Barrett

Date: 01/18/2026

đź“– Useful Vocabulary / Acronyms

Terminology Definition
Pluggable Authentication Modules (PAM) Supplement authentication methods with additional options and flexability
UID (User ID) A unique numeric identifier assigned to each user account in Linux.
GID (Group ID) A unique numeric identifier assigned to each group.
EUID (Effective User ID) The user ID a process runs as, often used during privilege escalation (e.g., sudo).
EGID (Effective Group ID) The effective group permissions a process is using.
/etc/passwd File that stores basic user account information such as username, UID, GID, home directory, and shell.
/etc/shadow Secure file that stores hashed passwords and password aging information.
/etc/group File that stores group names, GIDs, and group membership.
pam_faillock PAM module that locks accounts after too many failed login attempts.
Root The superuser account with unrestricted access to the system (UID 0).
Sudo A command that allows permitted users to execute commands with elevated privileges.
visudo A safe editor for modifying the /etc/sudoers file with syntax checking.
Wheel Group A special group that grants administrative privileges on Red Hat–based systems.
SGID (Set Group ID) A permission that causes files or processes to run with the group’s privileges.
Environment Variable A key-value pair passed to processes that defines system behavior (e.g., PATH, HOME).
Shell A command-line interpreter that allows users to interact with the operating system.
Login Shell The default shell assigned to a user when they log in.
Polkit (PolicyKit) A framework for fine-grained privilege authorization without full root access.
pkexec A Polkit command used to run programs with elevated privileges.
Exit Code A numeric value returned by a command indicating success or failure.
Skeleton Directory (/etc/skel) Template directory used to populate new user home directories.

Managing User Accounts

User Account Concepts

User Configuration Files

User Account Creation

useradd -c "Joe Smith" -e 2025-12-31 -s /bin/ksh jsmith
# This creates the user Joe Smith with the username of jsmith with an expiration of 2025-12-31 and a default shell of kornshell

sudo passwd jsmith 

sudo adduser jsmith
# this will prompt you to fill out the information for the new user
# including password, full name, room number, work phone, home phone, and other then to confirm

User Account Modification

The usermod command

usermod -c "John Smith" -d /home/jsmith -m -l jsmithy # This command was used to change the jsmithy user to jsmith due to a typo

cat /etc/passwd # To confirm username change

ls /home # To confirm the home profile has been changed

The userdel Command

The userdel command removes existing users from the system. By default, it does not remove the user's home directory. However, you can use the -r to also remove the associated home directory


userdel -r jsmith # Command to delete the user and remove their user directory

cat /etc/passwd # To confirm that the user was removed

ls /home # To confirm that the users' directory has been removed

The deluser Command

The deluser command removes user accounts from the system on some distros.

User Account Verification

When you use the useradd, usermod, or userdel command to manage users, the system records the command's result. Even when nothing appears on the screen. All error messages are labeled using a number called an exit code, and it can be retrieved with echo $?

User Management Command Scripts

You can use scripting to help create and manage users. This can be used to help make the repetitive task of adding a lot of users a little easier and less prone to typographical errors.

Script to add a single user

#!/bin/bash

# This script adds a user, sets a full name comment, expiration, custom home directory location, and default shell. Edit the name information for each new user.

useradd -c "John Smith" -e 2030-1-1 -d /home/helpdesk/ -s /bin/ksh jsmith

Script to add multiple users

#!/bin/bash

# This script creates multiple users based on an array of usernames
#
# Username Array
usernames=("jsmith" "bally" "dbarrett")

# Create the users by looping through the array
for username in "$[usernames[@]}"
do
		sudo useradd -m -s /bin/bash "$username"
done

# Print a String to let you know that the command ran
echo "Successfully created users"

# Displays the last three lines of /etc/passwd to confirm
sudo tail -n 3 /etc/password

Account Configuration Commands

There are many commands that system administrators can use to view and display account information.

Display Account Information

Pluggable Authentication Modules

User Login Commands

Administrators need to be able to audit sign-in logs and this can be achieved through a couple of different commands

Troubleshooting User Login Issues

User Login Attempt Failures

  1. Confirm that the user has an account by displaying the contents of /etc/passwd
    • Maybe the user doesn't have an account, use the useradd to add the user's account
  2. If the account exists, confirm that it has a password in the /etc/shadow file
    • Use passwd if there is no password set
  1. If the user account exists and the password both exists and are correct
    • Unlock the account with passwd -u username or usermod -U username
  2. Sometimes the account has expired
    • Use the change command to unlock the account

Manage Group Accounts

Group Configuration Files

Group Management Commands

The commands to create and manage groups are similar to user management commands

Before you delete a group, you have to ensure that you have another way to access the resources that the group can access

Verification

Add users to Groups

Rename and Create Groups

groupmod -n sales_west sales # Rename the sales group to sales_west
groupadd sales_east # create the group sales_east
usermod -G sales_east jsmith # adds jsmith to the sales_east group

User Shell Customization

Due to the large amount of time Linux administrators spend in the command Line interface, it is quite common for them to customize the shell to their liking

chsh -s /bin/ksh # Turns the user's shell to KornShell
chsh -l # Lists the available shells
chsh -s # Provides a path to the requested shell

User Profile Templates

Shell and Environment Variables

Variables, just like their name suggests, are variable and can change over time. Linux has two types of variables: shell variables and environmental variables

Environment variables

Declaring Variables

Setting the PATH variable

Set Localization Variable

Command Aliases

If there is a command that you type frequently, you can use command aliases as shorthand for that command

Command History

The Bash Shell stores a list of all commands that you enter, while the default settings are usually suffecient you can modify these values

User Password Settings

the chage command

the passwd Command

Escalate Privileges

Privilege Escalation Concepts

It is never recommended to log in and perform day-to-day tasks as the root user; the root user's permissions are very broad and allow inexperienced users to break the system, which is a serious security concern.

Privilege Escalation with su

Privilege Escalation with sudo

/etc/sudoer file entries

The Wheel and sudo groups

Additional sudo Options

The /etc/sudoers.d Directory

The sudoedit command

PolicyKit Rules

Configuring polkit rules

pkexec and other polkit commands