Sys Admin User Management

This tutorial dives into user management skills for system administrators. You’ll learn how to manage users and groups efficiently, automate tasks, enforce security policies, and troubleshoot common issues. By the end, you’ll be equipped to handle complex user management scenarios in real-world environments.

Beginner30 minutes

Step 1: Understanding User and Group Management Basics

Before diving into advanced techniques, ensure you understand the basics of user and group management in Linux. Learn how to create, modify, and delete users and groups using commands like useradd, usermod, groupadd, and groupmod.

- Key Concepts: UID, GID, primary group, secondary groups, /etc/passwd, /etc/group, and /etc/shadow.

- Real-World Scenario: A new employee joins your organization. You need to create their account and assign them to the appropriate groups for access to shared resources.

# Create a new user
sudo useradd -m -s /bin/bash jdoe

# Add the user to a secondary group
sudo usermod -aG developers jdoe

Practice Exercise

Create a user named alice with a home directory, set her default shell to /bin/zsh, and add her to the admins and developers groups. Verify her group memberships.

Show Solution

# Create the user
sudo useradd -m -s /bin/zsh alice

# Add her to the groups
sudo usermod -aG admins,developers alice

# Verify group memberships
id alice
# Output should show alice is part of admins and developers

Step 2: Implementing Password Policies

Enforce strong password policies to enhance system security. Use tools like chage and passwd to manage password expiration, complexity, and history.

- Key Concepts: Password aging, password complexity, password history.

- Real-World Scenario: Your organization requires passwords to expire every 90 days and users to change them immediately upon first login.

# Set password expiration for a user
sudo chage -M 90 -m 7 -W 7 jdoe

# Force a user to change their password on first login
sudo passwd --expire jdoe

Practice Exercise

Configure a user named bob to have a password that expires every 60 days, with a minimum of 5 days between changes, and a warning 7 days before expiration. Force him to change his password on the next login.

Show Solution

# Set password aging policies
sudo chage -M 60 -m 5 -W 7 bob

# Force password change on next login
sudo passwd --expire bob

Step 3: Automating User Management with Scripts

Automate repetitive user management tasks using shell scripts. Learn how to create, modify, and delete users in bulk, and apply consistent configurations.

- Key Concepts: Shell scripting, loops, conditionals, command-line arguments.

- Real-World Scenario: You need to create 50 new user accounts for a new department, all with the same default settings.

#!/bin/bash
for i in {1..50}
do
  username="user$i"
  sudo useradd -m -s /bin/bash $username
  echo "User $username created."
done

Practice Exercise

Write a script that creates 10 users named intern1 to intern10, assigns them to the interns group, and sets their passwords to Welcome123. Ensure the script logs all actions to a file named user_creation.log.

Show Solution

#!/bin/bash
for i in {1..10}
do
  username="intern$i"
  sudo useradd -m -s /bin/bash $username
  sudo usermod -aG interns $username
  echo "Welcome123" | sudo passwd --stdin $username
  echo "User $username created and added to interns group." >> user_creation.log
done

Step 4: Managing Sudo Privileges

Control access to administrative commands using sudo. Learn how to configure the /etc/sudoers file and use visudo for safe editing.

- Key Concepts: Sudoers syntax, command aliases, user and group privileges.

- Real-World Scenario: You need to grant a group of developers the ability to restart services without giving them full root access.

# Edit the sudoers file safely
sudo visudo

# Add a line to grant privileges
velopers ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart *

Practice Exercise

Grant the admins group the ability to manage user accounts (e.g., useradd, usermod, userdel) without requiring a password. Ensure the changes are made safely using visudo.

Show Solution

# Open the sudoers file for editing
sudo visudo

# Add the following line
mins ALL=(ALL) NOPASSWD: /usr/sbin/useradd, /usr/sbin/usermod, /usr/sbin/userdel

Step 5: Auditing User Activity

Monitor user activity to detect unauthorized actions or security breaches. Use tools like last, who, and auditd to track logins, commands, and file access.

- Key Concepts: Log files, audit logs, real-time monitoring.

- Real-World Scenario: You suspect a user is accessing sensitive files outside their permissions. You need to track their activity.

# View recent logins
last

# Monitor real-time user activity
sudo auditctl -w /etc/shadow -p wa -k shadow_access

Practice Exercise

Set up an audit rule to monitor all attempts to modify the /etc/passwd file. Generate a report of these attempts using ausearch.

Show Solution

# Add an audit rule
sudo auditctl -w /etc/passwd -p wa -k passwd_modification

# Generate a report
sudo ausearch -k passwd_modification

Step 6: Troubleshooting User Management Issues

Learn how to diagnose and resolve common user management problems, such as login failures, permission issues, and locked accounts.

- Key Concepts: Error messages, log files, permission checks.

- Real-World Scenario: A user reports they cannot log in, and you suspect their account is locked or their password has expired.

# Check if an account is locked
sudo passwd -S jdoe

# Unlock an account
sudo usermod -U jdoe

Practice Exercise

A user named charlie cannot log in. Investigate the issue by checking their account status, password expiration, and group memberships. Provide a solution if you find a problem.

Show Solution

# Check account status
sudo passwd -S charlie

# Check password expiration
sudo chage -l charlie

# Check group memberships
id charlie

# Example solution: If the account is locked, unlock it
sudo usermod -U charlie

Step 7: Implementing Role-Based Access Control (RBAC)

Use RBAC to assign permissions based on roles rather than individual users. This simplifies management and improves security.

- Key Concepts: Roles, permissions, inheritance.

- Real-World Scenario: You need to create roles for developers, admins, and auditors, each with specific access levels.

# Create roles and assign permissions
sudo groupadd developers
sudo groupadd admins
sudo groupadd auditors

# Assign permissions to roles
sudo visudo
# Add lines like:
velopers ALL=(ALL) NOPASSWD: /usr/bin/git
mins ALL=(ALL) ALL
%auditors ALL=(ALL) NOPASSWD: /usr/bin/less /var/log/*

Practice Exercise

Create a role named support that allows users to view logs in /var/log/ but not modify them. Assign this role to a user named dave.

Show Solution

# Create the support group
sudo groupadd support

# Assign permissions to the support role
sudo visudo
# Add the following line:
%support ALL=(ALL) NOPASSWD: /usr/bin/less /var/log/*

# Add dave to the support group
sudo usermod -aG support dave

Step 8: Securing User Accounts with SSH Keys

Enhance security by replacing password-based authentication with SSH keys. Learn how to generate, distribute, and manage SSH keys.

- Key Concepts: Public/private key pairs, ~/.ssh/authorized_keys, SSH configuration.

- Real-World Scenario: You need to configure SSH key-based authentication for all developers to access a remote server.

# Generate an SSH key pair
ssh-keygen -t rsa -b 4096 -C "jdoe@example.com"

# Copy the public key to the remote server
ssh-copy-id jdoe@remote-server

Practice Exercise

Generate an SSH key pair for a user named emma, copy the public key to a remote server at 192.168.1.100, and disable password-based SSH authentication for her account.

Show Solution

# Generate the SSH key pair
ssh-keygen -t rsa -b 4096 -C "emma@example.com"

# Copy the public key to the remote server
ssh-copy-id emma@192.168.1.100

# Disable password authentication for emma
sudo usermod -s /usr/sbin/nologin emma