7.2 Managing Unix Users and Groups

Creating Users: adduser vs useradd

Debian (and therefore Kali) offers two account-creation commands, and the exam expects you to distinguish them. useradd is the low-level, non-interactive binary from the shadow password suite, shipped on Debian and Kali in the passwd package. Called bare — useradd alice — it creates only the account entry: no home directory, no files copied, and on Debian the default shell may not even be set the way you expect. To get a usable account you must spell it out: useradd -m -s /bin/bash alice creates the home directory (-m) and sets the login shell (-s).

adduser is a Perl wrapper around useradd, driven by /etc/adduser.conf. It is interactive and opinionated: adduser alice prompts for a password and optional GECOS details, creates /home/alice, populates it from the /etc/skel skeleton directory, picks the next free UID, and sets the shell. For day-to-day administration on Kali, adduser is the recommended tool; useradd is for scripts where you want exact, flag-controlled behavior. The same split exists on the group side: addgroup admins (friendly wrapper) versus the low-level groupadd.

The Account Databases: /etc/passwd and /etc/shadow

Every local account is a line in /etc/passwd with seven colon-separated fields:

kali:x:1000:1000:Kali,,,:/home/kali:/usr/bin/zsh

1. Username — kali
2. Password placeholder — always x on modern systems; the real hash lives in /etc/shadow
3. UID — user ID; regular users start at 1000, root is 0
4. GID — primary group ID
5. GECOS — comment field (full name, room, phone)
6. Home directory
7. Login shell — the image's own kali account uses zsh (/usr/bin/zsh) since Kali 2020.4, but accounts you create afterwards still get /bin/bash from adduser (and /bin/sh from a bare useradd); /usr/sbin/nologin here denies interactive login (common for service accounts)

/etc/passwd must be world-readable because so many programs map UIDs to names. That is precisely why passwords were moved to /etc/shadow, which is readable only by root. Its nine colon-separated fields: username, encrypted password hash, date of last change, minimum days between changes, maximum days a password is valid, warning period, inactivity lockout, account expiration date, and a final reserved field. The hash field tells a story on sight: $y$ or $6$ prefixes indicate yescrypt or SHA-512 crypt, ! or * is not a valid crypt() result, so no password can ever match and password login is impossible (SSH keys may still work) — which is different from an empty field, meaning no password is required at all, and ! in front of a hash is exactly what passwd -l writes to lock an account. Aging is manipulated with chage, for example chage -l alice to list her policy.

Groups and /etc/group

/etc/group lists each group as name:x:GID:member-list, where the member list holds supplementary members only — a user's primary group comes from /etc/passwd and need not be repeated. Group password hashes, rarely used, live in /etc/gshadow. Every user gets a same-named private group by default (user private group scheme), so id alice shows uid=1000(alice) gid=1000(alice) groups=1000(alice),....

To modify membership, the canonical command is:

usermod -aG sudo alice

• -G sets the user's supplementary groups to exactly the list you give
• -a appends instead of replacing

Omitting -a is the classic disaster: usermod -G wireshark alice silently strips alice from every other supplementary group, including sudo. The exam loves this distinction. Changes to group membership apply to new logins — a running session keeps its old groups until re-login (or newgrp). Other useful group commands: gpasswd -a alice wireshark (add one member), gpasswd -d alice wireshark (remove), groups alice to view membership, and addgroup/delgroup/groupmod to create, remove, or renumber groups. Debian's own shorthand for adding an existing user to an existing group — the form Kali Linux Revealed documents — is simply adduser alice wireshark, and newgrp/sg switch group identity inside the current session.

Two more command families round out the account toolkit. To query the account databases through NSS rather than reading the files directly, use getent: getent passwd alice, getent group sudo. To modify individual fields, use the targeted tools instead of editing by hand: chfn (the GECOS/full-name field), chsh (login shell — non-root users may only pick a shell listed in /etc/shells), chage (password aging), and passwd -e alice to force a change at next login. usermod -L alice / usermod -U alice lock and unlock exactly like passwd -l / passwd -u, both writing and stripping a leading ! on the hash. For direct file edits, vipw and vigr take the proper locks.

sudo and the sudo Group

Root privileges on Kali are exercised through sudo, configured by /etc/sudoers (edit it only with visudo, which syntax-checks before saving). Debian's convention is the line %sudo ALL=(ALL:ALL) ALL, meaning every member of the sudo group may run any command as any user. So granting admin rights is just group membership: usermod -aG sudo alice. Related groups worth recognizing: adm (read system logs), wireshark (capture packets without root), and kaboxer/docker-style service groups. Prefix a command with sudo to run it as root; sudo -i or sudo su - opens a root shell, and sudo caches credentials for a few minutes so you are not re-prompted per command.

Passwords and Account Removal

A normal user changes their own password with passwd; root changes anyone's with passwd alice. Useful root options: passwd -l alice locks the account (prefixes the hash with !), passwd -u unlocks, and passwd -e alice expires the password to force a change at next login.

To remove an account, prefer deluser, adduser's counterpart: deluser alice removes the account, and deluser --remove-home alice also deletes her home directory and mail spool. The low-level equivalent is userdel -r alice. Deleting a user does not magically delete every file they owned elsewhere — orphaned files keep the numeric UID and can be found with find / -uid 1001 -nouser.

Kali's Non-Root Policy

Historically, BackTrack and early Kali ran everything as root — acceptable for a live pentest session, terrible as a daily-driver habit. Since Kali 2020.1, the default model changed: live images and standard installs log you in as the non-root user kali with default password kali (on live media), and administrative actions go through sudo. The reasoning is defense in depth: a browser exploit or mistyped command as a normal user cannot instantly own the whole system, sudo leaves an audit trail in the logs, and modern Kali is used as a primary OS, not just a throwaway live session. The root account itself is locked for direct login by default — you elevate per command instead of inhabiting root. This mirrors Debian and Ubuntu practice and is a frequently tested cultural point: Kali is a security distribution that nonetheless applies basic security hygiene to itself.