5.1 Basic Security and Identifying User Types
Key Takeaways
- Linux accounts fall into three practical types: root (UID 0), standard human users, and system/service accounts used by daemons
- /etc/passwd holds public account metadata; /etc/shadow holds password hashes and aging fields; /etc/group maps group names to GIDs and membership
- id shows your UID/GID and groups; who, w, and last report who is (or was) logged in
- su switches user (often to root); sudo runs one command with elevated rights when your account is permitted
- Never log in as root for routine work—use a standard account and escalate only when needed
5.1 Basic Security and Identifying User Types
Every process on Linux runs as some user. That identity controls which files you can read, write, or execute—and whether you may change other accounts. Topic 5.1 asks you to recognize who is on the system, what kind of account they use, and how privilege escalation works with su and sudo.
Three user types you must distinguish
| Type | Typical UID | Role | Example |
|---|---|---|---|
| Root | 0 | Superuser; bypasses normal permission checks | root |
| Standard (human) users | Usually 1000+ on modern distros | Interactive login accounts for people | alice, bob |
| System / service users | Low numbers (often 1–999) | Run daemons and services without a human login | www-data, nobody, sshd |
Root is the administrative account (UID 0). It can change ownership, edit /etc, install packages, and manage users—and a mistyped rm as root can destroy the system. Treat root as an exception, not a daily login.
Standard users are the accounts people use day to day. They own their home directories (commonly /home/username), can edit their own files, and need elevation for system-wide changes.
System users exist so services do not need root for every action. A web server might run as www-data so a compromised site process cannot freely rewrite the whole disk. These accounts often have no usable password and a shell set to something like /usr/sbin/nologin or /bin/false.
Worked example: On a laptop, you log in as
jordan(UID 1000). You browse the web as that user. When you install a package, you briefly become root viasudo. Thenginxworker processes may run aswww-data(a system UID), not asjordanorroot.
Account files: passwd, shadow, and group
Linux stores classic account databases as text files under /etc. You should know what each file holds and that password hashes are not in passwd on modern systems.
/etc/passwd — public account records
Each line is colon-separated. A typical entry looks like:
alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash
| Field (order) | Meaning |
|---|---|
| 1 Username | Login name |
| 2 Password placeholder | Usually x meaning “see shadow” |
| 3 UID | Numeric user ID |
| 4 GID | Primary group ID |
| 5 GECOS | Comment (often full name) |
| 6 Home directory | e.g. /home/alice |
| 7 Login shell | e.g. /bin/bash or /usr/sbin/nologin |
/etc/passwd is world-readable so programs can map UIDs to names—hence password hashes live in shadow instead.
/etc/shadow — secrets and aging
/etc/shadow is readable only by root (and sometimes a dedicated group). Fields include the username, the hashed password, and aging data (last change, minimum/maximum age, warn days, inactive days, expiration). If the password field is ! or * (conventions vary slightly by distro), the account cannot authenticate with a password.
/etc/group — groups and membership
Groups collect users for shared access. A line might look like:
developers:x:1500:alice,bob
| Field | Meaning |
|---|---|
| Group name | e.g. developers |
| Password placeholder | Usually x |
| GID | Numeric group ID |
| Members | Comma-separated usernames (supplementary membership) |
Every user also has a primary group (the GID in passwd). Supplementary groups appear in the members list of /etc/group.
Commands that identify users and sessions
| Command | What it tells you |
|---|---|
id | Current UID, GID, and all group memberships |
id alice | Same data for another account (if permitted) |
who | Who is logged in (and often from where) |
w | Logged-in users plus what they are doing / load |
last | Recent login history from the wtmp log |
id is the fastest self-check: after sudo -i or su -, run id and confirm UID 0 before doing destructive work. who and w answer “is anyone else on this machine?” last helps audit “who logged in recently?”—useful on shared lab systems.
id
who
w
last | head
Escalating privileges: su vs sudo
| Tool | Typical use | Password asked |
|---|---|---|
su / su - | Switch to another user shell (often root) | Target user’s password (root’s, unless already root) |
sudo command | Run one command as root (or another user) | Your password, if your sudoers policy allows it |
su means “switch user.” Bare su usually switches to root while keeping parts of your environment; su - (or su - root) starts a login-like root session with root’s home and PATH.
sudo (“superuser do”) is the modern default on many distros. Allowed users are listed in the sudoers policy. Then sudo apt install ... or sudo cat /etc/shadow runs that one command with elevated rights. After success, sudo may cache credentials briefly.
Worked contrast:
su -asks for the root password and opens a root shell.sudo -ialso aims for an interactive root shell, but authenticates with your password if you are allowed. On many cloud images, root login is disabled and onlysudoworks—know both concepts for the exam.
Security habits Essentials expects
- Use a standard user for browsing, editing, and coding.
- Escalate with
sudo(or a briefsu -) only for admin tasks. - Prefer least privilege: services should run as a system user when possible.
- Remember: the account files and
id/who/w/lastare as testable assudo.
Topic 5.1 is the vocabulary layer for 5.2–5.4: you must name user types and the files that define them before creating accounts or applying modes.
Which file stores hashed passwords and password aging fields on a typical modern Linux system?
A process shows UID 0. What does that identify?
You want a quick report of your numeric UID, primary GID, and all group memberships. Which command is best?
On a system where your account is permitted in sudoers, what does sudo typically ask for when you run sudo apt update?