Admin:Docs

Linux Administration #2: Advanced User Management

This article covers advanced aspects of Linux user management, from PAM configuration and user quotas to ACLs and monitoring user activities.

Reading time: 45 min

Category Linux administration
Author Sebastian Palencsar
Published 27.10.2024
Updated 27.10.2024

Welcome to the second part of our technical wiki series on Linux administration!

After we learned the fundamentals of user and permission management in the first article, we now dive deeper into the advanced aspects. Advanced user management encompasses all tools and concepts that go beyond basic creation and deletion of user accounts.

Imagine a Large Company

Simple user management would be like a doorman issuing ID cards. Advanced user management, on the other hand, is like a complete security system with access control, monitoring, and automated management.

⚠️ Note: In this article, we use Ubuntu/Debian as the example distribution. The basic concepts are the same on all Linux systems, but package installation and some configuration paths may vary depending on the distribution. If you use a different distribution, please consult the relevant documentation for the specific installation commands and paths.

Installing Required Packages

Installing PAM modules for advanced password policies

  • sudo apt install libpam-pwquality cracklib-runtime

Verifying the installation


dpkg -l | grep libpam-pwquality
dpkg -l | grep cracklib

What gets installed?

libpam-pwquality: Module for advanced password quality checks cracklib-runtime: Dictionary-based password validation

Important configuration files:


┌─────────────────────────────────────────────────────────────┐
│  STRUCTURE OF PWQUALITY CONFIGURATION FILES                 │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  /etc/security/                                             │
│  ├── pwquality.conf     → Main quality configuration        │
│  └── pwquality.conf.d/  → Modular configuration files       │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Understanding Password Policies

A password policy is like a set of rules for secure passwords:

Password policy components:


┌─────────── Complexity ─────────────────────────────────────┐
│  • Minimum length                                          │
│  • Character types                                         │
│  • Repetition rules                                        │
├─────────── Lifecycle ──────────────────────────────────────┤
│  • Validity period                                         │
│  • History                                                 │
│  • Change intervals                                        │
└─────────────────────────────────────────────────────────────┘

Password Policy Configuration

In advanced user management, setting up secure password policies is crucial. Think of the password policy like a security standard in a building.

Understanding Basic Password Policies

Password components:


┌─────────── Complexity ─────────────────────────────────────┐
│  • Minimum length                                          │
│  • Character types (A-Z, a-z, 0-9, @#$)                    │
│  • Dictionary check                                        │
├─────────── Validity ───────────────────────────────────────┤
│  • Maximum age                                              │
│  • Minimum age                                              │
│  • Warning time before expiry                               │
├─────────── History ────────────────────────────────────────┤
│  • Number of old passwords                                 │
│  • Reuse prevention                                        │
└─────────────────────────────────────────────────────────────┘

PAM Configuration for Password Policies

PAM (Pluggable Authentication Modules) is the heart of authentication in Linux. It allows flexible configuration of security policies.

Understanding PAM

PAM structure:


┌─────────── Authentication ────────────────────────────────┐
│  auth       Identity verification                          │
├─────────── Account ───────────────────────────────────────┤
│  account    Account access & status                        │
├─────────── Password ──────────────────────────────────────┤
│  password   Password changes                               │
├─────────── Session ───────────────────────────────────────┤
│  session    Session management                             │
└─────────────────────────────────────────────────────────────┘

Setting Up Password Quality Policies

Main configuration file:

Open configuration file

  • sudo nano /etc/security/pwquality.conf

Important parameters:


minlen = 12          # Minimum password length

minclass = 3         # At least 3 different character classes

maxrepeat = 2        # Maximum 2 identical characters in a row

gecoscheck = 1       # Checks for username in password

dictcheck = 1        # Enables dictionary check

Configuring PAM Modules for Passwords

PAM configuration for passwords

  • sudo nano /etc/pam.d/common-password

Example configuration


password    required    pam_pwquality.so retry=3
password    required    pam_unix.so use_authtok sha512 shadow remember=5

Password History and Expiry Management

Managing password history and expiry times is an important security component:

Password lifecycle:


┌─────────── Creation ──────────────────────────────────────┐
│  Day 0: New password set                                   │
├─────────── Usage ─────────────────────────────────────────┤
│  Day 1-75: Normal usage                                   │
├─────────── Warning ───────────────────────────────────────┤
│  Day 76-89: Expiry warning                                │
├─────────── Expiry ────────────────────────────────────────┤
│  Day 90: Password must be changed                          │
└─────────────────────────────────────────────────────────────┘

Configuring Password History

In /etc/pam.d/common-password:


password required pam_pwhistory.so remember=5 enforce_for_root use_authtok

Parameters explained:


┌─────────────────────────────────────────────────────────────┐
│  IMPORTANT PAM PWHISTORY PARAMETERS                         │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  remember=5        → Stores the last 5 passwords            │
│  enforce_for_root  → Enforces history for root as well      │
│  use_authtok       → Uses token from previous PAM modules   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Setting Up Password Expiry

in /etc/login.defs


PASS_MAX_DAYS   90    # Maximum age

PASS_MIN_DAYS   1     # Minimum age

PASS_WARN_AGE   14    # Warning time before expiry

For individual users:

  • sudo chage -M 90 -m 1 -W 14 username

Detailed Expiry Configuration

Display user details:

  • sudo chage -l username

Example output:

  • Last password change : Jan 01, 2024
  • Password expires : Apr 01, 2024
  • Password inactive : never
  • Account expires : never
  • Minimum number of days between changes : 1
  • Maximum number of days between changes : 90
  • Number of days of warning before expire : 14

Common Password Policy Issues

Problem: Password change fails


# Error message on password change:
passwd

# Output: "Password does not meet complexity requirements"
# Checking the current policy:
sudo cat /etc/security/pwquality.conf | grep -v '^#'

Common causes:

  • Password too short
  • Missing character classes
  • Contains username
  • Too similar to old password
  • Password history violated

Problem: User cannot log in


# Checking password status
sudo chage -l username

# Common causes and solutions:
# 1. Password expired
sudo chage -d 0 username  

# Forces change on next login
# 2. Account locked
sudo usermod -U username  

# Unlock account
# 3. Check PAM configuration
sudo cat /etc/pam.d/common-auth

Practical Examples

Scenario 1: Development team setup


# Password policy for developers
sudo nano /etc/security/pwquality.conf

minlen = 14
minclass = 3
maxrepeat = 2
enforce_for_root

# Password aging for sensitive projects
sudo chage -M 60 -m 1 -W 7 developer1

Scenario 2: Temporary employees


# Set expiry date
sudo useradd -e 2024-12-31 tempuser

# or for existing user
sudo chage -E 2024-12-31 tempuser

# Check status
sudo chage -l tempuser

Scenario 3: Enforce automatic password change

New employees should change their initial password on first login.


# Force password change
sudo chage -d 0 newuser

# Check settings
sudo chage -l newuser

Scenario 4: Temporary access

Interns need access for 3 months.


# Create user with expiry date
sudo useradd -e $(date -d "+3 months" +%Y-%m-%d) intern01

# Warning 14 days before expiry
sudo chage -W 14 intern01

# Check status
sudo chage -l intern01

Scenario 5: Enforce password history


# Adjust PAM configuration
sudo nano /etc/pam.d/common-password

# Add/adjust the following line:
password required pam_pwhistory.so remember=5 use_authtok

# Parameters explained:
remember=5      # Stores the last 5 passwords

use_authtok     # Uses previous PAM token

Implementing User Quotas

Quotas are like storage limits for users and groups. They help control resource usage.

Quota types:


┌─────────── Block Quotas ────────────────────────────────────┐
│  Limits storage space                                       │
│  Example: 5GB per user                                      │
├─────────── Inode Quotas ────────────────────────────────────┤
│  Limits number of files                                     │
│  Example: Max. 50,000 files                                 │
└─────────────────────────────────────────────────────────────┘

Activating the Quota System

Installing Quota Support

  • sudo apt install quota quotatool

Adjusting /etc/fstab


# Add usrquota,grpquota to mount options
sudo nano /etc/fstab

# Example:
# /dev/sda1  /home  ext4  defaults,usrquota,grpquota  0  2

Remounting the filesystem

  • sudo mount -o remount /home

Setting Up Quotas

Creating Quota Databases

  • sudo quotacheck -cugm /home

Activating quotas

  • sudo quotaon -v /home

Setting quota for a user


sudo edquota -u username

# Soft limit: Warning
# Hard limit: Strict limit

Advanced Quota Configurations

Understanding Soft and Hard Limits:

Editing quota for a user:

  • sudo edquota -u username

Example output:


Filesystem  blocks  soft    hard   inodes  soft  hard
/dev/sda1   500000  524288  786432  1000   1500  2000
                  ├─Current┤└─Warn─┘└─Limit┘└─Files──────┘

Meaning:

  • blocks: Current storage usage
  • soft: Warning when exceeded
  • hard: Absolute limit
  • inodes: Number of files

Managing Group Quotas:


# Set quota for a group
sudo edquota -g developers

# Display quota status for group
sudo quota -g developers

# Quota report for all groups
sudo repquota -g /home

Configuring Quota Warnings:

Set grace period:

  • sudo edquota -t

Example:


Filesystem    Block grace period    Inode grace period
/dev/sda1     7days                 7days

# 7 days between soft and hard limit

Practical Quota Scenarios

Development Team Setup

Developers get generous limits:

  • sudo edquota -u developer1

Example:


Filesystem  blocks   soft    hard   inodes   soft   hard
/dev/sda1   500000  5242880 6291456  10000   50000  75000

# Meaning:
# - 5GB soft limit (warning)
# - 6GB hard limit (strict)
# - 50,000 files soft limit
# - 75,000 files hard limit

Intern Setup

Limited resources for temporary employees:

  • sudo edquota -u intern1

Example:

  • Filesystem blocks soft hard inodes soft hard
  • /dev/sda1 100000 524288 786432 1000 2000 3000

Create template for all interns:

  • sudo edquota -p intern1 intern2 intern3

Project Quotas

Project directory with group quota:

  • sudo edquota -g projectgroup

Example:

  • Filesystem blocks soft hard inodes soft hard
  • /dev/sda1 1000000 10485760 15728640 20000 50000 75000

Quota report for the project:


sudo repquota -g /home | grep projectgroup

Quota Monitoring and Management


# Display quota status for a user
sudo quota -v username

# Quota report for all users
sudo repquota -a /home

# Detailed quota statistics
sudo quota -vs username

Quota Warnings and Notifications:


# Configure warning messages
sudo edquota -t

# Set grace period (grace period after exceeding limit)
# Set up email notifications
sudo nano /etc/quotamail.conf

Practical Monitoring Example:


#!/bin/bash
# Quota monitoring script
# Find users over 80% usage
repquota -a | awk '$4 > 80 {print $1": "$4"%"}'

# Send warning to users
for user in $(repquota -a | awk '$4 > 80 {print $1}')
do
	echo "Warning: Quota nearly exhausted" | mail -s "Quota Warning" $user
done

Access Control Lists (ACLs)

ACLs extend the traditional Linux permission system with fine-grained access controls.

Prerequisites:

  • sudo apt install acl

Understanding ACL Concepts

ACL types:


┌─────────── Extended ACLs ─────────────────────────────────┐
│  • Additional user permissions                             │
│  • Additional group permissions                            │
│  • Inheritable permissions                                 │
├─────────── Mask ───────────────────────────────────────────┤
│  • Maximum effective permissions                           │
│  • Overrides other ACL entries                             │
└─────────────────────────────────────────────────────────────┘

ACL Management

ACLs for existing directory structure

  • sudo setfacl -R -m g:developers:rwx /projects/webapp/
  • sudo setfacl -R -m g:qa:rx /projects/webapp/

Setting up inheritance

  • sudo setfacl -d -m g:developers:rwx /projects/webapp/

Practical ACL Use Cases

Development Project Setup


# Create project structure
sudo mkdir -p /projects/webapp/{src,docs,config}

# Base ACLs for development team
sudo setfacl -m g:developers:rwx /projects/webapp/src
sudo setfacl -m g:developers:rwx /projects/webapp/docs

# Special permissions for QA team
sudo setfacl -m g:qa:rx /projects/webapp/src
sudo setfacl -m g:qa:r /projects/webapp/docs

# Config directory with restricted access
sudo setfacl -m g:admin:rwx,g:developers:r /projects/webapp/config

Managing ACLs


# Display ACL for a file
getfacl file.txt

# Set ACL
# Syntax: setfacl -m u:username:rwx file
setfacl -m u:anna:rw- project.txt
setfacl -m g:developers:r-x scripts/

# Multiple ACL entries
setfacl -m u:anna:rw-,g:project:r-- file.txt

# Recursive ACLs for directories
setfacl -R -m g:developers:rwx /projects/

Practical ACL Examples

Standard ACLs for a Project Directory


# Create project directory
sudo mkdir -p /projects/webapp

# Set base ACLs
# Developers have full access
# QA team has read and execute permissions
sudo setfacl -m g:developers:rwx,g:qa:rx /projects/webapp

# Default ACLs for new files
sudo setfacl -d -m g:developers:rwx,g:qa:rx /projects/webapp

# Verify ACLs
getfacl /projects/webapp

Shared Document Directory


# Document structure
sudo mkdir -p /documents/{public,team,management}

# Public: Everyone can read
sudo setfacl -m g:users:rx /documents/public
sudo setfacl -d -m g:users:rx /documents/public

# Team: Only team members
sudo setfacl -m g:team:rwx /documents/team
sudo setfacl -d -m g:team:rwx /documents/team

# Management: Only specific people
sudo setfacl -m u:boss:rwx,u:secretary:rx /documents/management

ACLs for Different Use Cases

Shared document directory:


# Directory structure:
/documents/
├── public/     # Everyone can read
├── team/       # Only team members
└── private/    # Only specific users

# Set ACLs
sudo setfacl -R -m g:users:rx /documents/public
sudo setfacl -R -m g:team:rwx /documents/team
sudo setfacl -m u:boss:rwx,u:secretary:rx /documents/private

More Practical ACL Examples

Complex Project Structure with ACLs


# Create project structure
sudo mkdir -p /projects/webapp/{src,docs,config,tests}

# Base permissions
sudo chown -R root:developers /projects/webapp
sudo chmod 2775 /projects/webapp

# Set differentiated ACLs
# Developers have full access to src and tests
sudo setfacl -R -m g:developers:rwx /projects/webapp/src
sudo setfacl -R -m g:developers:rwx /projects/webapp/tests

# QA team has read and execute permissions for tests
sudo setfacl -R -m g:qa:rx /projects/webapp/tests

# Documentation readable for everyone
sudo setfacl -R -m g:users:rx /projects/webapp/docs

# Config only for administrators
sudo setfacl -R -m g:admin:rwx,g:developers:r /projects/webapp/config

ACL Inheritance for New Files


# Set default ACLs for new files
sudo setfacl -d -m g:developers:rwx /projects/webapp/src
sudo setfacl -d -m g:qa:rx /projects/webapp/tests

# Verify ACL inheritance
getfacl /projects/webapp/src

Monitoring User Activities

Monitoring user activities is an important aspect of system security and management.

Prerequisites:

  • sudo apt install auditd audispd-plugins

Understanding User Activity Monitoring

Monitoring areas:


┌─────────── Login/Logout ────────────────────────────────────┐
│  • Login attempts                                           │
│  • Successful/failed                                        │
│  • SSH access                                               │
├─────────── Activities ─────────────────────────────────────┤
│  • Executed commands                                        │
│  • File access                                              │
│  • Resource usage                                           │
└─────────────────────────────────────────────────────────────┘

Login Monitoring


# Current login sessions
who
w

# Login history
last
last -f /var/log/wtmp    

# Successful logins
lastb                    

# Failed logins
# Monitor SSH access
tail -f /var/log/auth.log | grep sshd

Recording User Activities


# Activate audit system
sudo apt install auditd

# Add audit rules
sudo auditctl -w /etc/passwd -p wa -k user-modify
sudo auditctl -w /etc/group -p wa -k group-modify

# Display audit logs
sudo ausearch -k user-modify
sudo aureport --auth     

# Authentication report

Monitoring Resource Usage


# Processes of a user
ps -u username

# Resource consumption
top -u username
iotop -u username        

# I/O activity
# Detailed process analysis
sudo ps auxf | grep username

Advanced Monitoring Tools

Process Monitoring with auditd:


# Set up process monitoring
sudo auditctl -a exit,always -F arch=b64 -S execve -k cmd_exec

# Monitor user actions
sudo ausearch -k cmd_exec
sudo aureport -x --summary

# Detailed process analysis
sudo ausearch -k cmd_exec -i | grep username

Login Monitoring with fail2ban:


# Installation
sudo apt install fail2ban

# Check configuration
sudo fail2ban-client status
sudo fail2ban-client status sshd

# Display blocked IPs
sudo fail2ban-client get sshd banip

Resource Monitoring:


# CPU and memory per user
top -U username

# Disk usage per user
sudo du -sh /home/*

# Network activity
sudo nethogs
sudo iftop

Real-Time Monitoring

System Activity Reporter (SAR):


# Installation
sudo apt install sysstat

# Record activities
sudo sar -u 1 5    

# CPU usage every 1 second, 5 times
sudo sar -r 1 5    

# Memory usage
sudo sar -b 1 5    

# I/O statistics

Process Tracking:


# Process tree of a user
pstree username

# Detailed process information
ps auxf | grep username

# Continuous monitoring
watch -n 1 'ps aux | grep username'

Integration of Monitoring Tools

Central Logging System


# Configure rsyslog for central logging
sudo nano /etc/rsyslog.d/auth-logging.conf

# Example configuration:
auth,authpriv.*                 /var/log/auth.log

# Log user activities
*.*;auth,authpriv.none          -/var/log/syslog

Automated Monitoring Script:


#!/bin/bash
# user-monitor.sh
# Monitor user activities
echo "=== Daily User Activity Report ===" > /var/log/user-report.txt
date >> /var/log/user-report.txt

# Login attempts
echo "Failed Logins:" >> /var/log/user-report.txt
grep "Failed password" /var/log/auth.log >> /var/log/user-report.txt

# Sudo usage
echo "Sudo Usage:" >> /var/log/user-report.txt
grep "sudo:" /var/log/auth.log >> /var/log/user-report.txt

# Resource usage per user
echo "Resource Usage:" >> /var/log/user-report.txt
ps aux --sort=-%cpu | head -n 5 >> /var/log/user-report.txt

Automatic notifications:


# Warning on suspicious activities
if grep -q "Failed password" /var/log/auth.log; then
	echo "Warning: Failed login attempts" | \
	mail -s "Security Warning" admin@localhost
fi

Troubleshooting

Common PAM Issues and Solutions

PAM Configuration Issues

Problem: PAM authentication fails


# Error message:
# Authentication token manipulation error
# Step-by-step diagnosis:
# 1. Check PAM logs
sudo tail -f /var/log/auth.log

# 2. Verify PAM modules
ldd /usr/lib/pam/pam_pwquality.so

# 3. Test PAM configuration
sudo pam-auth-update --verbose

Permission Issues

Problem: Shadow password access


# Error message:
# Authentication service cannot retrieve authentication info
# Solutions:
# 1. Check shadow file permissions
ls -l /etc/shadow

# Should be: -rw-r----- root:shadow
# 2. Check PAM shadow module
sudo ls -l /lib/x86_64-linux-gnu/security/pam_unix.so

Practical Solution Examples

Problem: Bypass password history (for emergencies)


sudo nano /etc/pam.d/common-password

# Temporarily comment out remember=5

Problem: Locked root account

  • sudo passwd -u root

Problem: Forgotten password

  • sudo passwd username

Best Practices for Troubleshooting

Checklist for password problems:


┌─────────── Configuration ──────────────────────────────────┐
│  □ PAM modules installed?                                   │
│  □ Configuration files readable?                            │
│  □ Permissions correct?                                     │
├─────────── Logs ───────────────────────────────────────────┤
│  □ auth.log checked?                                        │
│  □ syslog reviewed?                                         │
│  □ systemd-journal examined?                                │
├─────────── User ───────────────────────────────────────────┤
│  □ Account not locked?                                      │
│  □ Groups correct?                                          │
│  □ Shadow entry present?                                    │
└─────────────────────────────────────────────────────────────┘

Logging and Monitoring


# Real-time log monitoring
sudo tail -f /var/log/auth.log

# Failed login attempts
sudo grep "Failed password" /var/log/auth.log

# Monitor PAM events
sudo journalctl -u systemd-logind

Emergency Recovery


# Temporary policy disable (emergencies only!)
sudo mv /etc/pam.d/common-password /etc/pam.d/common-password.bak
sudo cp /etc/pam.d/common-password.orig /etc/pam.d/common-password

# Restore backup
sudo mv /etc/pam.d/common-password.bak /etc/pam.d/common-password

Documentation and Reporting


# Document current configuration
sudo cp /etc/security/pwquality.conf /root/pwquality.conf.$(date +%F)

# Log configuration changes
echo "$(date): PAM configuration adjusted" >> /var/log/security-changes.log

# Regular checks
sudo aureport --auth    

# Authentication reports
sudo aureport --failed  

# Failed logins

Exercise

Setting Up a Secure User Environment

Scenario: You need to set up a secure user environment with advanced password policies and access controls for a development team.

Requirements:


┌─────────── Password Policy ─────────────────────────────────┐
│  • At least 12 characters                                    │
│  • Complexity rules                                          │
│  • 90 days validity                                          │
│  • 5 password history                                        │
├─────────── User Groups ─────────────────────────────────────┤
│  • Developers (full access)                                  │
│  • Interns (restricted)                                      │
│  • External (temporary access)                               │
└─────────────────────────────────────────────────────────────┘

Possible solution:


#!/bin/bash
# 1. PAM configuration
sudo nano /etc/security/pwquality.conf

# Add:
minlen = 12
minclass = 3
maxrepeat = 2
enforce_for_root

# 2. Password history
sudo nano /etc/pam.d/common-password

# Add:
password required pam_pwhistory.so remember=5 use_authtok

# 3. Password aging
sudo nano /etc/login.defs

# Set:
PASS_MAX_DAYS   90
PASS_MIN_DAYS   1
PASS_WARN_AGE   14

# 4. Create groups
sudo groupadd developers
sudo groupadd interns
sudo groupadd external

# 5. Create users
# Developers
sudo useradd -m -s /bin/bash -G developers dev1
sudo chage -M 90 -m 1 -W 14 dev1

# Intern
sudo useradd -m -s /bin/bash -G interns intern1
sudo chage -M 30 -m 1 -W 7 intern1

# External
sudo useradd -m -s /bin/bash -G external extern1
sudo chage -E $(date -d "+90 days" +%Y-%m-%d) extern1

Verification:

Checklist:


┌─────────── Password Policy ─────────────────────────────────┐
│  □ PAM modules installed                                     │
│  □ Complexity rules active                                   │
│  □ History configured                                        │
├─────────── Users ───────────────────────────────────────────┤
│  □ Developer accounts active                                 │
│  □ Interns time-limited                                      │
│  □ External with expiry date                                 │
└─────────────────────────────────────────────────────────────┘

Command Reference (Cheatsheet)

For quick access during user, group, and permission management, the following reference table summarizes the most important commands of advanced user management:

Command / Syntax Category Function & Description
sudo chage -l <user> Password Aging Displays detailed expiry dates, intervals, and warnings.
sudo chage -M 90 -W 14 <u> Password Aging Sets maximum validity (90 days) and warning time (14 days).
sudo chage -d 0 <user> Password Aging Forces immediate password change on next login.
getfacl <file> POSIX ACL Displays extended access control lists of a file.
setfacl -m u:anna:rw <file> POSIX ACL Assigns user 'anna' specific read/write permissions.
setfacl -d -m g:grp:rwx <dir> POSIX ACL Defines inheritable default ACLs on a directory.
setfacl -b <file> POSIX ACL Removes all extended ACL entries completely.
sudo edquota -u <user> Quotas Interactively edits storage and inode limits.
sudo setquota -u <u> 500M 600M 0 0 / Quotas Sets quota limits directly via command or script.
sudo repquota -avugs Quotas Generates system-wide quota report for users and groups.
sudo visudo Sudoers Opens Sudoers configuration with automatic syntax checking.
sudo visudo -c Sudoers Checks Sudoers files for syntax errors without opening them.
last -n 20 Audit / Monitoring Displays the last 20 successful system logins.
sudo lastb -n 20 Audit / Monitoring Displays failed login attempts (Bad Logins).
sudo auditctl -w <path> -p wa Audit / Monitoring Monitors file write accesses via Linux kernel audit.

Further Resources

The following guides, specifications, and internal course modules deepen advanced user management and access control:

Resource Description
Linux-PAM System Administrator's Guide Official manual for the modular PAM architecture.
POSIX Access Control Lists on Linux Official man page for POSIX ACLs and permission masks.
Linux Quota Mini-HOWTO Detailed documentation for the Linux quota subsystem.
Sudoers Manual & Syntax Reference Official documentation for Sudoers configuration.
Linux Administration #1: Fundamentals The foundation: system architecture, FHS, mounting & file permissions.
chmod & File Permissions Guide Fundamental deepening of permissions and octal values.

Conclusion

With mastery of PAM authentication stacks, strict password policies via pwquality, granular POSIX ACLs, storage quotas, and a professional Sudoers architecture, you are able to secure and manage multi-user systems according to the highest enterprise and compliance standards.

💡 Practical Tip: For sudo privileges, always use modular files under /etc/sudoers.d/ with restrictive file permissions (chmod 440), instead of manually bloating the main file /etc/sudoers. This significantly simplifies configuration management via Ansible or GitOps.

In the next module of our administration course, we deal with monitoring and controlling running programs and system resources: 👉 Next up: Linux Administration #3: Processes and Resource Management

👉 Course Overview: All Linux Administration Articles & Modules

Tags

#user-management #acl #pam #sudo #groups #security #linux-administration

Share & export

Export as Markdown