Chapter 3 of 520% of exam

Services & User Management

This domain covers managing the accounts, groups, and network services that make a system usable and secure. You will configure who can log in, what privileges they hold, and how services are exposed. Correct account and service hygiene prevents both outages and breaches.

Creating and Managing Users

Accounts are created with 'useradd' (using -m for a home directory and -s for a shell) and modified with 'usermod'. Passwords are set with 'passwd', and account aging is controlled with 'chage'. User records live in /etc/passwd with hashed credentials in /etc/shadow. Removing accounts with 'userdel -r' also cleans up the home directory.

Groups and Membership

Groups organize users for shared permissions and are created with 'groupadd'. A user has one primary group and any number of supplementary groups. Add someone to a supplementary group without disturbing existing memberships using 'usermod -aG group user'; omitting -a would replace their groups. Group definitions are stored in /etc/group.

Privilege Escalation with sudo

sudo grants controlled administrative access without sharing the root password. Rules are defined in /etc/sudoers and drop-in files under /etc/sudoers.d, always edited with 'visudo' to catch syntax errors before saving. You can scope commands, hosts, and target users precisely, and log every elevated action. Least-privilege sudo rules are safer than granting blanket root access.

Managing Services

Network and system services are managed through systemd units with systemctl. Enable a service to start at boot, start it immediately, and confirm with 'systemctl status'. Many services read configuration from /etc and expose logs through the journal. Understanding the difference between enabled (boot) and active (running) states is essential.

Scheduling and Access Control

Recurring jobs for users are scheduled with crontab, while system-wide jobs live in /etc/cron.d and related directories. Login access can be restricted through PAM, /etc/security limits, and shells such as /sbin/nologin for service accounts. Time-based and host-based restrictions further tighten who can use a system. These controls keep services available to the right people only.

Report