Day 4 - User and Account Management

📌 Key Takeaways

• Account info lives in /etc/passwd, and passwords live separately in /etc/shadow. The reason for the split is security.
• /etc/passwd has 7 fields separated by colons (:). The UID, GID, home directory, and login shell go here.
• UID 0 is root. Even if the name isn't root, an account with UID 0 has administrator privileges.
• Three account commands: useradd (create) · usermod (modify) · userdel (delete).
• su switches users, and sudo runs just one command as administrator. The sudo configuration is in /etc/sudoers.

Where Is Account Information?

Why they were split: many programs need to look up user names and UIDs in /etc/passwd, so it has to be readable by anyone. But if passwords were in there too, anyone could take the hashes and crack them. So only the passwords were pulled out into /etc/shadow and locked down to root only.

Reading One Line of /etc/passwd

   user:x:1000:1000:Test User:/home/user:/bin/bash
     │  │  │    │       │          │          │
     │  │  │    │       │          │          └── ⑦ login shell
     │  │  │    │       │          └───────────── ⑥ home directory
     │  │  │    │       └──────────────────────── ⑤ description (comment)
     │  │  │    └──────────────────────────────── ④ GID (primary group)
     │  │  └───────────────────────────────────── ③ UID
     │  └──────────────────────────────────────── ② password slot (x = it's in shadow)
     └─────────────────────────────────────────── ① user name

• 7 fields, with a colon (:) as the delimiter — there are exam questions on these two facts.
• The x in the second field is a marker meaning "the actual password is in /etc/shadow."
• The fifth, description field may be empty. Even so, the colons remain (user:x:1000:1000::/home/user:/bin/bash), so the field count is always 7.

Reading One Line of /etc/shadow

   alice:$6$Xy3k...:19968:0:99999:7:::
     │      │         │   │   │   │ │││
     │      │         │   │   │   │ ││└─ ⑨ reserved (unused)
     │      │         │   │   │   │ │└── ⑧ account expiration date
     │      │         │   │   │   │ └─── ⑦ grace (inactive) days after expiry
     │      │         │   │   │   └───── ⑥ warning days before expiry
     │      │         │   │   └───────── ⑤ maximum days of use
     │      │         │   └───────────── ④ minimum days of use
     │      │         └───────────────── ③ date of last change
     │      └─────────────────────────── ② encrypted password
     └────────────────────────────────── ① user name

• /etc/shadow has 9 fields. It is asked as a pair with the 7 of /etc/passwd.
• The date in ③ is written not as year/month/day but as the number of days counted from January 1, 1970.
• If ② starts with $6$, it was encrypted with SHA-512 ($1$ is MD5, $5$ is SHA-256).
• If the ② slot is !, !!, or *, the account cannot log in with a password. This is the case for a freshly created account whose password hasn't been set yet, a locked account, or a system account.

Reading One Line of /etc/group

   dev:x:1500:alice,bob
    │  │   │      │
    │  │   │      └── ④ member list (separated by commas)
    │  │   └───────── ③ GID
    │  └───────────── ② group password slot
    └──────────────── ① group name

Pitfall: in ④ of /etc/group, only users who have that group as a secondary group are listed. Users whose primary group it is do not appear here — that relationship is recorded in the GID field of /etc/passwd.

UID Rules

• The key point is that UID 0 is root. Even if you rename the account, it is root if the UID is 0.
• For accounts that shouldn't be allowed to log in, set the shell to /sbin/nologin or /bin/false.

Handling Accounts

sudo useradd -m alice        # create along with a home directory
sudo passwd alice            # set the password
id alice                     # uid=1001(alice) gid=1001(alice) ...
sudo usermod -aG wheel alice # add to the wheel group
sudo userdel -r alice        # delete including the home

Two pitfalls. ① useradd sometimes doesn't create the home directory automatically — -m does that job (it depends on the distribution's default settings). ② Using usermod -G alone wipes out the existing secondary groups. To add one, always use -aG.

useradd Options Pair with passwd Fields

The options of useradd ultimately decide which field of /etc/passwd gets filled in.

sudo useradd -m -u 1500 -g dev -G wheel -c "Kim" -d /home/kim -s /bin/bash kim
grep kim /etc/passwd
# kim:x:1500:1500:Kim:/home/kim:/bin/bash

• Lowercase -g is the primary group (just one), and uppercase -G is the secondary groups (several). It means the same in usermod.
• Items you didn't give an option for are filled with defaults. There are separate places where those defaults are written.

• Right after creating an account, it has no password and cannot log in. It becomes usable only after you set one with passwd name.

Several Ways to Lock an Account

• Locking works by putting a ! in front of the password in /etc/shadow, so that no password matches. The account and files stay as they are.
• A regular user can change only their own password with passwd, and other accounts' passwords plus -l, -u, and -d can be used only by root.
• The remaining options of usermod are the same as useradd — -s (shell), -d (home), -g (primary group), -c (description). Just remember separately -l newname, which changes the login name (uppercase -L is lock).

Groups

$ id alice
uid=1001(alice) gid=1001(alice) groups=1001(alice),10(wheel),1500(dev)
     │              │                 │
     │              │                 └── all member groups (primary + secondary)
     │              └──────────────────── primary group
     └─────────────────────────────────── user number

• If you don't specify a group when creating an account, it is common for a group with the same name as the user to be created together and become the primary group. This is why alice's primary group above is alice.
• After adding a secondary group, you have to log in again for it to take effect. A shell that is already open keeps the group list from when you logged in.
• A group that is being used as some user's primary group cannot be removed with groupdel.

Who Is Connected

$ who
user     pts/0        2026-09-03 09:00 (192.168.0.10)
$ su -
Password:
# whoami
root
# who am i
user     pts/0        2026-09-03 09:00 (192.168.0.10)

• After switching with su, whoami shows the user you switched to (root), while who am i shows the user who first logged in (user). One space changes the answer.

Briefly Raising Privileges — su and sudo

su          # switch to root (environment variables stay the same)
su -        # switch to root + load root's environment too
sudo command    # only that one command with root privileges

• The hyphen in su - is important. With it, the environment variables and working directory also change as if you had logged in as the target user.
• sudo is recommended because of the principle of least privilege and audit trails. There is also no need for several people to share the root password.
• Edit /etc/sudoers with visudo. It checks for syntax errors, so if you edit it directly and break it, you can't use sudo at all.

$ pwd
/home/user
$ su
Password:
# pwd
/home/user          ← su : location and environment stay the same
# exit
$ su -
Password:
# pwd
/root               ← su - : to root's home, with root's environment

• When root becomes another user with su, no password is asked. The target account's password is needed only when a regular user switches.
• Not every user can use sudo. Only users and groups allowed in /etc/sudoers can.

root    ALL=(ALL)       ALL
%wheel  ALL=(ALL)       ALL

• The % at the front is a marker for a group. The second line above reads as "members of the wheel group can run any command with sudo."
• The name of the administrator group differs by distribution — the RedHat family uses the wheel group, and the Debian · Ubuntu family uses the sudo group. That is why usermod -aG wheel alice effectively means "give alice sudo privileges."

Tomorrow we will bundle the commands learned this week into a single summary.

📖 Glossary

• /etc/passwd : A file holding the basic information of user accounts. Seven colon-separated fields.
• /etc/shadow : A file holding encrypted passwords and expiry policy. Only root can read it.
• UID : User identification number. 0 is root, and 1000 and up are regular users.
• GID : Group identification number.
• Primary group : The group recorded in /etc/passwd. It becomes the group of newly created files.
• Secondary group : An additional group the user belongs to. Added with usermod -aG.
• su : A command that switches to another user. Requires the target account's password.
• sudo : A command that runs just one specified command with administrator privileges. Uses your own password.
• visudo : A command that safely edits /etc/sudoers with syntax checking.