Accounts on the system.
WHAT A USER HAS
A name A numeric identifier A home directory A shell Group memberships
WHERE ACCOUNTS ARE DEFINED
In the password file, with hashes stored separately.
WHY SEPARATELY
So the account list can be readable while hashes are not.
WHAT useradd AND adduser DO
Create accounts, with differing defaults by distribution.
WHAT passwd DOES
Sets or changes a password.
WHAT usermod DOES
Modifies an existing account.
WHAT GROUPS ARE FOR
Granting permissions to several users at once.
WHAT A PRIMARY GROUP IS
The one applied to files a user creates.
WHAT SUPPLEMENTARY GROUPS ARE
Additional memberships.
WHY GROUP MEMBERSHIP CHANGES SEEM NOT TO WORK
They apply at login, so the user must reconnect.
WHAT A SYSTEM ACCOUNT IS
One used by a service rather than a person.
WHAT SUCH ACCOUNTS SHOULD HAVE
No login shell.
WHY
It prevents them being used to obtain a shell.
WHAT TO AUDIT PERIODICALLY
Accounts that exist Which have shells Which have keys in their authorised list
WHAT TO REMOVE
Accounts for people who have left.
