ExamFinch.com My Study

Study guide

5.1 Basic Security and Identifying User Types

Practice this exam

LPI Linux Essentials Certificate 010-160

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Study Strategy & Blueprint Weights

2 Topic 1: The Linux Community and a Career in Open Source

1.1 Linux Evolution and Popular Operating Systems 1.2 Major Open Source Applications 1.3 Open Source Software and Licensing 1.4 ICT Skills and Working in Linux

3 Topic 2 Part A: Command Line Basics & Getting Help

2.1a Bash Shell, Command Syntax & Variables 2.1b Quoting, History & Safe Command Syntax 2.2 Using the Command Line to Get Help

4 Topic 2 Part B: Directories, Listing & File Operations

2.3 Using Directories and Listing Files 2.4 Creating, Moving and Deleting Files

5 Topic 3 Part A: Archiving & Searching Data

3.1 Archiving and Compression on the Command Line 3.2a Pipes, Redirection, and Basic Regular Expressions 3.2b grep and Text Extraction Tools

6 Topic 3 Part B: Turning Commands into Scripts

3.3a Script Basics: Shebang, Variables, and Arguments 3.3b Loops, Exit Status, and Simple Conditionals 3.3c Editors, chmod +x, and Running Scripts

7 Topic 4 Part A: Choosing an OS, Hardware & FHS Basics

4.1 Choosing an Operating System 4.2 Understanding Computer Hardware 4.3a Where Programs and Configuration Live (FHS Basics)

8 Topic 4 Part B: Processes, Logs & Networking

4.3b Processes, Memory & Logs 4.4 Your Computer on the Network

9 Topic 5: Security and File Permissions

5.1 Basic Security and Identifying User Types 5.2 Creating Users and Groups 5.3 Managing File Permissions and Ownership 5.4 Special Directories and Files

5.1 Basic Security and Identifying User Types

Key Takeaways Explain This Topic AI

Linux accounts fall into three practical types: root (UID 0), standard human users, and system/service accounts used by daemons

/etc/passwd holds public account metadata; /etc/shadow holds password hashes and aging fields; /etc/group maps group names to GIDs and membership

id shows your UID/GID and groups; who, w, and last report who is (or was) logged in

su switches user (often to root); sudo runs one command with elevated rights when your account is permitted

  • Never log in as root for routine work—use a standard account and escalate only when needed
  • Last updated: July 2026

5.1 Basic Security and Identifying User Types

Every process on Linux runs as some user. That identity controls which files you can read, write, or execute—and whether you may change other accounts. Topic 5.1 asks you to recognize who is on the system, what kind of account they use, and how privilege escalation works with su and sudo .

Three user types you must distinguish

  • Type Typical UID Role Example
  • Root 0 Superuser; bypasses normal permission checks root
  • Standard (human) users Usually 1000+ on modern distros Interactive login accounts for people alice , bob

System / service users Low numbers (often 1–999 ) Run daemons and services without a human login www-data , nobody , sshd

Root is the administrative account (UID 0 ). It can change ownership, edit /etc , install packages, and manage users—and a mistyped rm as root can destroy the system. Treat root as an exception , not a daily login.

Standard users are the accounts people use day to day. They own their home directories (commonly /home/username ), can edit their own files, and need elevation for system-wide changes.

System users exist so services do not need root for every action. A web server might run as www-data so a compromised site process cannot freely rewrite the whole disk. These accounts often have no usable password and a shell set to something like /usr/sbin/nologin or /bin/false .

Worked example: On a laptop, you log in as jordan (UID 1000). You browse the web as that user. When you install a package, you briefly become root via sudo . The nginx worker processes may run as www-data (a system UID), not as jordan or root .

Account files: passwd, shadow, and group

Linux stores classic account databases as text files under /etc . You should know what each file holds and that password hashes are not in passwd on modern systems.

/etc/passwd — public account records

Each line is colon-separated. A typical entry looks like:

alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash

  • Field (order) Meaning
  • 1 Username Login name
  • 2 Password placeholder Usually x meaning “see shadow”
  • 3 UID Numeric user ID
  • 4 GID Primary group ID
  • 5 GECOS Comment (often full name)
  • 6 Home directory e.g. /home/alice
  • 7 Login shell e.g. /bin/bash or /usr/sbin/nologin

/etc/passwd is world-readable so programs can map UIDs to names—hence password hashes live in shadow instead.

/etc/shadow — secrets and aging

/etc/shadow is readable only by root (and sometimes a dedicated group). Fields include the username, the hashed password , and aging data (last change, minimum/maximum age, warn days, inactive days, expiration). If the password field is ! or * (conventions vary slightly by distro), the account cannot authenticate with a password.

/etc/group — groups and membership

Groups collect users for shared access. A line might look like:

developers:x:1500:alice,bob

  • Field Meaning
  • Group name e.g. developers
  • Password placeholder Usually x
  • GID Numeric group ID
  • Members Comma-separated usernames (supplementary membership)

Every user also has a primary group (the GID in passwd). Supplementary groups appear in the members list of /etc/group .

Commands that identify users and sessions

  • Command What it tells you
  • id Current UID, GID, and all group memberships
  • id alice Same data for another account (if permitted)
  • who Who is logged in (and often from where)
  • w Logged-in users plus what they are doing / load
  • last Recent login history from the wtmp log

id is the fastest self-check: after sudo -i or su - , run id and confirm UID 0 before doing destructive work. who and w answer “is anyone else on this machine?” last helps audit “who logged in recently?”—useful on shared lab systems. id

  • who
  • w
  • last | head
  • Escalating privileges: su vs sudo
  • Tool Typical use Password asked
  • su / su - Switch to another user shell (often root) Target user’s password (root’s, unless already root)
  • sudo command Run one command as root (or another user) Your password, if your sudoers policy allows it

su means “switch user.” Bare su usually switches to root while keeping parts of your environment; su - (or su - root ) starts a login-like root session with root’s home and PATH.

sudo (“superuser do”) is the modern default on many distros. Allowed users are listed in the sudoers policy. Then sudo apt install ... or sudo cat /etc/shadow runs that one command with elevated rights. After success, sudo may cache credentials briefly.

Worked contrast: su - asks for the root password and opens a root shell. sudo -i also aims for an interactive root shell, but authenticates with your password if you are allowed. On many cloud images, root login is disabled and only sudo works—know both concepts for the exam.

Security habits Essentials expects

Use a standard user for browsing, editing, and coding.

Escalate with sudo (or a brief su - ) only for admin tasks.

Prefer least privilege: services should run as a system user when possible.

Remember: the account files and id / who / w / last are as testable as sudo .

Topic 5.1 is the vocabulary layer for 5.2–5.4: you must name user types and the files that define them before creating accounts or applying modes.