Lion Cipher Lab

Manage Linux users, groups, and passwords (and understand /etc/passwd and /etc/shadow)

• Foundations
• Beginner
• ~40 min
• Free · no account required

Why it matters

Almost everything about controlling a Linux system -- who can log in, what a service is allowed to touch, why `sudo` is dangerous, how an attacker turns a foothold into root, and what password-cracking tools actually chew on -- comes back to three plain text files most beginners never open: /etc/passwd, /etc/shadow, and /etc/group. This lab teaches the account model from zero and makes you read those files with your own eyes. You will create a user with `useradd`, give it a password with `passwd`, then open /etc/passwd and decode the line field by field -- username, the `x` placeholder where…

What you'll learn

• creating a user with useradd (and the friendlier adduser) and setting a password with passwd
• reading /etc/passwd field by field: name:x:UID:GID:GECOS:home:shell, and why the password field is now just 'x'
• reading /etc/shadow: the hashed-password field, the $id$salt$hash format ($6$ = SHA-512, $y$ = yescrypt), and why the file is readable only by root
• understanding UID 0 (root) vs low-numbered system/service accounts vs human accounts (UID 1000+)
• creating and managing groups: groupadd, usermod -aG, primary vs supplementary groups, and reading them with id and groups
• modifying users with usermod and deleting them cleanly with userdel -r
• giving service accounts no login shell (/usr/sbin/nologin), and locking or expiring accounts with passwd -l, usermod -L, and chage
• the judgment: least privilege over handing out root/sudo, a dedicated no-shell user per service, and why /etc/shadow is separated from /etc/passwd

Steps in this lab

1. The account model in one breath — and a throwaway sandbox to practise in
2. Create a user and give it a password
3. Open /etc/passwd and decode the line field by field
4. Open /etc/shadow: the real hash, the $id$salt$hash format, and why it's root-only
5. Groups: primary vs supplementary, and adding a user with usermod -aG
6. Modify a user, then delete one cleanly
7. No login shell for services, and locking or expiring accounts
8. The judgment: least privilege, no-shell services, and why /etc/shadow exists at all
9. What you did, and the reflex to keep

Open the full interactive lab →