Services & User Management
This domain covers managing the accounts, groups, and network services that make a system usable and secure. You will configure who can log in, what privileges they hold, and how services are exposed. Correct account and service hygiene prevents both outages and breaches.
Creating and Managing Users
Accounts are created with 'useradd' (using -m for a home directory and -s for a shell) and modified with 'usermod'. Passwords are set with 'passwd', and account aging is controlled with 'chage'. User records live in /etc/passwd with hashed credentials in /etc/shadow. Removing accounts with 'userdel -r' also cleans up the home directory.
Groups and Membership
Groups organize users for shared permissions and are created with 'groupadd'. A user has one primary group and any number of supplementary groups. Add someone to a supplementary group without disturbing existing memberships using 'usermod -aG group user'; omitting -a would replace their groups. Group definitions are stored in /etc/group.
Privilege Escalation with sudo
sudo grants controlled administrative access without sharing the root password. Rules are defined in /etc/sudoers and drop-in files under /etc/sudoers.d, always edited with 'visudo' to catch syntax errors before saving. You can scope commands, hosts, and target users precisely, and log every elevated action. Least-privilege sudo rules are safer than granting blanket root access.
Managing Services
Network and system services are managed through systemd units with systemctl. Enable a service to start at boot, start it immediately, and confirm with 'systemctl status'. Many services read configuration from /etc and expose logs through the journal. Understanding the difference between enabled (boot) and active (running) states is essential.
Scheduling and Access Control
Recurring jobs for users are scheduled with crontab, while system-wide jobs live in /etc/cron.d and related directories. Login access can be restricted through PAM, /etc/security limits, and shells such as /sbin/nologin for service accounts. Time-based and host-based restrictions further tighten who can use a system. These controls keep services available to the right people only.