Linux users and groups cheat sheet

The chapter on one page: what to remember, the commands to have at your fingertips, and flashcards for quick revision.

The chapter in eight sentences

Every account has a UID and every group a GID: 0 is root, 1 to 999 are system accounts, and people start at 1000.
Each user has one primary group (field 4 of /etc/passwd) and any number of supplementary groups (listed in /etc/group).
/etc/passwd holds accounts, /etc/group groups, and the root-only /etc/shadow password hashes and ageing.
su - becomes root with root's password; sudo runs commands as root with your own password, only if a rule allows it, and logs every one.
Members of wheel have full sudo on RHEL; narrower rules go in /etc/sudoers.d/NAME, mode 440, checked with visudo -c.
useradd, usermod, userdel -r, groupadd, groupmod, groupdel and gpasswd manage accounts; usermod -aG adds a group, -G alone replaces them all.
passwd sets passwords; chage sets ageing (-M, -m, -W, -I), forces a change (-d 0) and expires accounts (-E).
Locking (usermod -L) stops password logins only; expiring an account stops every login.

Command	Does
`id USER`	UID, primary group and groups
`useradd [-u UID] [-g GROUP] [-G G1,G2] [-c TEXT] [-s SHELL] NAME`	Create an account
`usermod -aG GROUP NAME`	Add a supplementary group
`usermod -c TEXT`, `-s SHELL`, `-L`, `-U`	Comment, shell, lock, unlock
`userdel -r NAME`	Delete with home directory
`groupadd [-g GID] NAME`, `groupmod -n NEW OLD`, `groupdel NAME`	Groups
`gpasswd -a USER GROUP`, `gpasswd -d USER GROUP`	Add, remove a member

Command	Does
`passwd [USER]`	Set a password
`passwd -S USER`	Status: LK locked, PS set, NP none
`chage -l USER`	Show ageing as dates
`chage -M 90 -m 1 -W 7 USER`	Max, min, warning
`chage -d 0 USER`	Change at next login
`chage -E YYYY-MM-DD USER`, `chage -E 0 USER`	Expire on a date, now
`/etc/login.defs`	Defaults for new accounts

Command	Does
`su -`	Root login shell (root's password)
`sudo CMD`, `sudo -i`	Run as root, root shell (your password)
`sudo -l`	What you may run
`%group ALL=(ALL) ALL`	Group may run anything
`user ALL=(ALL) /usr/bin/systemctl`	One command, any arguments
`NOPASSWD:`	Skip the password prompt
`visudo -c`, `visudo -cf FILE`	Check syntax
`/var/log/secure`	sudo's record

Which UID is root, and where do regular users start?: Root is **0**; regular users start at **1000**.
Where are password hashes kept?: `/etc/shadow`, readable only by root.
Primary or supplementary group, which owns the files a user creates?: The **primary** group.
su - or sudo, whose password does each ask for?: `su -` asks for root's; `sudo` asks for your own.
Why is student allowed to use sudo in the lab?: It is in the **wheel** group, which `/etc/sudoers` allows to run any command.
Safe place and permissions for a new sudo rule?: A file in `/etc/sudoers.d`, mode **440**, checked with `visudo -c`.
Add bob to the docker group, keeping his other groups?: `usermod -aG docker bob`
Delete an account and its home directory?: `userdel -r NAME`
Force a password change at the next login?: `chage -d 0 NAME`
Make an account stop working on a date?: `chage -E YYYY-MM-DD NAME`
Lock or expire, which also blocks SSH keys?: **Expire** (`chage -E 0`). A lock only blocks the password.