> For the complete documentation index, see [llms.txt](https://olb.gitbook.io/linux-essentials-certification/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://olb.gitbook.io/linux-essentials-certification/5.security-and-file-permissions/5.1-basic-security-and-users.md).

# 5.1 Basic security and users type

**Weight 2**\
Key knowledge areas

* Root and standard users
* System users

Partial list of the used files, terms and utilities

* /etc/passwd, /etc/shadow, /etc/group
* id, last, who, w
* sudo, su

***

## Accounts

* `root` UID : 0 and GUID : 0
* standard users : UIDs starting at 1000
* system users: UIDs under 100 and no home directory and no shell
* Service account : UID/GID >1000 but not a “standard” or “regular” user account
* `chsh` change shell (bash for zsh for instance)
* `id` user information
* `last` last user logged
  * pts : via distant terminal (remote via network)
  * tty : via console (directly on PC)
* `lastb` : last login failed
* `who` and `w` : list active users

## Access control files

* **/etc/passwd** This file stores basic information about the users on the system, including UID and GID, home directory, shell, etc. Despite the name, no passwords are stored here.
* **/etc/group** This file stores basic information about all user groups on the system, like group name and GID and members.
* **/etc/shadow** This is where user passwords are stored. They are hashed, for security.
* **/etc/gshadow** This file stores more detailed information about groups, including a hashed password which lets users temporarily become a member of the group
* By default, every user can enter /etc and read the files /etc/passwd and /etc/group. And also by default **no user, except root, may read the files /etc/shadow or /etc/gshadow**.
* **/etc/sudoers** This file controls who can use the sudo command, and how.
* **/etc/sudoers.d** This directory may contain files that supplement the settings on the sudoers file.

### /etc/password

* USERNAME The username aka login (name), like root, nobody, emma.
* PASSWORD Legacy location of the password hash. Almost always x, indicating that the password is stored in the file /etc/shadow.
* UID User ID (UID), like 0, 99, 1024.
* GID Default Group ID (GID), like 0, 99, 1024.
* GECOS A CSV list of user information including name, location, phone number. For example: Emma Smith,42 Douglas St,555.555.5555
* HOMEDIR Path to the user’s home directory, like /root, /home/emma, etc.
* SHELL The default shell for this user, like /bin/bash, /sbin/nologin, /bin/ksh, etc. For example, the following line describes the user emma:
* `emma:x:1000:1000:Emma Smith,42 Douglas St,555.555.5555:/home/emma:/bin/bash`
* `chfn` change GECOS

### /etc/group

* The /etc/group file contains fields always delimited by a ':' for storing basic information about the groups on the system. It is sometimes called the “group file”. The syntax for each line is:
* `NAME:PASSWORD:GID:MEMBERS` Where:
* NAME is the group name, like root, users, emma, etc.
* PASSWORD legacy location of an optional group password hash. Almost always x, indicating that the password (if defined) is stored in the file /etc/gshadow.
* GID Group ID (GID), like 0, 99, 1024.
* MEMBERS a comma-separated list of usernames which are members of the group, like jsmith,emma.
* `students:x:1023:jsmith,emma`

### /etc/shadow

* The following table lists the attributes stored in the file /etc/shadow, commonly referred to as the “shadow file”. The basic syntax for a line on this file is:
* `USERNAME:PASSWORD:LASTCHANGE:MINAGE:MAXAGE:WARN:INACTIVE:EXPDATE` Where:
* USERNAME The username (same as /etc/passwd), like root, nobody, emma.
* PASSWORD A one-way hash of the password, including
* LASTCHANGE Date of the last password change in days since the “epoch” (January 1st, 1970), such as 17909.
* MINAGE Minimum password age in days.
* MAXAGE Maximum password age in days.
* WARN Warning period before password expiration, in days.
* INACTIVE Maximum password age past expiration, in days.
* EXPDATE Date of password expiration, in days since the “epoch”.
* `emma:$6$nP532JDDogQYZF8I$bjFNh9eT1xpb9/n6pmjlIwgu7hGjH/eytSdttbmVv0MlyTMFgBIXESFNUmTo9EGxxH1 OT1HGQzR0so4n1npbE0:18064:0:99999:7:::`
* **!!** This means a “disabled” account (no authentication possible), with no password hash stored.
* **!$1$01234567$ABC…** A “disabled” account (due to the initial exclamation mark), with a prior hash function, hash salt and hash string stored.
* **$1$0123456789ABC$012…** An “enabled” account, with a hash function, hash salt and hash string stored.

### /etc/gshadow

* /etc/gshadow is a file readable only by root and by users with root privileges that contains encrypted passwords for groups, each on a separate line:
* `developer:$6$7QUIhUX1WdO6$H7kOYgsboLkDseFHpk04lwAtweSUQHipoxIgo83QNDxYtYwgmZTCU0qSCuCkErmyR2 63rvHiLctZVDR7Ya9Ai1::`
* **Group name** The name of the group.
* **Encrypted password** The encrypted password for the group (it is used when a user, who is not a member of the group, wants to join the group using the newgrp command — if the password starts with !, no one is allowed to access the group with newgrp).
* **Group administrators** A comma-delimited list of the administrators of the group (they can change the password of the group and can add or remove group members with the gpasswd command).
* **Group members** A comma-delimited list of the members of the group.