User & Group Administration

Ubuntu tells you never to log in as root and instead run admin tasks through your own account with sudo. What is the actual state of the root account on such a system, and why does that make it a non-issue to leave root passwordless?

During a standard Debian install you can just press Next past the root password screen, leaving it blank. What does Debian silently do to the first user account as a result?

You have shell access on a fresh Debian box and need to run admin commands. How you enter admin mode depends on one earlier install choice — what determines whether you use sudo -s versus su -l?

The openSUSE installer sets up your new user and then, unusually, applies that same password to root unless you catch an easy-to-miss option. What justification is given, and why is it a security weak spot?

Linux usernames look like they could be anything, but there are real constraints. What are the rules for a login name, and what specifically can break if you use accented or non-ASCII characters in a password?

Debian gives you both adduser and useradd, and so does Fedora — but a script that works on Debian's adduser can misbehave on Fedora. Why?

What is the two-command sequence to create a Linux user who has a working home directory and a password, and what does the -m flag contribute?

Linux distinguishes three kinds of user accounts. What are they, and why does the Apache web server run as its own account rather than as root?

The file is named /etc/passwd, yet it hasn't held passwords for decades. What are its seven colon-separated fields, and what sits in the password field now?

You see an account with UID 700 and another with UID 1000. What does each UID range signify, and which value does root always hold?

When you create a new user, where do the default dotfiles in their brand-new home directory come from, and what happens if you edit that source afterward?

A user's primary group and their supplementary groups are recorded in two different places. Where does each live, and what are the four fields of an /etc/group line?

SUSE puts every ordinary user into a shared users group, while Debian and Fedora give each user a private group of the same name. What problem does the private-group approach solve?

You want to give user bob sudo rights by adding him to a group, without disturbing the groups he already belongs to. What command does this, and what is the trap if you forget the -a?

Two users on a modern Linux system pick the exact same password, yet their /etc/shadow entries look completely different. What mechanism causes that, and which setting controls the hash algorithm?

Scanning /etc/shadow you notice most daemon accounts show * or ! where a hash would be. What does that value mean, and why is the file itself locked down to root?

A university wants student accounts that force a password change at first login, expire the password every 100 days, and shut off entirely at year end. Which command manages these shadow aging fields, and what does chage -d 0 -M 100 -E 2024-12-31 do?

Minimum password quality on Linux isn't enforced by passwd itself but delegated to PAM — and which module does it varies by distribution. Which module does each major family use?

You forgot the root password on a machine you physically control. What is the standard recovery procedure, and which step lets passwd operate on the installed system rather than the rescue environment?

On Debian/Ubuntu you set faillog -m 3 to lock accounts after three bad logins. What critical follow-up command must you run, and why does opening /var/log/faillog in a text editor show garbage?

You're setting up an NFS environment where the same users must appear on many machines with consistent UIDs and GIDs. Why is per-machine /etc/passwd the wrong approach, and what mechanisms replace it?

What role does PAM play between commands like passwd, login, and cron and the actual authentication, and how can you check whether a given binary uses it?

PAM configuration lives in /etc/pam.d/ with rules of the form Type Response module. What are the four rule types, and what does each govern?

In /etc/nsswitch.conf, what does the sss access method actually contact, and how does mdns differ from an ordinary dns lookup?

When user management runs through a slow network service like LDAP, what does nscd add to the picture, where is it configured, and how does it relate to sssd?

In a PAM stack, what is the difference between a requisite and a required control keyword when a module fails — and why does the distinction matter for security?

On a Fedora/RHEL box you hand-edit a file in /etc/pam.d to change authentication, and your change gets wiped or the system warns you not to. What is the supported way to configure PAM there?

PAM decides how to authenticate, but something else decides where user, group, and host names are looked up. What subsystem is that, which file configures it, and what does a line like passwd: files systemd sss mean?

During a Fedora installation you never see a user-creation screen. When does Fedora actually create your account, and what state are that user and root left in?

You run userdel bob and later notice /home/bob is still on disk eating space. Which single option would have removed it along with the account?

A provisioning script must create dozens of users and set each password without any interactive prompt. Which command sets passwords non-interactively, and what generates strong random ones?

A user needs to use the serial port but gets permission denied on /dev/ttyS1. On Linux, how is access to hardware devices actually gated?

New files you create are stamped with your primary group, but you want the next few files to belong to a shared project group instead. Which command switches your active group, and what is the alternative afterward?

Beyond useradd/userdel, Linux ships a matching trio for managing groups themselves. What are the three commands and what does each do?

Without editing any files, how do you quickly check your own UID plus every group you currently belong to, and which command bulk-creates many accounts at once?

UIDs have well-known ranges — GIDs have their own conventions too. How are GID numbers partitioned, and what constraint links the GID in /etc/passwd to /etc/group?

Where does useradd get its defaults — like the default password validity period and the UID/GID ranges to hand out — from?

PAM normally rejects weak passwords (too short, dictionary words). Yet an admin can still assign a trivially weak password. Who is exempt from the quality rules, and for whom?

The faillog-based lockout mechanism you set up on Debian doesn't exist on a Fedora/RHEL box. What does that family use to lock accounts after failed logins, and is it active out of the box?

Just like users, a group can have its own password. Which command sets it, where is it stored, and when does anyone actually get prompted for it?

In /etc/pam.d, how does PAM know which service a config file governs, where do Debian/SUSE keep the shared defaults, and what does a leading minus sign on a rule type do?

You create several accounts with useradd but deliberately give them no password (e.g. Samba-only users). What is their login state, and why is that convenient here?

In a PAM stack, one control keyword can short-circuit the whole stack with success, while another only matters in a special case. What do sufficient and optional do?

Besides files, sss, and dns, /etc/nsswitch.conf accepts several other access methods. What do compat, db, and systemd resolve, and what happens if a method's backing library isn't installed?