5.1 Basic Security and Identifying User Types
5.1 Basic Security and Identifying User Types
Weight: 2
Description: Various types of users on a Linux system.
Key Knowledge Areas:
Root and standard users
System users
The following is a partial list of the used files, terms and utilities:
/etc/passwd, /etc/shadow, /etc/group
id, last, who, w
sudo, su
Users
Linux is a multi-user operating system, meaning many people can interact with the same system; each with different levels of access.
Here are the three core user types:
1. Root User (Superuser)
Has unlimited access to everything on the system
Can read, write, execute, delete any file
Used for administrative tasks like installing packages, changing permissions or editing system files
Username: root
Prompt Symbol: #
(e.g., root@server:~#)
Example:
2. Regular Users (Standard Accounts)
Created by administrators or during OS setup
Can only access their own files and directories
Cannot modify system files or other users' data without permission
Prompt Symbol: $
(e.g., sana@linux:~$)
Example:
For daily use, always operate as a regular user it is safer and best practice.
3. System Users (Service Accounts)
Created by the system or during software installs
Not used for logging in directly
Manage background services (e.g.,
nginx,mysql,sshd,postfix)
Example Users: www-data, mysql, nobody
Use Case Example:
When you install Apache or Nginx, the web server runs as www-data, not as a normal user; this limits access for security.
Real World Scenarios
Root installs software, modifies config files, adds users.
Regular user writes code, manages personal projects and runs apps in home directory.
System users keep services running in the background securely.
A user account is a systematic way to track and monitor the use of system resources. Each user account has two unique identifiers: a username and a UID.
Username
A username is a text string. When you add a new user account, you must select a unique username for the user account. A username is flexible. If required, you can change it. When you choose a username, it must be unique. Two user accounts cannot use the same username.
UID
A UID (User ID) is a unique numeric ID. Similar to the username, you can choose a particular UID for the user account. If you do not select a UID for the user account, Linux automatically assigns a unique ID. If you manually select a custom UID, you must choose a unique UID. Two user accounts can not use the same UID.
User management systems
There are two ways to manage the user accounts: centralized and standalone.
In centralized management, a centralized server system manages all user accounts. It uses a directory service such as LDAP or ADS for user management and authentication. The local system sends the user's login information to the server system. The server system authenticates the user.
In standalone management, the local system manages user accounts. It uses text files to save user accounts and related information. It uses locally stored data to authenticate users.
Groups
In Linux, there can be multiple users (those who use/operate the system), and groups are nothing but a collection of users. Groups make it easy to manage users with the same security and access privileges. A user can be part of different groups.
gid
As you might expect, UID is a number associated with a user account, and GID is a number associated with a group.
/etc/group
It stores group information or defines the user groups i.e. it defines the groups to which users belong. There is one entry per line, and each line has the following format (all fields are separated by a colon (:)
Where,
group_name: It is the name of group. If you run ls -l command, you will see this name printed in the group field.
Password: Generally password is not used, hence it is empty/blank. It can store encrypted password. This is useful to implement privileged groups.
Group ID (GID): Each user must be assigned a group ID. You can see this number in your /etc/passwd file.
Group List: It is a list of user names of users who are members of the group. The user names, must be separated by commas.
How to Display a UID and GID
There are several ways to view a UID and GID. You can find the GID and UID of your current user or other users with the aptly named id command.
id
The 'id' command in Linux is a powerful tool used to display user and group names along with their numeric IDs (User ID - UID or Group ID - GID) of the current user or any specified user on the system. This command is particularly useful for system administrators and users who need to verify user identities and associated permissions.
Without any OPTION it prints every set of identified information i.e. numeric IDs.
This command is useful to find out the following information as listed below:
User name and real user id.
Find out the specific User UID.
Show the UID and all groups associated with a user.
List out all the groups a user belongs to.
Display the security context of the current user.
Syntax:
Options:
'-g': Prints only the effective group ID of the user.
'-G': Prints all group IDs associated with the user.
'-n': Displays names instead of numeric IDs.
'-r': Shows the real ID instead of the effective one.
'-u': Prints only the effective user ID.
'--help': Displays help messages for the id command and exits.
'-version': Shows the version information and exits.
Another simple way to see uid and gui is to look at the /etc/passwd file, which is available on most Linux operating systems.
/etc/passwd
The /etc/passwd file stores essential information required during login. In other words, it stores user account information. The /etc/passwd is a plain text file. It contains a list of the system’s accounts, giving for each account some useful information like user ID, group ID, home directory, shell, and more. The /etc/passwd file should have general read permission as many command utilities use it to map user IDs to user names. However, write access to the /etc/passwd must only limit for the superuser/root account.
Understanding /etc/passwd file fields:
The /etc/passwd contains one entry per line for each user (user account) of the system. All fields are separated by a colon (:) symbol. Total of seven fields as follows. Generally, /etc/passwd file entry looks as follows:
From the above image:
Username: It is used when user logs in. It should be between 1 and 32 characters in length.
Password: An x character indicates that encrypted and salted password is stored in /etc/shadow file. Please note that you need to use the passwd command to computes the hash of a password typed at the CLI or to store/update the hash of the password in /etc/shadow file.
User ID (UID): Each user must be assigned a user ID (UID). UID 0 (zero) is reserved for root and UIDs 1-99 are reserved for other predefined accounts. Further UID 100-999 are reserved by system for administrative and system accounts/groups.
Group ID (GID): The primary group ID (stored in /etc/group file)
User ID Info: The comment field. It allow you to add extra information about the users such as user’s full name, phone number etc. This field use by finger command.
Home directory: The absolute path to the directory the user will be in when they log in. If this directory does not exists then users directory becomes /
Command/shell: The absolute path of a command or shell (/bin/bash). Typically, this is a shell. Please note that it does not have to be a shell. For example, sysadmin can use the nologin shell, which acts as a replacement shell for the user accounts. If shell set to /sbin/nologin and the user tries to log in to the Linux system directly, the /sbin/nologin shell closes the connection. If the user entry in the /etc/passwd file doesn’t have an entry in the shell field, the user gets a Bourne shell (/bin/sh).
But, where are my encrypted hashed (salted) passwords? Good question.
Your password hashes is in the /etc/shadow file
Your encrypted password hashes are in the /etc/shadow file. There was no significant problem with this general read permission in the good old days. Everybody could read the encrypted passwords, but the hardware was too slow to crack a well-chosen password, and the basic assumption used to be that of a friendly user community. Therefore, we use /etc/shadow files on Linux and other Unix-like operating systems for security reasons.
Encryption
Please note that the passwords stored in /etc/shadow are not in plain text. They are hashed using algorithms like MD5, SHA-256, or SHA-512. Hashing makes passwords irreversible and secure. To validate a password, the login system compares the entered password’s hash against the stored hash.
Salting
Salting is the process of adding a random string of data to a password before hashing it. This makes it difficult for attackers to crack passwords using pre-computed hashes or detect identical passwords.
In sort, passwords in /etc/shadow are stored in a hashed format and cannot be reversed easily. The combination of hashing and salting is used to provide significantly more protection than simple encryption alone.
/etc/shadow
The /etc/shadow is a text-based password file. The shadow file stores the hashed passphrase (or “hash”) format for Linux user account with additional properties related to the user password. This shadow file is directly accessible only to the root user. However, some commands or programs (e.g., su, passwd, and others) with unique SetUID (SUID) are set on them to grant them access to the shadow file. Understanding /etc/shadow file format is essential for sysadmins and developers to debug user account issues.
Understanding /etc/shadow file fields and format
Basically, the /etc/shadow file stores secure user account information. All fields are separated by a colon (:) symbol. It contains one entry per line for each user listed in /etc/passwd file. Generally, shadow file entry looks as follows:
As with the /etc/passwd, each field in the shadow file is also separated with “:” colon characters as follows:
Username : A valid account name, which exist on the system.
Password : Your encrypted password is in hash format. The password should be minimum 15-20 characters long including special characters, digits, lower case alphabetic and more. Usually password format is set to $id$salt$hashed, The $id is the algorithm prefix used On GNU/Linux as follows
$1$ is MD5
$2a$ is Blowfish
$2y$ is Blowfish
$5$ is SHA-256
$6$ is SHA-512
$y$ is yescrypt
Last password change (lastchanged) : The date of the last password change, expressed as the number of days since Jan 1, 1970 (Unix time). The value 0 has a special meaning, which is that the user should change her password the next time she will log in the system. An empty field means that password aging features are disabled.
Minimum : The minimum number of days required between password changes i.e. the number of days left before the user is allowed to change her password again. An empty field and value 0 mean that there are no minimum password age.
Maximum : The maximum number of days the password is valid, after that user is forced to change her password again.
Warn : The number of days before password is to expire that user is warned that his/her password must be changed
Inactive : The number of days after password expires that account is disabled.
Expire : The date of expiration of the account, expressed as the number of days since Jan 1, 1970.
Format of an encrypted password in the /etc/shadow file
Consider the following entry in the /etc/passwd for a user named ‘bob‘:
And an encrypted password hash for a user named ‘bob’ in the /etc/shadow file is as follows:
bob – User ID
$6 – The hashing algorithm prefix used for this password. In this case, it is a SHA-512 hash (512 bits). It was originally developed by Ulrich Drepper for GNU libc. Supported on Linux but not common elsewhere. Acceptable for new hashes. The default CPU time cost parameter is 5000, which is too low for modern hardware.
$YTJ7JKnfsB4esnbS – The salt used to encrypt the password and it is chosen at random (6 to 96 bits).
$5XvmYk2.GXVWhDo2TYGN2hCitD/wU9Kov.uZD8xsnleuf1r0ARX3qodIKiDsdoQA444b8IMPMOnUWDmVJVkeg1 – The encrypted hash of the password for the user is named ‘bob’. Then, the salt and the unencrypted password are combined and encrypted to generate the encrypted hash of the password. Why use salt? It prevents two users with the same password from having duplicate entries in the /etc/shadow file. Say, if users named ‘bob’ and ‘ram’ both use ‘abracadabra’ as their passwords, their encrypted passwords in /etc/shadow will be different if their salts are different.
How Linux password verification works with /etc/shadow file
Say a user named ‘sai’ tries to log into a Linux machine, and the Linux OS looks up the entry for the user in the /etc/shadow file. It combines the salt for the user named ‘sai’ with the unencrypted password typed in by the ‘sai’ and encrypts them using the specified hashing algorithm such as SHA-512. If the result matches the encrypted hash, the user named ‘sai’ typed in the correct password. If the result does not match the encrypted hash, the user named ‘sai’ types in the wrong password, and the login attempt fails. This method allows the Linux operating system to determine if the user typed in the correct password without storing that password in a form usable for logging in.
su vs sudo
When it comes to working with Linux, there are two ways to run administrative applications. You can either change over to the super user, also known as the root account, using the “su” command, or you can use the “sudo” command. Which one you use will depend on which type of Linux you have. Some types, such as Fedora, Red Hat, and openSuSE enable the root user, while others, such as Ubuntu and Debian, do not. I am going to refer to Ubuntu in this blog.
The Unix command su, stands for “substitute user,” “super user,” or “switch user,” and allows you to log in as root and do whatever you want with the system. Sudo stands for either "substitute user do" or "super user do" and it allows you to temporarily elevate your current user account to have root privileges. This is different from “su” which is not temporary. With “sudo,” you continue to use your user account, but with root privilege, whereas in “su,” you are actually logged into the root account. Also, the root privilege in “sudo” is only valid for a finite time. Once that time expires, you have to enter your password again to regain root privilege.
Using “sudo,” you can do pretty much the same things you can with “su.” To use it, you just have to add “sudo” in front of all root commands. Having root user privileges can be dangerous, but using sudo instead of su can help you keep your system more secure. If you are using Linux and you want your actions to be safe, you need to know and understand these two commands.
Become another user
do things as different user
By default , root
root by default
Needs root password
needs user's password
Every Linux SysAdmin needs to monitor and manage users, hopefully with ease. There are several Linux commands which can help.
w
The w command is a built-in tool that allows administrators to view information about users that are currently logged in. This includes their username, where they are logged in from, and what they are currently doing.
Syntax:
Where:
[options]: Options that change the way the command behaves.[username]: Entering the name of a specific user only shows information about that particular user in the output.
Using the w command without any additional options produces an output similar to this:
The first line of the output shows system information:
System time: The current system time.
Up time: How long the system has logged in.
Number of users: The number of users currently logged in.
Average system load: The average number of jobs running on the system in the last 1, 5, and 15 minutes, respectively.
The second line shows user and process information:
USER: The names of currently logged in users.TTY: The name of the terminal the user is logging in from.FROM: The name or IP address of the terminal or host the user is logging in from.LOGIN@: The time the user logged in, in a 24-hour format.IDLE: The time since the user last used the terminal; displays ?xdm? if the user is currently active.JCPU: The total run time of all system processes attached to the user's terminal.PCPU: Elapsed time for the user's current process.WHAT: The name of the user's current process.
The w command uses the following options:
-h, --no-header
Print output without the header.
-u, --no-current
Ignores username when calculating current process times and load.
-s, --short
Print output in the short format.
-f, --from
Toggle printing the FROM (remote hostname) field.
--help
Display help text.
-i, --ip-addr
Replace the hostname in the FROM field with the IP address.
-V, --version
Display current command version.
-o, --old-style
Print old-style output (blank space for idle times shorter than 1 minute).
who
The who command is a simple and effective way to display information about currently logged-in users
who command is used to find out the following information :
Time of last system boot
Current run level of the system (LPIC 1)
List of logged-in users and more.
Syntax:
The who command displays the following information for each user currently logged in to the system if no option is provided :
Login name of the users
Terminal line numbers
Login time of the users into the system
The remote host name of the user
who command options:
-a
Same as -b -d –login -p -r -t -T -u
-b
Time of last system boot
-d
Print dead processes
-H
Print line of column headings
-l
Print system login processes
-m
Only hostname and user associated with stdin
-p
Print active processes spawned by init
-q
All login names and number of users logged on
-r
Print current runlevel
-t
Print last system clock change
-T
Add user’s message status as +, – or ?
-u
List users logged in
last
The 'last' command reads from the '/var/log/wtmp' file to provide a detailed list of user login and logout sessions. It can show the login times, durations, and hostnames associated with each session, giving insights into system access patterns. The command can also accept usernames and terminal names as arguments to display sessions related to specific users or terminals.
Syntax:
To view a list of recent user logins, simply run the last command without any options:
Understanding the last command outputs
root – It is the user name. For example, for system events such as reboot and shutdown of the Linux/Unix box, unique user names reboot and shutdown are used to indicate that activity.
pts/0 – Explains how the user logged into the system. For instance, pts for pseudoterminal session (ssh login), tty for the terminal, :0, :1, (:2) X windows GUI system, etc.
10.1.6.120 – The IP address or the FQDN (or hostname) from which the user logged into the system.
Tue Jan 28 04:08 – The date and time stamp for the user login activity (the log in time).
still logged in – The logout time.
Of course, you can specifies a file to search other than /var/log/wtmp using -f option. For example:
the last command options:
Option
Description
-a
Display the hostname in the last column
-d
Display IP addresses in numbers-and-dots notation
-F
Show full login and logout times (date and time)
-i
Display IP addresses in numbers-and-dots notation (same as -d)
-n
Limit output to specified number of lines (e.g., -n 20)
-R
Suppress hostname display
-x
Display system shutdowns and run level changes
-w
Display full user and domain names in output
-t
Show only entries logged in before specified time (YYYYMMDDHHMMSS)
-s
Show only entries logged in after specified time (YYYYMMDDHHMMSS)
-f
Read from specified file instead of /var/log/wtmp
-p
Show logins at specific time (YYYYMMDDHHMMSS)
--since
Display entries since specified date (YYYY-MM-DD)
--until
Display entries until specified date (YYYY-MM-DD)
That's all
.
.
.
sources:
https://dev.to/sanasadiq/understanding-types-of-users-in-linux-12n4
https://www.computernetworkingnotes.com/linux-tutorials/types-of-users-in-linux-explained-with-accounts.html https://www.geeksforgeeks.org/linux-unix/id-command-in-linux-with-examples/ https://www.cyberciti.biz/faq/understanding-etcgroup-file/
https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/
https://www.cyberciti.biz/faq/understanding-etcshadow-file/ https://phoenixnap.com/kb/w-command-in-linux https://phoenixnap.com/kb/w-command-in-linux https://www.geeksforgeeks.org/linux-unix/who-command-in-linux/ https://www.cyberciti.biz/faq/unix-linux-who-command-examples-syntax-usage/ https://www.geeksforgeeks.org/linux-unix/last-command-in-linux-with-examples/
Last updated