Chapter 10 Flashcards
Administering Users and Groups
Describe the players in managing user accounts.
The /etc/login.defs and /etc/default/useradd files configure various settings for the useradd command’s default behavior. Because the directive settings within these files vary from distribution to distribution, it is wise to peruse them prior to employing the useradd utility to create accounts. When an account is created, the /etc/passwd, /etc/shadow, and /etc/group files are all modified. Depending on the user account creation configuration, a user home directory may be created and files copied to it from the /etc/skel directory.
Summarize managing groups.
The commands involved in creating, modifying, and deleting groups are the groupadd, groupmod, and groupdel commands. These commands cause modifications to the /etc/group file. If you need to add a user to a group, you need to employ the usermod utility. A user can easily switch from the account’s default group to another group in which the account is a member by using the newgrp program. Account group membership can be audited via the groups and getent commands as well as by viewing the /etc/group file.
Outline the environment files.
The Bash shell uses environment variables to store information about the shell session and the working environment. These variables are set using environment files. Which environment files are run depends on how a user is logging into a system as well as the distribution the account is on. User environment files are hidden files in that they begin with a dot (.) and are potentially the .bash_profile, .bash_login, .profile, and .bashrc files. Global files may include /etc/bashrc, /etc/bash.bashrc, /etc/profile, and files within the /etc/profile.d/ directory.
Explain the various methods to query user account information.
There are several utilities you can employ to determine user account information for users who are currently logged into their accounts as well as those who are not. The “who” commands have three variations, which are the whoami, who, and w utilities. The id program is useful for matching UID and GID numbers to particular user accounts. The last command is helpful for viewing not only when a system has rebooted but also whether or not a user is currently logged into the system or when the last time the account was accessed.
Describe how to manage filesystem usage quotas.
Prior to setting user account or group quota limits on a system, you must enable quotas on the filesystem using the usrquota and grpquota options in the /etc/fstab file. Once the filesystem is unmounted and then remounted, you can create the needed user and/or group files with the quotacheck utility. After that is accomplished, user or group limits are set with the edquota command. You can also view and/or verify quotas using the repquota program.
Which of the following are fields within an /etc/passwd file record? (Choose all that apply.)
User account's username Password Password change date Special flag UID
A, B, E. The user account’s username, password (though it typically only contains an x), and UID are all legitimate fields in an /etc/passwd file record. Therefore, options A, B, and E are correct answers. The password change date and special flag are fields in the /etc/shadow file. Thus, options C and D are incorrect choices.
Which of the following are fields in an /etc/shadow file record? (Choose all that apply.)
Password expiration date Account expiration date Password Comment Default shell
A, B, C. The password expiration date, account expiration date, and password are all legitimate fields in a /etc/shadow file record. Therefore, options A, B, and C are correct answers. The comment and default shell are fields in the /etc/passwd file. Thus, options D and E are incorrect choices.
Which field contains the same data for both an /etc/passwd and an /etc/shadow file record?
Password Account expiration date UID GID User account's username
E. The user account’s username is the only field within an /etc/passwd and an /etc/shadow record that contains the same data. Therefore, option E is the correct answer. While both files have a password field, they do not contain the same data. The password can only exist in one of the two files, preferably the /etc/shadow file. Thus, option A is a wrong answer. The account expiration date only exists in the /etc/shadow file, so option B is also a wrong choice. The UID and GID fields only exist in the /etc/passwd file, so options C and D are also incorrect answers.
Which of the following commands will allow you to view the NUhura account’s record data in the /etc/passwd file? (Choose all that apply.)
getent NUhura passwd cat /etc/passwd passwd NUhura grep NUhura /etc/passwd getent passwd NUhura
B, D, E. Though not very efficient, the cat /etc/passwd command would allow you to view the NUhura account’s record within the /etc/passwd file. The grep NUhura /etc/passwd and getent passwd NUhura commands also would allow you to see the NUhura record. So options B, D, and E are correct choices. The getent command in option A has got the username and filename flip-flopped, so it is an incorrect choice. Also, the passwd NUhura command attempts to change the account’s password instead of display its file record, so option C is also an incorrect answer.
You use the useradd -D command to view account creation configuration directives. What file does this command pull its displayed information from?
The /etc/passwd file The /etc/shadow file The /etc/group file The /etc/login.defs file The /etc/default/useradd file
E. The useradd -D command allows you to view the account creation configuration directives in the /etc/default/useradd file. Therefore, option E is the correct answer. The /etc/passwd, /etc/shadow, and /etc/group files do not contain account creation configuration directives, so options A, B, and C are wrong answers. While the /etc/login.defs file does contain account creation configuration directives, you cannot display it with the useradd -D command. Therefore, option D is also an incorrect choice.
You create an account using the appropriate utility, except for some reason the account’s home directory was not created. Which of the following most likely caused this to occur?
The HOME directive is set to no. You did not employ super user privileges. The CREATE_HOME directive is not set. The INACTIVE directive is set to -1. The EXPIRE date is set and it is before today.
C. If the CREATE_HOME directive is not set or it is set to no, when a user account is created no home directory will be created by default. Most likely this caused the problem, so option C is the correct answer. The HOME directive determines what base directory name is used when creating home directories for new accounts, so option A is a wrong answer. If you did not employ super user privileges, you would not have been able to even create the account, so option B is a wrong choice. The INACTIVE directive pertains to when an account will be considered inactive, so option D is also an incorrect answer. The EXPIRE directive is involved with account expiration and not home directory creation. Therefore, option E is also an incorrect choice.
Your boss has asked you to remove KSingh’s account and all his home directory files from the system immediately. Which command should you use?
usermod -r KSingh rm -r /home/KSingh userdel Ksingh userdel -r KSingh usermod -d KSingh
D. To immediately remove the KSingh account and all his home directory files, using super user privileges you would use the userdel -r KSingh command. Therefore, option D is the correct answer. There is no -r option for the usermod command, so option A is a wrong answer. The rm -r /home/KSingh command would only remove the account’s home directory files and not delete the user account. Therefore, option B is an incorrect answer. The userdel command without any options would only delete the account and not remove any of its home directory files, so option C is a wrong choice. The -d option on the usermod command is for changing an account’s home directory. Therefore, option E is also an incorrect choice.
Which of the following will allow you to change an account’s /etc/shadow file record data? (Choose all that apply.)
The passwd command The usermod command The userdel command The getent command The chage command
A, B, C, E. The passwd, usermod, userdel, and chage commands can all manipulate (or remove) an account’s /etc/shadow file record data in some way. Therefore, options A, B, C, and E are all correct. While the getent command will allow you to display selected records from the /etc/shadow file, it will not allow you to manipulate data records within the file. Therefore, option D is the only incorrect choice.
Which of the following commands will allow you to switch temporarily from your account’s default group to another group you are a member of?
The usermod command The newgrp command The groups command The groupadd command The groupmod command
B. The newgrp command will let you switch temporarily from your account’s default group to another group with whom you have membership. Therefore, option B is the correct answer. The usermod command could make that switch, but it is not best for temporary situations, so it is an incorrect choice. The groups command allows you to display group information, but not change groups, so it also is a wrong answer. The groupadd and groupmod commands deal with group management, but not temporarily switching an account’s default group. Therefore, options D and E are also incorrect choices.
Which of the following commands is the best one to add JKirk as a member to a new group called the NCC-1701 group and not remove any of the account’s previous group memberships?
usermod -g NCC-1701 JKirk usermod -G NCC-1701 JKirk usermod -aG NCC-1701 JKirk groupadd NCC-1701 groupmod NCC-1701 JKirk
C. The usermod -aG NCC-1701 JKirk command would add JKirk to the NCC-1701 group as a member and not remove any of the account’s previous group memberships. Therefore, option C is the correct answer. The usermod -g NCC-1701 JKirk command would change the JKirk account’s primary group membership, so option A is a wrong answer. The command in option B would add the JKirk account as a member to the NCC-1701 group, but it would remove any of the account’s previous group memberships. Thus, option B is an incorrect answer. The groupadd NCC-1701 command would only add the NCC-1701 group. Therefore, option D is a wrong answer as well. The groupmod command is for modifying groups, and so the command in option E would have undesirable results. Thus, option E is an incorrect choice.
