Users and Groups

/etc/passwd lists every account on the machine, one per line, with colons between the fields:

$ grep hugo /etc/passwd
hugo:x:1007:1007::/home/hugo:/bin/bash

Reading that line across:

The UID is the part that matters. Names are for people; permissions are decided on the number. Root is UID 0, and anything with UID 0 is root whatever it happens to be called.

The numbers also tell you what an account is for. UIDs below 1000 are system accounts, created by packages to run services under, and they usually have a shell of /usr/sbin/nologin or /bin/false so that nobody can log in as them. Human accounts start at 1000. An account under 1000 with a real shell, or a second account with UID 0, is worth a second look.

The x matters too. Password hashes used to sit in /etc/passwd, which every user can read, so they moved to /etc/shadow, which only root can. That's why cat /etc/shadow fails for you and cat /etc/passwd doesn't.

An account belongs to one primary group, named in its /etc/passwd line, and any number of secondary groups, listed in /etc/group. id shows the lot:

$ id
uid=1007(hugo) gid=1007(hugo) groups=1007(hugo),1011(payroll)

groups prints the same thing with the numbers left off, and either of them takes a name if you want to ask about somebody else: id backupsvc.

Groups are how you give several people access to the same thing without handing out accounts or making the thing readable by everyone. From the Permissions and Ownership room, the middle rwx triplet is the group's, so a folder owned by root:payroll with mode 750 can be opened by root and by anyone in payroll, and by nobody else:

$ ls -ld /srv/teams/payroll
drwxr-x--- 2 root payroll 4096 Sep 30 09:14 /srv/teams/payroll

Note what 750 does on a folder rather than a file. Without x you cannot enter it at all, so you can't read a file inside it even if that file is yours and its own permissions would allow it. The folder is the outer door.

One catch worth knowing: adding yourself to a group doesn't change a session that's already running. Your groups are attached when you log in, so a new membership shows up in id only after you log in again. It's a standard half hour of confusion the first time it happens.

Hugo has just joined, and somebody has left him a handover note in a team folder. There are three of them under /srv/teams and he can open exactly one.

1. Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as hugo.
2. Read ~/todo.txt, then look at your own account: id, and your line in /etc/passwd.
3. List the team folders with ls -l /srv/teams. Note the group on each one and what its permissions allow.
4. Try cat /etc/shadow. It fails, and the first task says why.
5. Open the folder your group lets you into, and read the note inside.