Module 15: System and User Security

Module 15: System and User Security

• Exam Objective 5.1 covers basic security and identifying user types on a Linux system.
• The objective focuses on various user types within a Linux environment.

Identifying User Accounts

• User accounts are designed to secure a Linux operating system.
• Accounts control file and directory access rights based on file permissions.

Users and Permissions

• User accounts belong to groups.
• This module covers commands to view user and group details and navigate between them.

Administrative Accounts

• Some commands require administrative or root privileges.
• Using the root account carries risks, so sudo or su are recommended for executing commands as root.
• Risks of logging in as root:
  • All processes run with root privileges.
  • Easier to accidentally run non-admin tasks as root.

Switching Users

• The su command allows running a shell as a different user.
• The su command with the [username] parameter opens a new shell.
• After pressing Enter, the correct password for the target user is needed.

Executing Privileged Commands

• The sudo command enables executing commands as another user.
• It's useful for distributions where root login isn't permitted.
• Unlike su, sudo prompts for your own password. This prevents a possible compromise of root privileges.

User Accounts

• The /etc directory contains files defining user and group accounts.
• The /etc/passwd file provides user account information (name, password placeholder, UID, primary group ID, comment, home directory, shell). Fields are separated by colons.

Passwords

• The /etc/shadow file contains encrypted user passwords (access requires root privileges).
• Fields in /etc/shadow include username, encrypted password, last password change, minimum/maximum password age, warning before password expiry, inactive period and password expiry time.

System Accounts

• Users typically log in using regular accounts (UID > 1000).
• The root account has UID 0 and special access.
• System accounts (UID 1-499) manage services on the system.
• System accounts in /etc/passwd and /etc/shadow may have different fields (like home directory, shell, password).

Group Accounts

• Users can belong to one or more groups.
• The /etc/passwd file specifies the primary group membership.
• The /etc/group file defines additional or secondary group memberships.
• Group information includes the group name, password holder(an 'x' indicates no password), group ID, and list of members in the group file.

Viewing User Accounts

• The id command displays user and group information (UID, username, primary group, and details of other groups).

Viewing Current Users

• The who command lists currently logged-in users, their terminal, and login times.

• The w command provides a more detailed view of logged-in users, including system status like user activity and load average.

Viewing Login History

• The last command displays login history, including previous and current login sessions. It gathers information from the /var/log/wtmp file.