User Management

• Containment: a process running as www-data that gets exploited can only touch www-data's files, not the database or the kernel.
• Auditing: logs record uids, so 'who did what and when' is answerable for every command executed with sudo.
• Isolation on shared servers: individual logins give each person their own home and permissions without sharing passwords.
• Least privilege: sudo grants specific commands to specific users instead of the all-or-nothing root login.
• Offboarding: a leaver's access is revoked by deleting one account, not by changing a shared password everyone knows.

Each guest (user) gets a keycard that opens their own room (home directory) and shared floors (groups). The master key (root) never leaves the safe. Instead of copying it, staff are issued a sudo badge that opens specific doors and logs every time it is used — so you always know who entered what.

• /etc/passwd stores one line per user: name, an x placeholder for the password, uid, gid, a comment field, home directory and login shell. It is world-readable because programs need the metadata — never the hash.
• /etc/shadow stores the actual password hash plus ageing policy (last change, minimum/maximum age, warning, inactivity) and is readable only by root, so hashes never leak to normal users.
• useradd registers a new account — writing to /etc/passwd and /etc/shadow and, with -m, creating the home directory — while passwd sets or rotates the password by updating the hash in /etc/shadow.
• usermod edits an existing account in place: locking/unlocking, adding groups with -aG, changing the shell or home, or expiring the account — all without deleting and recreating it.
• userdel removes the account; with -r it also removes the home directory and mail spool. Escalation to run any of this is granted through /etc/sudoers, edited safely with visudo, which syntax-checks the file before saving.

• Service accounts: nginx runs as www-data, databases as their own user, apt as _apt — a breach inside one service cannot read another service's files.
• Sudo is the gate to production: teams get scoped sudoers entries (a restart-only rule for operators, NOPASSWD for CI) and every escalated command is logged.
• SSH keys plus named accounts replace shared passwords entirely, and userdel -r deprovisions a leaver in seconds.
• Identity is the unit of compliance: RBAC, PAM modules and audit tooling all key off users and their group memberships.

• Never do daily work as root — create a personal account and escalate with sudo for everything.
• Give every human and every service its own account; shared logins destroy audit trails.
• Edit sudoers only through visudo (or visudo -f /etc/sudoers.d/<file>), never with a raw editor.
• Lock accounts that no longer need access (usermod -L) and remove them with userdel -r once confirmed.
• Use NOPASSWD sparingly and only for a precise command list, e.g. systemctl restart my-app.
• Keep /etc/shadow at 640 root:shadow and enforce strong password hashing and ageing policy.

• Deleting accounts that still own files: userdel leaves those files orphaned under a numeric uid, which a future account could reclaim.
• Sharing one account or the root password 'for convenience' — nobody can be held accountable afterwards.
• Using adduser and useradd interchangeably without knowing their defaults differ between distros (home, shell, sudo group).
• Dropping the -a in -aG: usermod -G sudo alice replaces every secondary group, silently stripping existing privileges.
• Leaving default password ageing: accounts with 99999 max days in /etc/shadow never expire unless you set a policy.

• id <user> and groups <user> show memberships; compare them when access is refused — a stale login is the usual culprit.
• getent passwd alice queries the real name service (files, LDAP, sssd) — more truthful than cat /etc/passwd on enterprise boxes.
• grep alice /etc/passwd /etc/shadow /etc/group reveals exactly which files know about the account.
• chage -l alice shows expiry state — an account can exist yet be locked or expired.
• sudo -l -U alice lists every rule alice can use; print it before assuming sudo works.