---
id: linux-administration-advanced-user-management
slug: linux-administration-advanced-user-management
title: "Linux Administration #2: Advanced User Management"
excerpt: "This article covers advanced aspects of Linux user management, from PAM configuration and user quotas to ACLs and monitoring user activities."
date: "2024-10-27T09:00:00+01:00"
updated: "2024-10-27T10:00:00+01:00"
author:
name: "Sebastian Palencsar"
handle: "AdminDocs"
category: "linux-administration"
tags: ["user-management", "acl", "pam", "sudo", "groups", "security", "linux-administration"]
toc: true
reading_time: 45
---
**Welcome to the second part of our technical wiki series on Linux administration!**
After we learned the [fundamentals of user and permission management](/en/linux-administration/linux-administration-fundamentals-of-linux-administration){.badge-link-text} in the first article, we now dive deeper into the advanced aspects. Advanced user management encompasses all tools and concepts that go beyond basic creation and deletion of user accounts.
## Imagine a Large Company
Simple user management would be like a doorman issuing ID cards. Advanced user management, on the other hand, is like a complete security system with access control, monitoring, and automated management.
⚠️ **Note:** In this article, we use Ubuntu/Debian as the example distribution. The basic concepts are the same on all Linux systems, but package installation and some configuration paths may vary depending on the distribution. If you use a different distribution, please consult the relevant documentation for the specific installation commands and paths.
## Installing Required Packages
**Installing PAM modules for advanced password policies**
* sudo apt install libpam-pwquality cracklib-runtime
**Verifying the installation**
```bash
dpkg -l | grep libpam-pwquality
dpkg -l | grep cracklib
```
**What gets installed?**
`libpam-pwquality`: Module for advanced password quality checks
`cracklib-runtime`: Dictionary-based password validation
**Important configuration files:**
```markdown
┌─────────────────────────────────────────────────────────────┐
│ STRUCTURE OF PWQUALITY CONFIGURATION FILES │
├─────────────────────────────────────────────────────────────┤
│ │
│ /etc/security/ │
│ ├── pwquality.conf → Main quality configuration │
│ └── pwquality.conf.d/ → Modular configuration files │
│ │
└─────────────────────────────────────────────────────────────┘
```
## Understanding Password Policies
A password policy is like a set of rules for secure passwords:
**Password policy components:**
```markdown
┌─────────── Complexity ─────────────────────────────────────┐
│ • Minimum length │
│ • Character types │
│ • Repetition rules │
├─────────── Lifecycle ──────────────────────────────────────┤
│ • Validity period │
│ • History │
│ • Change intervals │
└─────────────────────────────────────────────────────────────┘
```
### Password Policy Configuration
In advanced user management, setting up secure password policies is crucial. Think of the password policy like a security standard in a building.
Understanding Basic Password Policies
**Password components:**
```markdown
┌─────────── Complexity ─────────────────────────────────────┐
│ • Minimum length │
│ • Character types (A-Z, a-z, 0-9, @#$) │
│ • Dictionary check │
├─────────── Validity ───────────────────────────────────────┤
│ • Maximum age │
│ • Minimum age │
│ • Warning time before expiry │
├─────────── History ────────────────────────────────────────┤
│ • Number of old passwords │
│ • Reuse prevention │
└─────────────────────────────────────────────────────────────┘
```
PAM Configuration for Password Policies
PAM (Pluggable Authentication Modules) is the heart of authentication in Linux. It allows flexible configuration of security policies.
Understanding PAM
**PAM structure:**
```markdown
┌─────────── Authentication ────────────────────────────────┐
│ auth Identity verification │
├─────────── Account ───────────────────────────────────────┤
│ account Account access & status │
├─────────── Password ──────────────────────────────────────┤
│ password Password changes │
├─────────── Session ───────────────────────────────────────┤
│ session Session management │
└─────────────────────────────────────────────────────────────┘
```
### Setting Up Password Quality Policies
**Main configuration file:**
Open configuration file
* sudo nano /etc/security/pwquality.conf
Important parameters:
```bash
minlen = 12 # Minimum password length
minclass = 3 # At least 3 different character classes
maxrepeat = 2 # Maximum 2 identical characters in a row
gecoscheck = 1 # Checks for username in password
dictcheck = 1 # Enables dictionary check
```
### Configuring PAM Modules for Passwords
**PAM configuration for passwords**
* sudo nano /etc/pam.d/common-password
**Example configuration**
```bash
password required pam_pwquality.so retry=3
password required pam_unix.so use_authtok sha512 shadow remember=5
```
### Password History and Expiry Management
Managing password history and expiry times is an important security component:
**Password lifecycle:**
```markdown
┌─────────── Creation ──────────────────────────────────────┐
│ Day 0: New password set │
├─────────── Usage ─────────────────────────────────────────┤
│ Day 1-75: Normal usage │
├─────────── Warning ───────────────────────────────────────┤
│ Day 76-89: Expiry warning │
├─────────── Expiry ────────────────────────────────────────┤
│ Day 90: Password must be changed │
└─────────────────────────────────────────────────────────────┘
```
Configuring Password History
In `/etc/pam.d/common-password`:
```bash
password required pam_pwhistory.so remember=5 enforce_for_root use_authtok
```
**Parameters explained:**
```markdown
┌─────────────────────────────────────────────────────────────┐
│ IMPORTANT PAM PWHISTORY PARAMETERS │
├─────────────────────────────────────────────────────────────┤
│ │
│ remember=5 → Stores the last 5 passwords │
│ enforce_for_root → Enforces history for root as well │
│ use_authtok → Uses token from previous PAM modules │
│ │
└─────────────────────────────────────────────────────────────┘
```
Setting Up Password Expiry
in `/etc/login.defs`
```bash
PASS_MAX_DAYS 90 # Maximum age
PASS_MIN_DAYS 1 # Minimum age
PASS_WARN_AGE 14 # Warning time before expiry
```
**For individual users:**
* sudo chage -M 90 -m 1 -W 14 username
Detailed Expiry Configuration
Display user details:
* sudo chage -l username
**Example output:**
* Last password change : Jan 01, 2024
* Password expires : Apr 01, 2024
* Password inactive : never
* Account expires : never
* Minimum number of days between changes : 1
* Maximum number of days between changes : 90
* Number of days of warning before expire : 14
### Common Password Policy Issues
**Problem:** Password change fails
```bash
# Error message on password change:
passwd
# Output: "Password does not meet complexity requirements"
# Checking the current policy:
sudo cat /etc/security/pwquality.conf | grep -v '^#'
```
**Common causes:**
* Password too short
* Missing character classes
* Contains username
* Too similar to old password
* Password history violated
**Problem:** User cannot log in
```bash
# Checking password status
sudo chage -l username
# Common causes and solutions:
# 1. Password expired
sudo chage -d 0 username
# Forces change on next login
# 2. Account locked
sudo usermod -U username
# Unlock account
# 3. Check PAM configuration
sudo cat /etc/pam.d/common-auth
```
### Practical Examples
**Scenario 1:** Development team setup
```bash
# Password policy for developers
sudo nano /etc/security/pwquality.conf
minlen = 14
minclass = 3
maxrepeat = 2
enforce_for_root
# Password aging for sensitive projects
sudo chage -M 60 -m 1 -W 7 developer1
```
**Scenario 2:** Temporary employees
```bash
# Set expiry date
sudo useradd -e 2024-12-31 tempuser
# or for existing user
sudo chage -E 2024-12-31 tempuser
# Check status
sudo chage -l tempuser
```
**Scenario 3:** Enforce automatic password change
New employees should change their initial password on first login.
```bash
# Force password change
sudo chage -d 0 newuser
# Check settings
sudo chage -l newuser
```
**Scenario 4:** Temporary access
Interns need access for 3 months.
```bash
# Create user with expiry date
sudo useradd -e $(date -d "+3 months" +%Y-%m-%d) intern01
# Warning 14 days before expiry
sudo chage -W 14 intern01
# Check status
sudo chage -l intern01
```
**Scenario 5:** Enforce password history
```bash
# Adjust PAM configuration
sudo nano /etc/pam.d/common-password
# Add/adjust the following line:
password required pam_pwhistory.so remember=5 use_authtok
# Parameters explained:
remember=5 # Stores the last 5 passwords
use_authtok # Uses previous PAM token
```
## Implementing User Quotas
Quotas are like storage limits for users and groups. They help control resource usage.
**Quota types:**
```markdown
┌─────────── Block Quotas ────────────────────────────────────┐
│ Limits storage space │
│ Example: 5GB per user │
├─────────── Inode Quotas ────────────────────────────────────┤
│ Limits number of files │
│ Example: Max. 50,000 files │
└─────────────────────────────────────────────────────────────┘
```
### Activating the Quota System
Installing Quota Support
* sudo apt install quota quotatool
**Adjusting `/etc/fstab`**
```bash
# Add usrquota,grpquota to mount options
sudo nano /etc/fstab
# Example:
# /dev/sda1 /home ext4 defaults,usrquota,grpquota 0 2
```
**Remounting the filesystem**
* sudo mount -o remount /home
### Setting Up Quotas
Creating Quota Databases
* sudo quotacheck -cugm /home
**Activating quotas**
* sudo quotaon -v /home
**Setting quota for a user**
```bash
sudo edquota -u username
# Soft limit: Warning
# Hard limit: Strict limit
```
### Advanced Quota Configurations
Understanding Soft and Hard Limits:
**Editing quota for a user:**
* sudo edquota -u username
**Example output:**
```bash
Filesystem blocks soft hard inodes soft hard
/dev/sda1 500000 524288 786432 1000 1500 2000
├─Current┤└─Warn─┘└─Limit┘└─Files──────┘
```
**Meaning:**
* `blocks`: Current storage usage
* `soft`: Warning when exceeded
* `hard`: Absolute limit
* `inodes`: Number of files
Managing Group Quotas:
```bash
# Set quota for a group
sudo edquota -g developers
# Display quota status for group
sudo quota -g developers
# Quota report for all groups
sudo repquota -g /home
```
Configuring Quota Warnings:
Set grace period:
* sudo edquota -t
**Example:**
```bash
Filesystem Block grace period Inode grace period
/dev/sda1 7days 7days
# 7 days between soft and hard limit
```
### Practical Quota Scenarios
Development Team Setup
Developers get generous limits:
* sudo edquota -u developer1
**Example:**
```bash
Filesystem blocks soft hard inodes soft hard
/dev/sda1 500000 5242880 6291456 10000 50000 75000
# Meaning:
# - 5GB soft limit (warning)
# - 6GB hard limit (strict)
# - 50,000 files soft limit
# - 75,000 files hard limit
```
Intern Setup
Limited resources for temporary employees:
* sudo edquota -u intern1
**Example:**
* Filesystem blocks soft hard inodes soft hard
* /dev/sda1 100000 524288 786432 1000 2000 3000
Create template for all interns:
* sudo edquota -p intern1 intern2 intern3
### Project Quotas
Project directory with group quota:
* sudo edquota -g projectgroup
**Example:**
* Filesystem blocks soft hard inodes soft hard
* /dev/sda1 1000000 10485760 15728640 20000 50000 75000
Quota report for the project:
```bash
sudo repquota -g /home | grep projectgroup
```
### Quota Monitoring and Management
```bash
# Display quota status for a user
sudo quota -v username
# Quota report for all users
sudo repquota -a /home
# Detailed quota statistics
sudo quota -vs username
```
Quota Warnings and Notifications:
```bash
# Configure warning messages
sudo edquota -t
# Set grace period (grace period after exceeding limit)
# Set up email notifications
sudo nano /etc/quotamail.conf
```
Practical Monitoring Example:
```bash
#!/bin/bash
# Quota monitoring script
# Find users over 80% usage
repquota -a | awk '$4 > 80 {print $1": "$4"%"}'
# Send warning to users
for user in $(repquota -a | awk '$4 > 80 {print $1}')
do
echo "Warning: Quota nearly exhausted" | mail -s "Quota Warning" $user
done
```
## Access Control Lists (ACLs)
ACLs extend the traditional Linux permission system with fine-grained access controls.
**Prerequisites:**
* sudo apt install acl
### Understanding ACL Concepts
**ACL types:**
```markdown
┌─────────── Extended ACLs ─────────────────────────────────┐
│ • Additional user permissions │
│ • Additional group permissions │
│ • Inheritable permissions │
├─────────── Mask ───────────────────────────────────────────┤
│ • Maximum effective permissions │
│ • Overrides other ACL entries │
└─────────────────────────────────────────────────────────────┘
```
### ACL Management
**ACLs for existing directory structure**
* sudo setfacl -R -m g:developers:rwx /projects/webapp/
* sudo setfacl -R -m g:qa:rx /projects/webapp/
**Setting up inheritance**
* sudo setfacl -d -m g:developers:rwx /projects/webapp/
### Practical ACL Use Cases
Development Project Setup
```bash
# Create project structure
sudo mkdir -p /projects/webapp/{src,docs,config}
# Base ACLs for development team
sudo setfacl -m g:developers:rwx /projects/webapp/src
sudo setfacl -m g:developers:rwx /projects/webapp/docs
# Special permissions for QA team
sudo setfacl -m g:qa:rx /projects/webapp/src
sudo setfacl -m g:qa:r /projects/webapp/docs
# Config directory with restricted access
sudo setfacl -m g:admin:rwx,g:developers:r /projects/webapp/config
```
### Managing ACLs
```bash
# Display ACL for a file
getfacl file.txt
# Set ACL
# Syntax: setfacl -m u:username:rwx file
setfacl -m u:anna:rw- project.txt
setfacl -m g:developers:r-x scripts/
# Multiple ACL entries
setfacl -m u:anna:rw-,g:project:r-- file.txt
# Recursive ACLs for directories
setfacl -R -m g:developers:rwx /projects/
```
### Practical ACL Examples
Standard ACLs for a Project Directory
```bash
# Create project directory
sudo mkdir -p /projects/webapp
# Set base ACLs
# Developers have full access
# QA team has read and execute permissions
sudo setfacl -m g:developers:rwx,g:qa:rx /projects/webapp
# Default ACLs for new files
sudo setfacl -d -m g:developers:rwx,g:qa:rx /projects/webapp
# Verify ACLs
getfacl /projects/webapp
```
Shared Document Directory
```bash
# Document structure
sudo mkdir -p /documents/{public,team,management}
# Public: Everyone can read
sudo setfacl -m g:users:rx /documents/public
sudo setfacl -d -m g:users:rx /documents/public
# Team: Only team members
sudo setfacl -m g:team:rwx /documents/team
sudo setfacl -d -m g:team:rwx /documents/team
# Management: Only specific people
sudo setfacl -m u:boss:rwx,u:secretary:rx /documents/management
```
ACLs for Different Use Cases
Shared document directory:
```bash
# Directory structure:
/documents/
├── public/ # Everyone can read
├── team/ # Only team members
└── private/ # Only specific users
# Set ACLs
sudo setfacl -R -m g:users:rx /documents/public
sudo setfacl -R -m g:team:rwx /documents/team
sudo setfacl -m u:boss:rwx,u:secretary:rx /documents/private
```
### More Practical ACL Examples
Complex Project Structure with ACLs
```bash
# Create project structure
sudo mkdir -p /projects/webapp/{src,docs,config,tests}
# Base permissions
sudo chown -R root:developers /projects/webapp
sudo chmod 2775 /projects/webapp
# Set differentiated ACLs
# Developers have full access to src and tests
sudo setfacl -R -m g:developers:rwx /projects/webapp/src
sudo setfacl -R -m g:developers:rwx /projects/webapp/tests
# QA team has read and execute permissions for tests
sudo setfacl -R -m g:qa:rx /projects/webapp/tests
# Documentation readable for everyone
sudo setfacl -R -m g:users:rx /projects/webapp/docs
# Config only for administrators
sudo setfacl -R -m g:admin:rwx,g:developers:r /projects/webapp/config
```
ACL Inheritance for New Files
```bash
# Set default ACLs for new files
sudo setfacl -d -m g:developers:rwx /projects/webapp/src
sudo setfacl -d -m g:qa:rx /projects/webapp/tests
# Verify ACL inheritance
getfacl /projects/webapp/src
```
## Monitoring User Activities
Monitoring user activities is an important aspect of system security and management.
**Prerequisites:**
* sudo apt install auditd audispd-plugins
### Understanding User Activity Monitoring
**Monitoring areas:**
```markdown
┌─────────── Login/Logout ────────────────────────────────────┐
│ • Login attempts │
│ • Successful/failed │
│ • SSH access │
├─────────── Activities ─────────────────────────────────────┤
│ • Executed commands │
│ • File access │
│ • Resource usage │
└─────────────────────────────────────────────────────────────┘
```
### Login Monitoring
```bash
# Current login sessions
who
w
# Login history
last
last -f /var/log/wtmp
# Successful logins
lastb
# Failed logins
# Monitor SSH access
tail -f /var/log/auth.log | grep sshd
```
### Recording User Activities
```bash
# Activate audit system
sudo apt install auditd
# Add audit rules
sudo auditctl -w /etc/passwd -p wa -k user-modify
sudo auditctl -w /etc/group -p wa -k group-modify
# Display audit logs
sudo ausearch -k user-modify
sudo aureport --auth
# Authentication report
```
### Monitoring Resource Usage
```bash
# Processes of a user
ps -u username
# Resource consumption
top -u username
iotop -u username
# I/O activity
# Detailed process analysis
sudo ps auxf | grep username
```
### Advanced Monitoring Tools
Process Monitoring with auditd:
```bash
# Set up process monitoring
sudo auditctl -a exit,always -F arch=b64 -S execve -k cmd_exec
# Monitor user actions
sudo ausearch -k cmd_exec
sudo aureport -x --summary
# Detailed process analysis
sudo ausearch -k cmd_exec -i | grep username
```
Login Monitoring with fail2ban:
```bash
# Installation
sudo apt install fail2ban
# Check configuration
sudo fail2ban-client status
sudo fail2ban-client status sshd
# Display blocked IPs
sudo fail2ban-client get sshd banip
```
Resource Monitoring:
```bash
# CPU and memory per user
top -U username
# Disk usage per user
sudo du -sh /home/*
# Network activity
sudo nethogs
sudo iftop
```
### Real-Time Monitoring
System Activity Reporter (SAR):
```bash
# Installation
sudo apt install sysstat
# Record activities
sudo sar -u 1 5
# CPU usage every 1 second, 5 times
sudo sar -r 1 5
# Memory usage
sudo sar -b 1 5
# I/O statistics
```
Process Tracking:
```bash
# Process tree of a user
pstree username
# Detailed process information
ps auxf | grep username
# Continuous monitoring
watch -n 1 'ps aux | grep username'
```
## Integration of Monitoring Tools
### Central Logging System
```bash
# Configure rsyslog for central logging
sudo nano /etc/rsyslog.d/auth-logging.conf
# Example configuration:
auth,authpriv.* /var/log/auth.log
# Log user activities
*.*;auth,authpriv.none -/var/log/syslog
```
### **Automated Monitoring Script:**
```bash
#!/bin/bash
# user-monitor.sh
# Monitor user activities
echo "=== Daily User Activity Report ===" > /var/log/user-report.txt
date >> /var/log/user-report.txt
# Login attempts
echo "Failed Logins:" >> /var/log/user-report.txt
grep "Failed password" /var/log/auth.log >> /var/log/user-report.txt
# Sudo usage
echo "Sudo Usage:" >> /var/log/user-report.txt
grep "sudo:" /var/log/auth.log >> /var/log/user-report.txt
# Resource usage per user
echo "Resource Usage:" >> /var/log/user-report.txt
ps aux --sort=-%cpu | head -n 5 >> /var/log/user-report.txt
```
**Automatic notifications:**
```bash
# Warning on suspicious activities
if grep -q "Failed password" /var/log/auth.log; then
echo "Warning: Failed login attempts" | \
mail -s "Security Warning" admin@localhost
fi
```
## Troubleshooting
### Common PAM Issues and Solutions
PAM Configuration Issues
**Problem:** PAM authentication fails
```bash
# Error message:
# Authentication token manipulation error
# Step-by-step diagnosis:
# 1. Check PAM logs
sudo tail -f /var/log/auth.log
# 2. Verify PAM modules
ldd /usr/lib/pam/pam_pwquality.so
# 3. Test PAM configuration
sudo pam-auth-update --verbose
```
Permission Issues
**Problem:** Shadow password access
```bash
# Error message:
# Authentication service cannot retrieve authentication info
# Solutions:
# 1. Check shadow file permissions
ls -l /etc/shadow
# Should be: -rw-r----- root:shadow
# 2. Check PAM shadow module
sudo ls -l /lib/x86_64-linux-gnu/security/pam_unix.so
```
Practical Solution Examples
**Problem:** Bypass password history (for emergencies)
```bash
sudo nano /etc/pam.d/common-password
# Temporarily comment out remember=5
```
**Problem:** Locked root account
* sudo passwd -u root
**Problem:** Forgotten password
* sudo passwd username
## Best Practices for Troubleshooting
### Systematic Error Search
**Checklist for password problems:**
```markdown
┌─────────── Configuration ──────────────────────────────────┐
│ □ PAM modules installed? │
│ □ Configuration files readable? │
│ □ Permissions correct? │
├─────────── Logs ───────────────────────────────────────────┤
│ □ auth.log checked? │
│ □ syslog reviewed? │
│ □ systemd-journal examined? │
├─────────── User ───────────────────────────────────────────┤
│ □ Account not locked? │
│ □ Groups correct? │
│ □ Shadow entry present? │
└─────────────────────────────────────────────────────────────┘
```
**Logging and Monitoring**
```bash
# Real-time log monitoring
sudo tail -f /var/log/auth.log
# Failed login attempts
sudo grep "Failed password" /var/log/auth.log
# Monitor PAM events
sudo journalctl -u systemd-logind
```
**Emergency Recovery**
```bash
# Temporary policy disable (emergencies only!)
sudo mv /etc/pam.d/common-password /etc/pam.d/common-password.bak
sudo cp /etc/pam.d/common-password.orig /etc/pam.d/common-password
# Restore backup
sudo mv /etc/pam.d/common-password.bak /etc/pam.d/common-password
```
**Documentation and Reporting**
```bash
# Document current configuration
sudo cp /etc/security/pwquality.conf /root/pwquality.conf.$(date +%F)
# Log configuration changes
echo "$(date): PAM configuration adjusted" >> /var/log/security-changes.log
# Regular checks
sudo aureport --auth
# Authentication reports
sudo aureport --failed
# Failed logins
```
## Exercise
### Setting Up a Secure User Environment
**Scenario:** You need to set up a secure user environment with advanced password policies and access controls for a development team.
**Requirements:**
```markdown
┌─────────── Password Policy ─────────────────────────────────┐
│ • At least 12 characters │
│ • Complexity rules │
│ • 90 days validity │
│ • 5 password history │
├─────────── User Groups ─────────────────────────────────────┤
│ • Developers (full access) │
│ • Interns (restricted) │
│ • External (temporary access) │
└─────────────────────────────────────────────────────────────┘
```
**Possible solution:**
```bash
#!/bin/bash
# 1. PAM configuration
sudo nano /etc/security/pwquality.conf
# Add:
minlen = 12
minclass = 3
maxrepeat = 2
enforce_for_root
# 2. Password history
sudo nano /etc/pam.d/common-password
# Add:
password required pam_pwhistory.so remember=5 use_authtok
# 3. Password aging
sudo nano /etc/login.defs
# Set:
PASS_MAX_DAYS 90
PASS_MIN_DAYS 1
PASS_WARN_AGE 14
# 4. Create groups
sudo groupadd developers
sudo groupadd interns
sudo groupadd external
# 5. Create users
# Developers
sudo useradd -m -s /bin/bash -G developers dev1
sudo chage -M 90 -m 1 -W 14 dev1
# Intern
sudo useradd -m -s /bin/bash -G interns intern1
sudo chage -M 30 -m 1 -W 7 intern1
# External
sudo useradd -m -s /bin/bash -G external extern1
sudo chage -E $(date -d "+90 days" +%Y-%m-%d) extern1
```
**Verification:**
**Checklist:**
```markdown
┌─────────── Password Policy ─────────────────────────────────┐
│ □ PAM modules installed │
│ □ Complexity rules active │
│ □ History configured │
├─────────── Users ───────────────────────────────────────────┤
│ □ Developer accounts active │
│ □ Interns time-limited │
│ □ External with expiry date │
└─────────────────────────────────────────────────────────────┘
```
## Command Reference (Cheatsheet)
For quick access during user, group, and permission management, the following reference table summarizes the most important commands of advanced user management:
| Command / Syntax | Category | Function & Description |
|---|---|---|
| `sudo chage -l ` | Password Aging | Displays detailed expiry dates, intervals, and warnings. |
| `sudo chage -M 90 -W 14 ` | Password Aging | Sets maximum validity (90 days) and warning time (14 days). |
| `sudo chage -d 0 ` | Password Aging | Forces immediate password change on next login. |
| `getfacl ` | POSIX ACL | Displays extended access control lists of a file. |
| `setfacl -m u:anna:rw ` | POSIX ACL | Assigns user 'anna' specific read/write permissions. |
| `setfacl -d -m g:grp:rwx ` | POSIX ACL | Defines inheritable default ACLs on a directory. |
| `setfacl -b ` | POSIX ACL | Removes all extended ACL entries completely. |
| `sudo edquota -u ` | Quotas | Interactively edits storage and inode limits. |
| `sudo setquota -u 500M 600M 0 0 /` | Quotas | Sets quota limits directly via command or script. |
| `sudo repquota -avugs` | Quotas | Generates system-wide quota report for users and groups. |
| `sudo visudo` | Sudoers | Opens Sudoers configuration with automatic syntax checking. |
| `sudo visudo -c` | Sudoers | Checks Sudoers files for syntax errors without opening them. |
| `last -n 20` | Audit / Monitoring | Displays the last 20 successful system logins. |
| `sudo lastb -n 20` | Audit / Monitoring | Displays failed login attempts (Bad Logins). |
| `sudo auditctl -w -p wa` | Audit / Monitoring | Monitors file write accesses via Linux kernel audit. |
## Further Resources
The following guides, specifications, and internal course modules deepen advanced user management and access control:
| Resource | Description |
|---|---|
| [Linux-PAM System Administrator's Guide](http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html){.badge-link-text} | Official manual for the modular PAM architecture. |
| [POSIX Access Control Lists on Linux](https://man7.org/linux/man-pages/man5/acl.5.html){.badge-link-text} | Official man page for POSIX ACLs and permission masks. |
| [Linux Quota Mini-HOWTO](https://tldp.org/HOWTO/Quota.html){.badge-link-text} | Detailed documentation for the Linux quota subsystem. |
| [Sudoers Manual & Syntax Reference](https://www.sudo.ws/docs/man/sudoers.man/){.badge-link-text} | Official documentation for Sudoers configuration. |
| [Linux Administration #1: Fundamentals](/en/linux-administration/linux-administration-fundamentals-of-linux-administration){.badge-link-text} | The foundation: system architecture, FHS, mounting & file permissions. |
| [chmod & File Permissions Guide](/en/linux-beginners/basics-to-best-practices-all-about-chmod-in-linux){.badge-link-text} | Fundamental deepening of permissions and octal values. |
## Conclusion
With mastery of PAM authentication stacks, strict password policies via `pwquality`, granular POSIX ACLs, storage quotas, and a professional Sudoers architecture, you are able to secure and manage multi-user systems according to the highest enterprise and compliance standards.
💡 **Practical Tip:** For sudo privileges, always use modular files under `/etc/sudoers.d/` with restrictive file permissions (`chmod 440`), instead of manually bloating the main file `/etc/sudoers`. This significantly simplifies configuration management via Ansible or GitOps.
In the next module of our administration course, we deal with monitoring and controlling running programs and system resources:
👉 **Next up:** [Linux Administration #3: Processes and Resource Management](/en/linux-administration/linux-administration-processes-and-resource-management){.badge-link-text}
👉 **Course Overview:** [All Linux Administration Articles & Modules](/en/category/linux-administration){.badge-link-text}