MODULE 15 - System and User security

Question 1

Which command allows you to run a shell as a different user in Linux?

Answer 1

The su command allows you to switch users and run commands under another user’s privileges, often used to switch to the root user.

Question 2

Which 3 options fully configure the new shell with the settings of the new user, ensuring that all commands are executed correctly?

Answer 2

The login shell option (su -, su -l, su –login) fully configures the new shell with the settings of the new user, ensuring that all commands are executed correctly.

Question 3

What is the default behavior when no username is provided with the su command?

Answer 3

By default, the su command opens a new shell as the root user.

Question 3

How can you specify the login shell option when using the su command?

Answer 3

You can specify the login shell option with one of these commands:

su -

su -l

su –login

Question 3

Which command allows a user to execute a single command as another user, typically the root user, without switching shells?

Answer 3

The sudo command lets users execute commands with elevated privileges, assuming root permissions by default.

Question 4

What command is equivalent to su - root when switching to the root user?

Answer 4

The command su - is equivalent to su - root when switching to the root user.

Question 4

What should you use to return to your original user account after performing administrative tasks with the root user?

Answer 4

To return to your original shell, use the exit command.

Question 4

How can you confirm successfully switching to the root user using the su command?

Answer 4

The id command is used to confirm successfully switching to the root user using the su command.

Question 5

Which password is required when using the sudo command to execute a privileged command?

Answer 5

The user must enter their own password, not the root user’s password, when prompted by sudo.

Question 6

What is the default timeout period during which the password prompt does not reappear for sudo after a successful entry?

Answer 6

Five minutes is the default timeout window during which a user can run additional sudo commands without being prompted again.

Question 7

Which logging advantage does sudo offer that su does not?

Answer 7

Each command run with sudo is logged individually, showing the user, time, and specific command, ensuring better accountability.

Question 8

Which file in the /etc directory contains basic user account information for all users on the system?

Answer 8

/etc/passwd file in the /etc directory contains basic user account information for all users on the system.

Question 9

What does an x in the second field of a line in /etc/passwd indicate?

Answer 9

The actual password is stored in /etc/shadow, not in /etc/passwd.

Question 9

Which command is used to check if a specific user (e.g., sysadmin) exists in the /etc/passwd file?

Answer 9

grep sysadmin /etc/passwd command is used to check if a specific user exists in the /etc/passwd file.

Question 10

What is the purpose of the third field (e.g., 1001) in a line from /etc/passwd?

Answer 10

It represents the User ID (UID) used by the system internally to identify the user.

Question 11

What does the fourth field in /etc/passwd specify?

Answer 11

The Primary Group ID (GID) the user belongs to.

Question 12

What is typically stored in the fifth field (the comment field) of the /etc/passwd file?

Answer 12

User information such as the real name or other identifiers (e.g., “System Administrator”).

Question 13

Where is the default home directory for a regular user like bob located?

Answer 13

/home/bob

Question 14

What is the default home directory for the root user?

Answer 14

/root

Question 15

Which field in the /etc/passwd file defines the user’s default shell at login?

Answer 15

The seventh field, typically something like /bin/bash

Question 16

Which shell is most commonly assigned as the login shell for Linux users?

Answer 16

/bin/bash

Question 17

What does the $6$ prefix in the password field indicate in the following /etc/shadow line?
sysadmin:$6$c75ekQWF$…:16874:5:30:7:60:15050:

Answer 17

It indicates that the password is encrypted.

Question 18

Which field in the following /etc/shadow line shows the exact number of days since the password was last changed: sysadmin:$6$c75ekQWF$…:16874:5:30:7:60:15050: ?

Answer 18

The third field (16874) shows the last change date, representing the number of days since the Unix Epoch (Jan 1, 1970).

Question 19

In this /etc/shadow line, what does the 5 represent?
sysadmin:$6$c75ekQWF$…:16874:5:30:7:60:15050:

Answer 19

It represents the minimum number of days required between password changes—meaning the user must wait 5 days before changing the password again.

Question 20

What is the purpose of the 30 in this /etc/shadow line? sysadmin:$6$c75ekQWF$...:16874:5:30:7:60:15050:

Answer 20

It’s the maximum password age in days. The user is forced to change their password every 30 days.

Question 21

How many days before password expiry will the user be warned, according to this line? sysadmin:$6$c75ekQWF$...:16874:5:30:7:60:15050:

Answer 21

7 days. The warn field (7) notifies the user during login within that time window before password expiration.

Question 22

After the password expires, how many days does the user have to still log in and change it before the admin must intervene? sysadmin:$6$c75ekQWF$...:16874:5:30:7:60:15050:

Answer 22

60 days. That’s the inactive field, providing a grace period after expiry during which the user can still update their password if they log in.

Question 23

What does the value 15050 at the end of this /etc/shadow line represent? sysadmin:$6$c75ekQWF$...:16874:5:30:7:60:15050:

Answer 23

It’s the account expiration date, given as the number of days since Jan 1, 1970. Once reached, the account is locked (but not deleted).

Question 24

In a /etc/shadow line, what does a * or ! in the password field indicate?

Answer 24

It marks the account as locked or disabled. * is typically used for system accounts, while ! indicates login is disabled.

Question 25

Which command is used to view user account info from /etc/shadow or /etc/passwd, including over a network?

Answer 25

getent — it retrieves entries from databases like passwd or shadow and works with both local and network-based sources.

Question 26

What does the x in the second field of /etc/group indicate?

Answer 26

A placeholder showing that the group password is stored in /etc/gshadow (if used), not in /etc/group

Question 26

Define the concept described as: accounts that run services, not meant for direct login, and have UID values from 1 to 499?

Answer 26

System accounts.

Question 26

If the maximum field is set to 99999, what effect does that have on password aging?

Answer 26

It essentially disables forced password changes—the password will never expire, since 99999 days ≈ 274 years.

Question 26

What does /usr/sbin/nologin or /bin/false field in /etc/passwd file mean?

Answer 26

The shell field, which is typically set to /usr/sbin/nologin or /bin/false for a system account prevents login.

Question 26

Which type of account has a UID of 0 and full system access?

Answer 26

The root account.

Question 27

Why do most system accounts in /etc/passwd lack a home directory?

Answer 27

Because system accounts don't need to store user files or configurations, they typically don't require home directories.

Question 27

Which UID range is typically reserved for regular user accounts?

Answer 27

UID > 500 (on some systems UID > 1000).

Question 27

What file defines supplemental (secondary) group memberships in Linux?

Answer 27

/etc/group

Question 27

What does an asterisk * in the password field of /etc/shadow mean ?

Answer 27

An asterisk * in the password field of /etc/shadow means it is a system account disabled for interactive logins.

Question 27

In the group file entry mail:x:12:mail,postfix, what does the mail in the first field represent?

Answer 27

The group name.

Question 27

What file defines a user’s primary group membership in Linux?

Answer 27

/etc/passwd

Question 27

How did traditional UNIX systems limit group membership per user? How many groups can a user belong to in modern Linux kernels?

Answer 27

In traditional UIX systems Users could belong to no more than 16 groups, in modern Linux kernels users can belong to Over 65,000 groups.

Question 27

In the line mail:x:12:mail,postfix, what does the final field list?

Answer 27

Users who are secondary members of the group

Question 27

What does the number 12 in the group entry mail:x:12:mail,postfix represent?

Answer 27

The Group ID (GID) — a unique numeric identifier for the group

Question 27

Which command is used To view information about a specific group

Answer 27

grep groupname /etc/group

Question 27

Which command is used to view a user's UID, GID, and group memberships?

Answer 27

id.

Question 27

What command shows all groups (by GID) that the current user belongs to?

Answer 27

id -G

Question 28

What happens if you run the id command without any arguments?

Answer 28

It displays UID, GID, and group memberships for the current user.

Question 28

What command shows the numeric GID of the current user’s primary group? Answer:

Answer 28

id -g

Question 28

What file confirms the secondary groups a user belongs to?

Answer 28

/etc/group

Question 28

Which command displays a list of users currently logged into the system along with their login details?

Answer 28

who

Question 28

What does an IP address or domain in the who command's last column indicate?

Answer 28

A remote login from that host or network.

Question 28

What command can be used alongside cat to search for group entries of a specific user?

Answer 28

cat /etc/group | grep username

Question 28

What does it mean if the terminal name in who starts with tty?

Answer 28

The user logged in using a local command-line terminal.

Question 28

What does it mean if the terminal name in who starts with pts?

Answer 28

The user is connected via a pseudo-terminal (e.g., SSH or terminal emulator).

Question 28

What does (:0) or (:0.0) indicate in the last column of who output?

Answer 28

A local graphical login session (using X Window System display 0).

Question 28

What does the who -b option display?

Answer 28

The last system boot time.

Question 28

What is the term for A functional state of the system that determines which services are running?

Answer 28

A runlevel

Question 28

What does the who -r option show?

Answer 28

The current system runlevel and when it was reached.

Question 28

Which command gives a more detailed list of logged-in users and their activity?

Answer 28

w.

Question 28

What is shown in the WHAT column of w output?

Answer 28

The current command or process the user is running.

Question 28

What does the JCPU column in the w command output represent?

Answer 28

Total CPU time used by all processes attached to the terminal since login.

Question 28

What does the load average in w output represent?

Answer 28

System load (CPU usage) over time; on a single-core, 1.00 means 100% usage.

Question 28

What does the IDLE field in w output indicate?

Answer 28

The time since the user last executed a command.

Question 28

What does the PCPU column show in w output?

Answer 28

The CPU time used by the current process the user is running.

Question 28

Which command shows a history of all logins and reboots on a Linux system?

Answer 28

last

Question 28

Which file does the last command read from to display login history?

Answer 28

/var/log/wtmp

Question 28

Which command shows only the users currently logged in (not history)?

Answer 28

who

Question 28

Which command shows history of all user logins &logouts date and time, and system reboots?

Answer 28

The last command.

Question 29

What file does the who command read to list currently logged-in users?

Answer 29

/var/log/utmp

Question 30

Which command would be used to view account information of you, the sysadmin in the /etc/shadow folder?

Answer 30

getent passwd sysadmin

Question 31

Which command which you use to view the account information of the root user?

Answer 31

id root