Embedded Files
15.1 Basic Commands
15.1 Basic Commands
whoami Verify current username
exit Logout
su - [Username] Switch user
useradd [Username] Add new user
passwd [Username] Edit user's password
userdel -r [Username] Delete user include home directory
usermod -L [Username] Lock user
usermod -U [Username] Unlock user
passwd -S [Username] Check user status (similar to cat /etc/shadow)
chage -l [Username] Check password status (expired, last change time etc.)
/etc/passwd File to check available user
/etc/group File to check available group
15.2 Defining User Default Settings
15.2 Defining User Default Settings
Goal
Make sure that new users require a password with a maximal validity of 90 days
Ensure that while creating users, an empty file with the name newfile is created to their home directory
Edit Default Settings
/etc/login.defs contain default settings when run useradd, groupadd, or usermod
sudo vim /etc/login.defs
If no sudo can't save
In vim, press Esc to make sure in Normal Mode.
Press I to enter insert mode.
Set password's maximum validity to 90 days
Change PASS_MAX_DAYS value from 99999 to 90
Press Esc to make sure in Normal Mode.
Save and exit
:wq --> Enter
Create empty file when create new user
When you create a new user with the useradd command, system will copy every file and folder from /etc/skel into the new home directory.
sudo touch /etc/skel/[File Name]
Example: sudo touch /etc/skel/newfile
User Creation
Add new user
sudo useradd [User]
Example: sudo useradd anil
Change password
sudo passwd [User]
Example: sudo passwd anil
Verification
Verify newfile is created
sudo ls /home/[User]
Example: ls /home/anil
Verify password maximum validity
cat /etc/shadow
Remove User
Restore default settings in /etc/login.defs
sudo vim /etc/login.defs
In vim, press Esc to make sure in Normal Mode.
Press I to enter insert mode.
Change PASS_MAX_DAYS value from 90 to 99999
Press Esc to make sure in Normal Mode.
:wq --> Enter
Delete newfile in /etc/skel
sudo rm -rf /etc/skel/newfile
Delete user
sudo userdel -r [User]
Example: sudo userdel -r anil
Anatomy of an Entry in /etc/shadow
Example: mentor:$6$rounds=4096$jS9...:19820:7:90:7:30:20500:
Result
student@localhost:~$ sudo vim /etc/login.defs
[sudo] password for student:
student@localhost:~$ cat /etc/login.defs | grep "PASS_MAX_DAYS"
# PASS_MAX_DAYS Maximum number of days a password may be used.
PASS_MAX_DAYS 90
student@localhost:~$ sudo touch /etc/skel/newfile
[sudo] password for student:
student@localhost:~$ sudo useradd anil
student@localhost:~$ sudo passwd anil
New password:
passwd: password updated successfully
student@localhost:~$ sudo ls /home/anil
newfile
student@localhost:~$ sudo cat /etc/shadow
anil:$y$j9T$Wc5YsQQeJd6NeMS77jVsN0$O1sz0T7/oamvbhhlk5eMOwrWLRS.OgfG8RDH8cgrtqB:20567:0:90:7:::
student@localhost:~$ sudo vim /etc/login.defs
[sudo] password for student:
student@localhost:~$ sudo cat /etc/login.defs | grep "PASS_MAX_DAYS"
# PASS_MAX_DAYS Maximum number of days a password may be used.
PASS_MAX_DAYS 99999
student@localhost:~$ sudo rm -rf /etc/skel/newfile
student@localhost:~$ sudo ls /etc/skel
student@localhost:~$ sudo userdel -r anil
student@localhost:~$ cat /etc/passwd
student:x:1000:1000:student:/home/student:/bin/bash
15.3 Providing User Management Access to Specific Users
15.3 Providing User Management Access to Specific Users
User Creation
Add new user
sudo useradd [User]
Example: sudo useradd anil
Change password
sudo passwd [User]
Example: sudo passwd anil
Switch user
su - [User]
Example: su - anil
Verify permission by add user, it will return error because user don't have permission
sudo useradd [User]
Example: sudo useradd john
Grant permission to user
Switch user to administrative account
su - [Admin]
Example: su - student
Open or create a specific configuration file for the user by using the vim editor
sudo vim /etc/sudoers.d/[User]
Example: sudo vim /etc/sudoers.d/anil
Inside vim editor, press Esc to make sure in Normal Mode.
Press I to enter insert mode.
Grant the user permission except to root user without being prompted for a password
[User] ALL=(ALL) NOPASSWD: [Persmission Scope] ! /usr/bin/passwd root
Example: anil ALL=(ALL) NOPASSWD: /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/usermod, /usr/bin/passwd, ! /usr/bin/passwd root
Press Esc to make sure in Normal Mode.
Save and exit
:wq --> Enter
Grant user's specific privileges
Open visudo
visudo performs a syntax check before saving. If you make a typo in the sudoers file using vim, you could accidentally lock everyone (including yourself) out of administrative access. visudo prevents that.
sudo visudo
In visudo, press Esc to make sure in Normal Mode.
Press I to enter insert mode.
[Optional] Find text "# Defaults specification"
You may add anywhere in the file if needed
Modifies how sudo remembers your password authentication
Defaults timestamp_type=global,timestamp_timeout=60
With global, once you authenticate in one terminal, you are authenticated across all terminals for that user session.
timestamp_timeout make sure you won't be prompted for your password again for an hour. The default is usually 5 or 15 minutes.
Press Esc to make sure in Normal Mode.
Save and exit
:wq --> Enter
Switch user
su - [User]
Example: su - anil
Verify permission by add user
sudo useradd [User]
Example: sudo useradd john
Verify new user creation
cat /etc/passwd
Remove User
Switch user to administrative account
su - [Admin]
Example: su - student
Delete user's specific privileges
sudo visudo
In visudo, press Esc to make sure in Normal Mode.
Press I to enter insert mode.
Delete the line
Press Esc to make sure in Normal Mode.
:wq --> Enter
Delete user's specific privileges
sudo rm /etc/sudoers.d/[User]
Example: sudo rm /etc/sudoers.d/anil
Delete user
Type exit if said user is currently used bu process
sudo userdel -r [User]
Example:
sudo userdel -r john
sudo userdel -r anil
Result
student@localhost:~$ sudo useradd anil
[sudo] password for student:
student@localhost:~$ sudo passwd anil
New password:
BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word
Retype new password:
passwd: password updated successfully
student@localhost:~$ su - anil
Password:
anil@localhost:~$ sudo useradd john
[sudo] password for anil:
anil is not in the sudoers file.
anil@localhost:~$ su - student
Password:
Last login: Tue Apr 21 12:50:16 +08 2026 on tty2
student@localhost:~$ sudo vim /etc/sudoers.d/anil
student@localhost:~$ sudo cat /etc/sudoers.d/anil
anil ALL=(ALL) NOPASSWD: /usr/sbin/useradd, /usr/sbin/userdel/, /usr/sbin/usermod, /usr/bin/passwd, ! /usr/bin/passwd root
student@localhost:~$ sudo visudo
student@localhost:~$ su - anil
Password:
Last login: Tue Apr 21 13:24:49 +08 2026 on pts/0
anil@localhost:~$ sudo useradd john
[sudo] password for anil:
anil@localhost:~$ cat /etc/passwd
student:x:1000:1000:student:/home/student:/bin/bash
anil:x:1001:1001::/home/anil:/bin/bash
john:x:1002:1002::/home/john:/bin/bash
anil@localhost:~$ su - student
Password:
Last login: Tue Apr 21 13:25:21 +08 2026 on pts/0
student@localhost:~$ sudo visudo
student@localhost:~$ sudo rm /etc/sudoers.d/anil
[sudo] password for student:
student@localhost:~$ sudo userdel -r john
student@localhost:~$ sudo userdel -r anil
userdel: user anil is currently used by process 4933
student@localhost:~$ exit
logout
anil@localhost:~$ exit
logout
student@localhost:~$ sudo userdel -r anil
15.4 Group
15.4 Group
User Creation
Add new user
sudo useradd [User]
Example: sudo useradd anil
Change password
sudo passwd [User]
Example: sudo passwd anil
Verify which group
id [User]
Example: id anil
Verify user creation
cat /etc/passwd
System will automatically create a group for new user
cat /etc/group
Group Creation
Add new group
sudo groupadd [Group]
Example: sudo groupadd sales
Add user to new group without remove user from existing groups
sudo usermod -aG [Group] [User]
Example: sudo usermod -aG sales anil
Verify which group
Now new group will be shown at the end
id [User]
Example: id anil
Verify group creation
Now new user will be shown at the end of new group
cat /etc/group
Verify Group Member
Using command lid to check group member
Need to download libuser , system will prompt if need download
sudo lid -g [Group]
Example: sudo lid -g sales
Remove user and group
Remove group
sudo groupdel [User]
Example: sudo groupdel sales
Remove user
sudo userdel -r [User]
Example: sudo userdel -r anil
Result
student@localhost:~$ sudo useradd anil
[sudo] password for student:
student@localhost:~$ sudo passwd anil
New password:
BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word
Retype new password:
passwd: password updated successfully
student@localhost:~$ id anil
uid=1001(anil) gid=1001(anil) groups=1001(anil)
student@localhost:~$ cat /etc/passwd
...
anil:x:1001:1001::/home/anil:/bin/bash
student@localhost:~$ cat /etc/group
...
anil:x:1001:
student@localhost:~$ sudo groupadd sales
[sudo] password for student:
student@localhost:~$ sudo usermod -aG sales anil
student@localhost:~$ id anil
uid=1001(anil) gid=1001(anil) groups=1001(anil),1002(sales)
student@localhost:~$ cat /etc/group
...
anil:x:1001:
sales:x:1002:anil
student@localhost:~$ lid -g anil
bash: lid: command not found...
Install package 'libuser' to provide command 'lid'? [N/y] y
* Waiting in queue...
The following packages have to be installed:
libuser-0.64-11.el10.x86_64 A user and group account administration library
Proceed with changes? [N/y] y
* Waiting in queue...
* Waiting for authentication...
* Waiting in queue...
* Downloading packages...
* Requesting data...
* Testing changes...
* Installing packages...
Error initializing libuser: not executing with superuser privileges.
student@localhost:~$ sudo lid -g sales
anil(uid=1001)
student@localhost:~$ sudo groupdel sales
student@localhost:~$ sudo userdel -r anil
student@localhost:~$ cat /etc/passwd
...
student:x:1000:1000:student:/home/student:/bin/bash
student@localhost:~$ cat /etc/group
...
clock:x:103:
Page updated
Google Sites
Report abuse