MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:45Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 152:		Line 152:
	[[Category:Linux User Auditing\|023]]		[[Category:Linux User Auditing\|023]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/linux/user_auditing/intro_user_auditing.md

2026-09-18T17:06:26Z

Import from cypat.guide: docs/linux/user_auditing/intro_user_auditing.md

New page

{{Submit}}

-----

Author(s): c-bass

Last Updated: 7-1-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None! This is an introductory article.

|}

== Fundamental concepts ==

=== Users ===

A '''user''' on linux is just like a user on other operating systems, like MacOS or Windows: it's an account that represents something (a person or a process) that can access the system. Every user gets a unique username, a password, a home folder (called a ''directory'' on linux), and a UID (User ID, a number used by the system to uniquely identify users).

=== Groups ===

Put simply, a '''group''' on linux is a collection of users that share the same permissions. This makes access control significantly easier. Say you have a set of users that need access to a directory-- you can put them all in a group and give the group itself, not the individual users, access to that directory. This is advantageous since if you need to give more users access in the future, you can simply add them to the group. Note this is a ''singular'' use of groups - there are many other uses - but this demonstrates the usefulness groups can have. Each group has a GID (Group ID), just like how each user has a UID.

== Key files ==

=== The /etc/passwd file ===

The <code>/etc/passwd</code> file stores user info. Let's explore how it works:

<syntaxhighlight lang="bash">ubuntu@ubuntu:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
...
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash</syntaxhighlight>
There's one line per user. The first user listed is the ''root user'', having a UID of 0. This should be the only user to have this uid. The root user is an administration account with unrestricted access to the system. System users have UIDs below 1000 (like <code>daemon</code> in the output above), and normal users (like the <code>ubuntu</code> user above) have UIDs 1000 or greater.

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! What is a system user? (click to expand)
|-
|

Many of the users above are ''system users'', meaning they're for system accounts and not meant for actual use. A user is a system user if it has a UID under 1000. System users exist because many programs/services need a user account to own their respective files. For instance, a webserver needs a system account to own files in <code>/var/www</code>.

|}

Each line in <code>/etc/passwd</code> follows this format:

<syntaxhighlight lang="text">username:password:UID:GID:comment:home_directory:shell</syntaxhighlight>
There are some important things to note about this:

* Each user's password isn't stored in <code>/etc/passwd</code>, instead a ''placeholder'' takes the password field. Typically that placeholder is <code>x</code>, denoting the password hash is stored in another file (<code>/etc/shadow</code>). The same goes for the <code>/etc/group</code> file!
* While normal users have loginable shells, like <code>/bin/bash</code>, system users by convention don't have loginable shells, usually <code>/bin/false</code> or <code>/usr/sbin/nologin</code>.
* A GID denotes a user's ''primary group''. Secondary groups (often called supplementary groups) are denoted by entries in <code>/etc/group</code>. This'll be explained more below!

=== The /etc/group file ===

Like how <code>/etc/passwd</code> stores user info, the <code>/etc/group</code> file stores group info.

<syntaxhighlight lang="text">ubuntu@ubuntu:~$ cat /etc/group
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
...
sudo:x:27:ubuntu
...</syntaxhighlight>
Each line follows this structure:

<syntaxhighlight lang="text">group:password:GID:users</syntaxhighlight>
A particularly important group is <code>sudo</code>: any user in the <code>sudo</code> group effectively has full access to the system.

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! What is a primary group? What is a supplementary group? (click to expand)
|-
|

Every user has exactly one '''primary group''' that is assigned when the user account is created - this is the group that owns files when the user creates them. Users can also belong to multiple '''supplementary groups''' (also called secondary groups) which give them additional permissions beyond their primary group. For example, a user named "josh" might have "josh" as their primary group but also belong to supplementary groups like "sudo" and "docker" to access those specific services. Primary groups are denoted by a user's GID in <code>/etc/passwd</code>, and supplementary groups are denoted by entries in <code>/etc/group</code>.

|}

=== The /etc/shadow file ===

The <code>/etc/shadow</code> file stores password hashes and other important information.

<syntaxhighlight lang="text">ubuntu@ubuntu:~$ sudo cat /etc/shadow
root:!:19827:0:99999:7:::
daemon:*:19790:0:99999:7:::
bin:*:19790:0:99999:7:::
sys:*:19790:0:99999:7:::
sync:*:19790:0:99999:7:::
...
ubuntu:<hash>:19827:0:99999:7:::</syntaxhighlight>
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Why do we need sudo here, but not /etc/passwd and /etc/group? (click to expand)
|-
|

Password hashes are ''incredibly'' sensitive information. If someone has an insecure password, it's usually trivial to find it if you have their hash. For this reason, we need root permissions (granted through <code>sudo</code>) to view the <code>/etc/shadow</code> file. In contrast, the info in <code>/etc/passwd</code> and <code>/etc/group</code> is less critical.

|}

It's beyond the scope of introductory user auditing to explain the structure of the <code>/etc/shadow</code> file-- for now, just know it exists and what its purpose is.

== Hardening ==

=== User Auditing ===

Since users are stored in <code>/etc/passwd</code>, you can use this command to get a list of all users on the system with loginable shells:

<syntaxhighlight lang="text">grep "/bin/.*sh$" /etc/passwd | cut -d: -f1</syntaxhighlight>
In a system hardening scenario, you're usually given a list of authorized users: compare that list to the actual users present.

For any users not supposed to be on the system, remove them:

<syntaxhighlight lang="text">sudo deluser <user></syntaxhighlight>
To remove their home directory too, use:

<syntaxhighlight lang="text">sudo deluser --remove-home <user></syntaxhighlight>
<code>userdel</code> also works if needs be, but <code>deluser</code> is standard. Alternatively, simply remove the user's entry in <code>/etc/passwd</code>.

If you need to add a user to the system, run:

<syntaxhighlight lang="text">sudo adduser <user></syntaxhighlight>
<code>useradd</code> also works in case <code>adduser</code> isn't available.

=== Group Auditing ===

Check the members of the sudo group:

<syntaxhighlight lang="text">getent group sudo</syntaxhighlight>
Alternatively,

<syntaxhighlight lang="text">grep sudo /etc/group</syntaxhighlight>
In a system hardening scenario, compare this to known authorized admins. To remove an unauthorized admin (but keep them on the system), do:

<syntaxhighlight lang="text">sudo deluser username sudo</syntaxhighlight>
Alternatively, you can modify the <code>/etc/group</code> file and remove the user from the <code>sudo</code> group manually.

=== Other Hardening ===

If a user has an insecure password, change it!

<syntaxhighlight lang="text">passwd <user></syntaxhighlight>
It'll then prompt you for the user's new password.

[[Category:Linux User Auditing|023]]
[[Category:Migrated from cypat.guide]]

Draft:User Auditing - Beginner - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/linux/user_auditing/intro_user_auditing.md