Elevated Privileges and Basic User Management

🎯 Learning Objective

Master the sudo command to run commands with elevated privileges safely, understand its security benefits, and know how to check your own permissions.

📚 Concept Introduction

Some actions in Linux, like installing software, modifying system files, or managing users require root privileges. But logging in as the root user full-time is risky - one mistake could damage the entire system.

That's why we use sudo. It stands for "superuser do" and allows authorized users to run specific commands as the root user (or another user) safely and with a password prompt. Think of sudo like a secure keycard system: instead of everyone carrying master keys, you get temporary access when you need it, and every use is logged.

📁 Pre-created for this unit:

• restricted_info.txt - A file owned by root that laborant cannot read directly

🔐 The Problem: Needing Elevated Privileges

Certain files and commands are protected for security. For example, the file /home/laborant/restricted_info.txt is owned by root. If you try to read it as a regular user, you'll be denied.

Try to read the protected file:

cat /home/laborant/restricted_info.txt

This command will fail with a "Permission denied" error.

✅ The Solution: Running a Command with sudo

To run this command successfully, you can temporarily elevate your privileges using sudo.

sudo cat /home/laborant/restricted_info.txt

◆ How sudo Works

1. Prefix the Command: You add sudo before the command that needs root access.
2. Enter Your Password: The first time you use sudo in a session, it will ask for your own user password (not the root password). This confirms it's really you.
3. Command Execution: If you are authorized, the command runs with root privileges.
4. Logging: The action is logged, creating an audit trail of who did what.

For a short period (often 5-15 minutes), sudo "remembers" your authentication, so you won't have to re-enter your password for subsequent commands.

⚙️ How sudo is Configured

The rules governing who can use sudo and what they can do are defined in the /etc/sudoers file. This is like the master security policy that determines access rights across the entire system.

◆ Why sudo is Superior to Root Login

Traditional approach (dangerous):

• Log in as root → Everything you do has maximum privileges → One mistake = system damage

Modern approach (secure):

• Use sudo → Temporary elevation only when needed → Mistakes are limited in scope → Full audit trail

🧰 Useful sudo Options

sudo has several helpful options for managing your elevated privileges.

📋 Essential Command Reference

💡 Key Takeaways

The sudo command lets you run specific commands as root without logging in as the root user, providing a crucial security layer by limiting powerful access and logging all actions. Always use sudo for administrative tasks instead of a persistent root shell, and use sudo -l to see what you are allowed to do. Never edit /etc/sudoers directly; always use the visudo command. Using sudo properly is a fundamental practice for secure Linux administration, providing an audited and controlled way to perform administrative tasks without the risks of a persistent root session.

🎯 Learning Objective

Master creating user accounts with different tools, set secure passwords, and understand where user information is stored on the system.

📚 Concept Introduction

Creating user accounts is a core system administration task. Each user should have their own account for security, accountability, and personal file ownership. Think of user accounts like individual lockers in a school - each person gets their own space, their own combination, and their own responsibility for what's inside.

Every person or service that interacts with a Linux system should have its own unique account. This separation is essential for security (separate accounts limit damage if one is compromised), accountability (actions can be traced back to a specific user), and organization (each user has a private home directory to store their files).

👤 The Interactive Approach: adduser

On Debian-based systems like Ubuntu, adduser is a user-friendly, interactive script that simplifies user creation. It's the recommended tool for creating accounts for human users because it handles all the necessary steps for you.

Create a new user interactively:

sudo adduser new_user

When you run this command, adduser will:

1. Create the user new_user.
2. Create a home directory at /home/new_user/.
3. Copy default configuration files (from /etc/skel) into the new home directory.
4. Prompt you to set and confirm a secure password.
5. Ask for optional user information (like Full Name), which you can skip by pressing Enter.

Because it's interactive and handles everything at once, adduser is the safest and easiest method for day-to-day user creation.

👤 Method 2: useradd — The Low-Level Way

useradd is the standard, low-level command found on all Linux distributions. It is not interactive and requires you to specify what you want with options. This makes it ideal for use in automated scripts.

Create a user with specific options: If you just run sudo useradd another_user, it will create the user but with no home directory and no password, leaving the account unusable.

A correct, minimal command looks like this:

sudo useradd -m -s /bin/bash another_user

This command creates the user and their home directory, but the account is still missing a critical piece: a password.

◆ The Two-Step Process

Unlike adduser, which handles everything in one go, useradd follows a two-step approach:

1. Create the account structure (with useradd)
2. Set the password (with passwd)

This separation gives you more control but requires more steps.

🔒 Password Management: The Security Layer

Think of passwords as the keys to digital offices. The passwd command is your key-cutting service, creating and changing the security credentials that protect user accounts.

◆ Setting Passwords for New Accounts

Set a password for someone else's account:

sudo passwd another_user

You need sudo because you're acting as the system administrator, setting security credentials for an account you don't own. The system will prompt you to enter and confirm the new password.

Change your own password:

passwd

When changing your own password, you don't need sudo - but you will need to provide your current password first as a security measure.

📁 The User Database: Understanding /etc/passwd

Every user account you create gets recorded in the system's "employee directory" - the /etc/passwd file. This file acts as the central registry of all user accounts, storing essential information about each digital identity.

◆ Decoding User Records

Each line in /etc/passwd represents one user account with seven fields separated by colons:

Each line has fields separated by colons (:): username:password_placeholder:UID:GID:description:home_directory:login_shell

Modern security note: The actual password isn't stored here anymore (it's in /etc/shadow for security), but the format remains for compatibility.

Examine a user's record:

grep '^newemployee:' /etc/passwd

This shows you the complete "employee profile" for the user you just created.

📋 Essential Command Reference

💡 Key Takeaways

Linux provides two main approaches for user creation: adduser (interactive, user-friendly) and useradd (scriptable, precise control). On Debian/Ubuntu systems, adduser is recommended for manual user creation because it handles all setup steps automatically. Use useradd when you need repeatable, automated user provisioning in scripts, but remember to specify essential options like -m for home directories and set passwords with passwd. User information is stored in /etc/passwd, where you can verify account creation and review user attributes. Choose your tool based on context: adduser for interactive tasks, useradd for automation.

🎯 Learning Objective

Master the usermod and userdel commands to modify existing user accounts, lock them for security, and delete them when they are no longer needed.

📚 Concept Introduction

User accounts are not static. People change roles, leave organizations, or require different access levels over time. As a system administrator, you need to know how to modify user attributes and securely remove accounts that are no longer in use. This is crucial for maintaining system security and keeping user information up to date.

Think of user account management like updating employee records in a company database. Sometimes you need to change someone's department (modify), temporarily disable their access card (lock), or completely remove them from the system when they leave (delete).

📁 Pre-created for this unit:

• A user named modifiableuser with the /bin/bash shell
• A user named demouser for use in the examples

🔧 usermod: Modifying an Existing User

The usermod command is your primary tool for changing the properties of an existing user account. Because you are altering system-wide settings, you will almost always need to use sudo.

◆ Common usermod Options

◆ Applying Modifications: Scenarios

1. Changing a User's Shell: If a user needs access to a different shell, like /bin/sh, for compatibility reasons, you can update their account.

sudo usermod -s /bin/sh demouser

2. Locking an Account: If an employee goes on leave or an account is under investigation, you can lock it to prevent anyone from logging in with their password.

sudo usermod -L demouser

The user's data remains on the system, but their account is temporarily disabled. You can unlock it later with sudo usermod -U demouser.

❌ userdel: Deleting a User Account

When an account is no longer needed, it's a security best practice to remove it completely. The userdel command handles this.

◆ Deleting a User and Their Files

Simply running sudo userdel username will delete the user, but it will leave their home directory behind. This can lead to orphaned files cluttering the system.

To delete the user and their home directory at the same time, always use the -r (remove) flag.

Delete a user and all their data:

sudo userdel -r demouser

📋 Essential Command Reference

💡 Key Takeaways

The usermod command is a powerful tool for modifying existing user accounts, allowing you to change usernames, shells, home directories, and temporarily lock accounts for security purposes. The userdel command removes users from the system, and you should always use the -r option to also remove the user's home directory and mail spool to prevent orphaned files. Always be careful when deleting users, as it can be a destructive operation. These commands are essential for the entire lifecycle of a user account, from granting new permissions with usermod to securely decommissioning accounts with userdel.