Users, Groups and IDs

Who am I?

Linux is a multi-user system: many people and programs can use the same machine, each with their own account. You already know whoami. id tells you more:

whoami
id
groups

In the terminal

student@vulntech:~$ whoami
student
student@vulntech:~$ id
uid=1000(student) gid=1000(student) groups=1000(student),1001(sudo)
student@vulntech:~$ groups
student sudo

Each user has a number, the user ID (UID), and belongs to one or more groups, each with a group ID (GID). Linux itself works with the numbers; the names are for us humans.

/etc/passwd: the list of accounts

Every account is a line in /etc/passwd. Despite its name, it holds no passwords any more, and everyone can read it:

grep student /etc/passwd

In the terminal

student@vulntech:~$ grep student /etc/passwd
student:x:1000:1000:Student:/home/student:/bin/bash

The seven fields are separated by colons:

root and the system accounts

head -n 4 /etc/passwd
id root

In the terminal

student@vulntech:~$ head -n 4 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
student@vulntech:~$ id root
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

/etc/group: the list of groups

Groups live in /etc/group: name, password placeholder, GID and the extra members. getent looks up one entry:

getent group sudo
getent passwd root

In the terminal

student@vulntech:~$ getent group sudo
sudo:x:1001:student
student@vulntech:~$ getent passwd root
root:x:0:0:root:/root:/bin/bash

Tip: Security check: only root should have UID 0. Another account with UID 0 is a classic backdoor. You'll hunt for one in this module's last lab.

Remember: id shows your UID, GID and groups. Accounts are in /etc/passwd, groups in /etc/group. UID 0 is root.