Skip to main content

Exercise: User Management

In this exercise, you will learn how to manage users and groups on a Linux system. You will create and delete users and groups, and practice switching between users.

Note: sudo command allows you to run commands with elevated privileges. Some of the commands in this exercise require root privileges, so you will need to use sudo to execute them.

Step 1: Create a New User​

First, let's create a random password using pwgen:

pwgen 20 1

This command generates a random password of 20 characters. You can use this password for the new user.

Now, create a new user called dev:

sudo adduser dev

You will be prompted to enter a password for the new user. Use the password generated by pwgen. You can also fill in the additional information or leave it blank. Note when you paste the password, it will not show up on the screen. Just paste it and press Enter.

This will create a new user with a home directory and set the password. You can verify that the user was created by checking the /etc/passwd file:

cat /etc/passwd | grep dev

This command will show the entry for the dev user in the /etc/passwd file (which contains user account information).

Step 2: Give the User Sudo Privileges​

To allow the dev user to execute commands with sudo, we need to give the user sudo privileges. We can do this by running the following command:

visudo

This command opens the sudoers file (a file that controls sudo permissions) in the default text editor. Add the following line to the file

dev ALL=(ALL:ALL) NOPASSWD: ALL

This line allows the dev user to execute any command with sudo without being prompted for a password. Save and exit the file (usually by pressing Ctrl + X, then Y, and Enter).

The meaning of the line is as follows:

  • dev: The username of the user we are granting permissions to.
  • ALL=(ALL:ALL): This means that the user can run commands as any user and any group.
  • NOPASSWD: ALL: This means that the user can run all commands without being prompted for a password.

Test the sudo privileges by switching to the dev user and running a command with sudo:

su - dev
sudo whoami

This command should output root, indicating that the dev user has sudo privileges.

To switch back to the original user, you can use the exit command:

exit

Now you should be back to the root user or the user you were originally logged in as.

Step 3: Adding SSH Key for the User​

To allow the dev user to log in via SSH, we need to add an SSH key for the user.

Every time a user logs in via SSH, the server checks for the presence of an SSH key in the user's home directory. The SSH key is stored in a file called authorized_keys located in the .ssh directory within the user's home directory.

We need to create the .ssh directory and the authorized_keys file for the dev user:

mkdir -p /home/dev/.ssh

This command creates the .ssh directory in the dev user's home directory. The -p flag ensures that the parent directories are created if they do not exist.

For simplicity, we will copy the root user's SSH key to the dev user. This allows us to use the same SSH key for both users:

cp /root/.ssh/authorized_keys /home/dev/.ssh/

This command copies the authorized_keys file from the root user's .ssh directory to the dev user's .ssh directory.

Next, we need to set the correct permissions for the .ssh directory and the authorized_keys file. This is important, since the user will not be able to log in via SSH if the permissions are not set correctly:

chown -R dev:dev /home/dev/.ssh
chmod 700 /home/dev/.ssh
chmod 600 /home/dev/.ssh/authorized_keys
  • The chown command changes the ownership of the .ssh directory and its contents to the dev user and group.
  • The chmod 700 command sets the permissions for the .ssh directory to rwx------, which means that only the owner (the dev user) has read, write, and execute permissions.
  • The chmod 600 command sets the permissions for the authorized_keys file to rw-------, which means that only the owner (the dev user) has read and write permissions.

Now, the dev user should be able to log in via SSH using the same SSH key as the root user.

To test this, you can try to log in as the dev user from another terminal or SSH client:

ssh dev@localhost

This command attempts to log in to the local machine as the dev user. If everything is set up correctly, you should be able to log in without being prompted for a password, using the SSH key for authentication.