User Management

UID_MIN         1000
UID_MAX        60000
SYS_UID_MIN      201
SYS_UID_MAX      999
GID_MIN         1000
GID_MAX        60000

# Create a system user (UID below 1000, no home, no login)
sudo useradd -r -s /usr/sbin/nologin <service-name>

# Create a system user with a specific home directory
sudo useradd -r -s /usr/sbin/nologin -d /var/lib/<service-name> -m <service-name>

# Verify the assigned UID
id <service-name>

# Set a user's shell to nologin (disable interactive login)
sudo usermod -s /usr/sbin/nologin <username>

# List valid shells
cat /etc/shells

# Change your own shell
chsh -s /bin/zsh

sudo find / -user <old-uid> -exec chown <new-uid> {} +

id <username>                # Show UID, GID, and groups
whoami                       # Show current user
who                          # Show logged-in users
w                            # Show logged-in users with activity
last                         # Show login history
last <username>              # Show login history for a specific user
lastlog                      # Show last login of all users
faillog -a                   # Show failed login attempts
getent passwd <username>     # Query user from all NSS sources (LDAP, local, etc.)

username:x:UID:GID:comment:home:shell

username:$hash:last_change:min:max:warn:inactive:expire:reserved

# Add user to sudo/wheel group
sudo usermod -aG sudo <username>    # Debian/Ubuntu
sudo usermod -aG wheel <username>   # RHEL/Fedora/Arch

# Add a sudoers drop-in file (safer than editing /etc/sudoers directly)
echo "<username> ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/<username>
sudo chmod 440 /etc/sudoers.d/<username>

sudo visudo                          # edit /etc/sudoers
sudo visudo -f /etc/sudoers.d/myfile # edit a drop-in file

<who> <where>=(<runas>) <commands>

# Allow user full sudo with password
alice ALL=(ALL) ALL

# Allow group without password
%devops ALL=(ALL) NOPASSWD: ALL

# Allow specific commands only
bob ALL=(root) /usr/bin/systemctl restart nginx, /usr/bin/journalctl

# Allow a user to run commands as another user
deploy ALL=(www-data) NOPASSWD: /usr/bin/rsync

# Require password, but cache for 30 minutes
Defaults:alice timestamp_timeout=30

# Log all sudo commands to a file
Defaults logfile="/var/log/sudo.log"

# Show ACLs for a file
getfacl <file>

# Show ACLs for a directory
getfacl <directory>

# Grant a specific user read/write
setfacl -m u:<username>:rw <file>

# Grant a specific group read-only
setfacl -m g:<groupname>:r <file>

# Set default ACL on a directory (inherited by new files)
setfacl -d -m u:<username>:rwx <directory>

# Remove a specific ACL entry
setfacl -x u:<username> <file>

# Remove all ACLs (revert to standard permissions)
setfacl -b <file>

# Copy ACLs from one file to another
getfacl <source> | setfacl --set-file=- <target>

# Recursive ACL application
setfacl -R -m g:<groupname>:rx <directory>

# Set the mask (limits effective permissions)
setfacl -m m::rx <file>

# After setting: a user with rw ACL effectively gets only rx

-rw-rwxr--+ 1 alice devs 4096 Mar 22 10:00 report.txt

# Install quota tools
sudo apt install quota              # Debian/Ubuntu
sudo pacman -S quota-tools          # Arch

# Enable quotas in /etc/fstab (add usrquota,grpquota to options)
# /dev/sda1 /home ext4 defaults,usrquota,grpquota 0 2

# Remount the filesystem
sudo mount -o remount /home

# Initialize quota database
sudo quotacheck -cugm /home

# Enable quotas
sudo quotaon /home

# Edit quotas for a user (opens editor)
sudo edquota <username>

# Set quotas directly (soft=500M, hard=1G, inodes soft=10000, hard=15000)
sudo setquota -u <username> 500M 1G 10000 15000 /home

# Copy quotas from one user to another
sudo edquota -p <template-user> <target-user>

# View quota for a user
quota -u <username>

# View quota report for all users
sudo repquota -a

# Set a grace period for soft limits
sudo edquota -t

# Minimum password length
minlen = 12

# Require at least 1 uppercase, 1 lowercase, 1 digit, 1 special
ucredit = -1
lcredit = -1
dcredit = -1
ocredit = -1

# Reject passwords containing the username
usercheck = 1

# Reject dictionary words
dictcheck = 1

# Maximum consecutive identical characters
maxrepeat = 3

# Minimum number of character classes (uppercase, lowercase, digit, other)
minclass = 3

# Reject passwords similar to the old one
difok = 5

password requisite pam_pwquality.so retry=3 enforce_for_root
password required  pam_unix.so use_authtok sha512 shadow

# /etc/security/faillock.conf (modern method)
deny = 5            # lock after 5 failed attempts
unlock_time = 600   # unlock after 600 seconds (10 minutes)
fail_interval = 900 # count failures within 15 minutes

# PAM configuration
auth required pam_faillock.so preauth
auth required pam_faillock.so authfail
account required pam_faillock.so

# View failed login attempts
faillock --user <username>

# Manually unlock a locked account
faillock --user <username> --reset

# In /etc/pam.d/common-password or system-auth
password required pam_pwhistory.so remember=12 enforce_for_root use_authtok

sudo useradd -r -s /usr/sbin/nologin -d /var/lib/myapp -m myapp

while IFS=: read -r user pass; do
  sudo useradd -m "$user"
  echo "$user:$pass" | sudo chpasswd
done < users.txt

# Add user to sudo/wheel group
sudo usermod -aG sudo <username>    # Debian/Ubuntu
sudo usermod -aG wheel <username>   # RHEL/Fedora/Arch

# Or add a sudoers entry (use visudo or drop-in file)
echo "<username> ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/<username>
sudo chmod 440 /etc/sudoers.d/<username>

# Create the shared directory
sudo mkdir /srv/shared
sudo chown root:devteam /srv/shared
sudo chmod 2770 /srv/shared          # setgid ensures new files inherit group

# Grant additional access to another group
setfacl -m g:managers:rx /srv/shared
setfacl -d -m g:managers:rx /srv/shared    # default ACL for new files

# Find users with UID 0 (should only be root)
awk -F: '$3 == 0 {print $1}' /etc/passwd

# Find users with empty passwords
sudo awk -F: '$2 == "" {print $1}' /etc/shadow

# Find users with no expiry set
sudo chage -l <username> | grep "Account expires"

# Find accounts that have never logged in
lastlog | grep "**Never logged in**"