Users, Groups & Permissions

Create users, manage groups, configure sudo, and apply least privilege with file permissions.

Easy 40m 3 tasks

Prerequisites: Linux Command Line Mastery

Learning Objectives

→ Create, modify, and delete users and groups
→ Read /etc/passwd and /etc/shadow file formats
→ Configure sudo access with the principle of least privilege
→ Identify SUID/SGID bits and their privilege escalation risk

User Management

Key Files

/etc/passwd    — User accounts (username:x:UID:GID:comment:home:shell)
/etc/shadow    — Hashed passwords (root-readable only)
/etc/group     — Group definitions
/etc/sudoers   — sudo permissions (edit with visudo!)

User Commands

# Create user
sudo useradd -m -s /bin/bash alice
sudo passwd alice

# Modify user
sudo usermod -aG sudo alice        # add to sudo group
sudo usermod -s /bin/zsh alice     # change shell

# Delete user
sudo userdel -r alice              # -r removes home dir

# Switch user
su alice
sudo -u alice command

# Who is logged in?
who
w
last                               # login history

/etc/passwd Format

root:x:0:0:root:/root:/bin/bash
alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash
│     │ │    │    │            │           └── shell
│     │ │    │    │            └── home directory
│     │ │    │    └── comment/GECOS
│     │ │    └── GID
│     │ └── UID
│     └── x = password in /etc/shadow
└── username

sudo Configuration

# Edit sudoers safely
sudo visudo

# Allow alice to run all commands
alice ALL=(ALL:ALL) ALL

# Allow without password
alice ALL=(ALL) NOPASSWD: ALL

# Allow only specific commands
alice ALL=(ALL) /usr/bin/apt, /bin/systemctl restart nginx

Special Permission Bits

# SUID — runs as file owner (not executing user)
chmod u+s /usr/bin/passwd   # ls shows -rwsr-xr-x
find / -perm -4000 2>/dev/null  # find SUID files (privesc check!)

# SGID — runs as group, or new files inherit group
chmod g+s /shared/

# Sticky bit — only owner can delete files in directory
chmod +t /tmp/shared/        # ls shows drwxrwxrwt

Linux access control is built on users (individuals) and groups (collections of users). Every process runs as a user, every file is owned by a user and group.

/etc/passwd format — colon-separated

# /etc/passwd — 7 fields root:x:0:0:root:/root:/bin/bash │ │ │ │ │ │ └─ login shell │ │ │ │ │ └────── home directory │ │ │ │ └─────────── GECOS (comment/full name) │ │ │ └───────────── GID (primary group) │ │ └─────────────── UID (user ID) │ └───────────────── x = password in /etc/shadow └────────────────────── username

# User management useradd -m -s /bin/bash alice # create user with home + bash passwd alice # set password usermod -aG sudo alice # add to sudo group userdel -r alice # delete user + home dir # Group management groupadd devops # create group gpasswd -a alice devops # add alice to devops groups alice # show alice's groups # Switch user su - alice # login as alice (needs password) sudo -u alice whoami # run as alice (if you have sudo)

⚠ Security: /etc/shadow is readable only by root. It stores salted password hashes. If you can read it, you can run offline hash cracking (John the Ripper, hashcat).

✦ Answer the questions to complete this task

What UID is always assigned to root?

Why is /etc/shadow only readable by root?

sudo lets authorised users run specific commands as root — without giving them the root password. Configured in /etc/sudoers.

sudoers syntax

# /etc/sudoers (edit with: visudo) # Format: user host=(runas) command root ALL=(ALL:ALL) ALL # root can do everything alice ALL=(ALL) ALL # alice has full sudo bob ALL=(root) /sbin/reboot # bob can only reboot %devops ALL=(ALL) NOPASSWD:/usr/bin/systemctl # group, no password # Dangerous: NOPASSWD + ALL = essentially root without password # alice ALL=(ALL) NOPASSWD:ALL ← never do this

Principle	What it means	Example
Least privilege	Grant only the access needed for the job	Deploy user needs: systemctl restart app — NOT sudo ALL
Separation of duties	Split critical tasks across people	Deploy != approve code != manage secrets
Need-to-know	Access only to data required for the role	Dev has dev DB, not production DB

⚠ Security: sudo entries with vim, python, find, or bash can be abused to get a full root shell even if only specific commands are listed. Check GTFOBins for exploitable sudo binaries.

✦ Answer the questions to complete this task

What command shows which sudo privileges the current user has?

Which sudoers flag allows running a command without entering a password?

Beyond rwx, Linux has three special permission bits that change how execution works — and are prime privilege escalation targets.

Bit	Octal	On file	On directory	Risk
SUID	4000	Executes as file's owner	—	If owner=root: runs as root → privesc!
SGID	2000	Executes as file's group	New files inherit group	Less common but exploitable
Sticky	1000	—	Only owner can delete their files	/tmp uses sticky: others can't delete your files

# Find all SUID files (prime privesc targets) find / -perm -4000 -type f 2>/dev/null # Common legitimate SUID binaries: # /usr/bin/passwd — changes your own password # /usr/bin/sudo — needs SUID to run as root # /usr/bin/ping — needs raw socket (root) # Suspicious SUID binaries (look these up on GTFOBins): # /usr/bin/vim — if SUID root, can edit /etc/shadow # /usr/bin/python3 — if SUID root: python3 -c 'import os; os.execl("/bin/sh","sh")' # /usr/bin/find — find . -exec /bin/sh \; -quit

⚠ Security: After gaining a shell, immediately run find / -perm -4000 -type f 2>/dev/null to find SUID binaries. Cross-reference with GTFOBins to find which ones can be abused for root escalation.

✦ Answer the questions to complete this task

What does the SUID bit on an executable do?

Why does /tmp have the sticky bit set?

💪 Exercises & Challenges

⚙️ Practical Easy +25 XP

User & Permission Audit

## Task: Security Audit of Users & Permissions ```bash # 1. List all users with login shells grep -v 'nologin\|false' /etc/passwd | cut -d: -f1,7 # 2. Find users with UID 0 (root-equivalent) awk -F:

Start →

🚩 Challenge Easy +50 XP

Shadow File Analysis

The /etc/shadow format is: `username:$hash_type$salt$hash:last_change:min:max:warn:inactive:expire` Hash type `$6$` = SHA-512. `$1$` = MD5 (weak!). Question: In a shadow file entry `oldadmin:$1$abc1

Start →

🔗 Related Lessons

Know this first

Linux Command Line Mastery Linux filesystem

Linux Command Line Mastery Filesystem Hierarchy & Package Management