Ubuntu Security · 4.1

👤 User & Group Management

Add, remove, and audit user accounts the right way⏱ ~3 min

User and group management on Ubuntu is done primarily through the command line. The key files are /etc/passwd (user info), /etc/shadow (encrypted passwords), and /etc/group (group membership).

Key User Files

File	Contains	View With
/etc/passwd	Username, UID, GID, home dir, shell — one line per user	cat /etc/passwd
/etc/shadow	Encrypted passwords and password aging info — root only	sudo cat /etc/shadow
/etc/group	Group names, GID, member list	cat /etc/group

Reading /etc/passwd

bash

# Format: username:password:UID:GID:comment:home:shell
# Example:
alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash
#     ^                                    ^ shell — /bin/false or /sbin/nologin
#       means password is in /shadow        means account cannot log in interactively
 
# UIDs to know:
# 0        = root (superuser)
# 1-999    = system accounts (daemons, services)
# 1000+    = human users

Competition Commands — User Management

bash

# List all users
cat /etc/passwd
getent passwd          # same, but works even with LDAP/NIS
 
# Add a user (creates home dir, sets up defaults)
sudo adduser alice
 
# Remove a user
sudo deluser bob
sudo deluser --remove-home bob   # also deletes /home/bob
 
# Set or change a password
sudo passwd alice
 
# Check what groups a user is in
groups alice
id alice

Competition Commands — Group Management

bash

# Create a new group
sudo groupadd physics
 
# Add a user to a group
sudo gpasswd -a alice physics
# or: sudo usermod -aG physics alice
 
# Remove a user from a group
sudo gpasswd -d alice physics
 
# Delete a group
sudo groupdel physics
 
# List members of a group
getent group physics
members physics           # if 'members' package is installed

Check Who Has sudo Access

bash

# Users in the sudo group can use sudo
getent group sudo
 
# Users in the admin group also typically have sudo
getent group admin
 
# View sudoers file (be careful, use visudo to edit)
sudo cat /etc/sudoers

🔒 SecurityCompetition: compare the list of users in the 'sudo' group against the scenario's list of authorized administrators. Remove unauthorized users from the sudo group with: sudo gpasswd -d USERNAME sudo

🧠Quick Checkfirst try = +5 XP

How do you remove a user from the sudo group on Ubuntu?

🎮 Practice what you learned

🏰

Password Fort

Build passwords that survive a brute-force siege

→🕵️

Log Analysis

Hunt attackers through real firewall & access logs

→

⭐ 0 XP🔥 0 days

Open the full interactive CyberPatriot Prep module →