Secure Linux User Management for Cyber Warfare

Introduction

Linux user management is a fundamental skill for system administrators. It involves creating, modifying, and maintaining user accounts to ensure proper system access and security. In this lab, you will learn how to manage users in a Linux environment, focusing on adding users and configuring their permissions. These skills are essential for maintaining the security and integrity of any Linux system.

Creating a New User

User accounts in Linux allow individuals to access the system with specific permissions. Each user has a unique username, user ID (UID), home directory, and default shell.

In this step, you will create a new user named "cipher" on the system.

Open the terminal in your LabEx VM environment. The terminal should already be at the default location /home/labex/project.
Use the useradd command with appropriate options to create the new user:

sudo useradd -m -s /bin/bash cipher

Let's understand the command:

sudo: This runs the command with superuser privileges, which are required for user management.
useradd: This is the command used to create a new user.
-m: This option creates a home directory for the new user at /home/cipher.
-s /bin/bash: This sets the default shell for the user to bash.
cipher: This is the username of the new user we're creating.

Verify that the user has been created by listing the home directories:

ls -l /home

You should see output similar to:

total 8
drwxr-xr-x 2 cipher cipher 4096 Oct 15 10:30 cipher
drwxr-xr-x 5 labex  labex  4096 Oct 15 10:00 labex

The entry for cipher confirms that the user and their home directory have been created successfully.

Setting a Password for the New User

Every user account should have a secure password to prevent unauthorized access. In this step, you will set a password for the "cipher" user you created in the previous step.

Use the passwd command to set a password for the user:

sudo passwd cipher

You will be prompted to enter a new password twice. Type a password of your choice and press Enter after each entry. Note that for security reasons, the password you type will not be displayed on the screen.

New password:
Retype new password:

If both passwords match, you'll see a confirmation message:

passwd: password updated successfully

Verify that the password has been set by checking if the password field in the shadow file is no longer empty:

sudo grep cipher /etc/shadow | cut -d: -f2 | grep -v '!'

If a string of characters is returned, it means the password has been set successfully. The output won't show the actual password but rather its encrypted form.

Let's understand the verification command in detail:

grep cipher /etc/shadow finds the line containing our user
cut -d: -f2 extracts the password field (second field)
grep -v '!' shows only lines that don't contain '!'

The last part (grep -v '!') is particularly important because in Linux:

An account with no password or a locked account will have '!' in the password field
An account with a valid password will have an encrypted hash without '!'

Therefore, if the command returns output, it confirms that a valid password is set without exposing the actual password hash.

Viewing User Information

After creating a user, it's important to know how to view information about that user. Linux provides several commands for this purpose.

Let's first check the basic information about the "cipher" user using the id command:

id cipher

This will display the user ID (uid), group ID (gid), and the groups the user belongs to. The output should look similar to:

uid=1001(cipher) gid=1001(cipher) groups=1001(cipher)

Now, let's check the user's entry in the /etc/passwd file, which contains basic user information:

grep cipher /etc/passwd

The output will be a line containing fields separated by colons. For example:

cipher:x:1001:1001::/home/cipher:/bin/bash

These fields represent:

Username: cipher
Password: x (the actual password is stored in /etc/shadow)
User ID: 1001
Group ID: 1001
GECOS field: (empty in this case, often contains the user's full name)
Home directory: /home/cipher
Login shell: /bin/bash

You can also use the finger command to view user information in a more readable format. First, install the finger package:

sudo apt-get update
sudo apt-get install -y finger

Now use finger to view information about the cipher user:

finger cipher

The output will display information in a more human-readable format, including login status and home directory:

Login: cipher                           Name:
Directory: /home/cipher                 Shell: /bin/bash
Never logged in.
No mail.
No Plan.

Adding a User to Groups

Linux uses groups to organize users and control their access to files and resources. In this step, you will learn how to add a user to an existing group.

First, let's create a new group called "crypto" that our user will be added to:

sudo groupadd crypto

Now, add the "cipher" user to the "crypto" group using the usermod command:

sudo usermod -aG crypto cipher

In this command:

sudo: Runs the command with superuser privileges
usermod: The command to modify a user account
-aG: The option to add the user to a group (-a for append, -G for supplementary groups)
crypto: The name of the group
cipher: The username

Verify that the user has been added to the group by checking the groups they belong to:

groups cipher

The output should include both "cipher" and "crypto" groups:

cipher : cipher crypto

You can also check the group's entry in the /etc/group file:

grep crypto /etc/group

The output should show the group and its members:

crypto:x:1002:cipher

Granting Sudo Access to a User

For administrative tasks, users often need elevated privileges. The sudo (superuser do) command allows regular users to execute commands with administrative privileges. In this step, you will learn how to grant sudo access to a user.

In Ubuntu, users with sudo access are typically added to the "sudo" group. Add the "cipher" user to the sudo group:

sudo usermod -aG sudo cipher

Verify that the user has been added to the sudo group:

groups cipher

The output should now include the "sudo" group:

cipher : cipher crypto sudo

Let's test the sudo access by switching to the "cipher" user and trying to run a command with sudo. First, switch to the cipher user:

sudo su - cipher

Now try to run a command that requires sudo privileges:

sudo ls /root

You will be prompted for the password you set for the cipher user. After entering it correctly, the command should execute successfully, showing the contents of the /root directory.
Exit the cipher user session to return to the labex user:

exit

Summary

In this lab, you've learned the fundamental concepts of user management in Linux. You've successfully created a new user, set a password, viewed user information, added the user to groups, and granted sudo access. These skills are essential for system administrators to maintain security and control access to resources on Linux systems.

User management is a critical aspect of system administration, and the commands and concepts you've learned here form the foundation for more advanced user and permission management tasks. By mastering these basics, you're well on your way to becoming proficient in Linux system administration.

Linux User Adding