0Pricing
Cyber Security Academy · Lesson

User and Group Management

Add, remove, and audit users and groups, configure sudo, and apply the principle of least privilege.

User and Group Management is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Linux User Model

Linux is a multi-user OS. Every process runs as a specific user. Understanding users and groups is fundamental to access control and privilege separation.

The /etc/passwd File

/etc/passwd stores user account information: username, UID, GID, home directory, shell. Passwords are stored (as hashes) in /etc/shadow, readable only by root.

cat /etc/passwd
# format: username:x:UID:GID:comment:home:shell

Creating and Managing Users

Key commands:

useradd -m -s /bin/bash alice   # create user with home dir
passwd alice                    # set password
usermod -aG sudo alice          # add to sudo group
userdel -r alice                # delete user and home dir

Groups and Access Control

Groups allow multiple users to share permissions. A user can belong to many supplementary groups. The primary group is set at creation; secondary groups grant additional access to files and devices.

groupadd developers
usermod -aG developers bob
id bob                          # show UID, GID, groups

The /etc/shadow File

/etc/shadow contains hashed passwords and password aging info. Only root can read it. Hash format: $id$salt$hash where id indicates algorithm (6=SHA-512, 2y=bcrypt).

sudo cat /etc/shadow
# $6$salt$hash = SHA-512

Principle of Least Privilege

Each user and service should run with only the minimum permissions required. Never run applications as root unless absolutely necessary. Use dedicated service accounts with no login shell and restricted home directories.

sudo vs su

sudo runs a single command with elevated privileges, logging the action. su switches to another user (usually root) for an entire session. Prefer sudo for auditability — every elevated command is logged to /var/log/auth.log.

sudo apt update              # single command as root
sudo -u postgres psql        # run as specific service user
su - alice                   # switch to alice (full login)

Sudoers Configuration

The /etc/sudoers file (edit with visudo) controls which users can run which commands as root. Grant granular access rather than full sudo. Example: allow a deploy user to restart nginx only.

visudo
# deploy ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx

Locking and Expiring Accounts

Disable unused accounts rather than deleting them (preserves audit trail):

passwd -l alice              # lock account
usermod -e 2024-12-31 alice  # set expiry date
chage -l alice               # view password aging info

Service Accounts

Applications should run as dedicated service accounts with: no interactive login shell (/usr/sbin/nologin), no home directory write access, minimal group memberships. Never run web servers or databases as root.

Auditing User Activity

Monitor user actions via logs:

last                        # recent logins
lastb                       # failed login attempts
journalctl _UID=1000        # journal entries for UID 1000
grep sudo /var/log/auth.log # sudo usage

Quick Check: User Management

Which file contains hashed passwords on Linux and is readable only by root?

Lesson Recap

Linux user and group management controls access through UIDs, GIDs, and group memberships. Use useradd, usermod, groupadd. Follow least privilege: service accounts with no login shell. Use sudo over su for auditability. Monitor /var/log/auth.log for suspicious activity.

Frequently asked questions

Is the “User and Group Management” lesson free?

Yes — the full text of “User and Group Management” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “User and Group Management”?

Add, remove, and audit users and groups, configure sudo, and apply the principle of least privilege. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “User and Group Management” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. File Permissions and Ownership
  2. User and Group Management
  3. SSH Hardening and Key-Based Auth
  4. iptables and UFW Firewall Rules
← Back to Cyber Security Academy