LFCS 163 🐧 LFCS Exam Objectives Review — Domain 3 - KandZ

⏱️ Estimated read: 9 min | |

The previous chapter reviewed Domain 2: Operations Deployment. This chapter covers Domain 3: Users and Groups. This domain is weighted at 10% of the total score, the smallest of the five domains, but it is the domain where the permission errors and the authentication failures originate . The objectives are the user and group lifecycle, the password aging, the PAM configuration, the sudo privileges, the resource limits, and the environment profiles. The critical trap is the assumption that “users and groups” means only the useradd and the groupadd commands. The exam tests the deeper mechanics: the /etc/passwd and /etc/shadow structure, the chage for the aging, the visudo for the safe edit, the ulimit and the limits.conf for the limits, and the /etc/profile and the /etc/skel for the environment .

Key point: Users and Groups is 10% of the exam. The objectives are the user and group creation, the password management, the privilege escalation with sudo, the PAM configuration, the resource limits with ulimit and limits.conf, and the environment profiles. The exam tests the files that store the data (/etc/passwd, /etc/shadow, /etc/group, /etc/sudoers) and the commands that modify them.

Why Domain 3 requires a specific mental model

The small domain problem. The 10% weight means the domain has fewer tasks on the exam, but the tasks are not trivial. The candidate who ignores the domain because of the low weight loses the points that are easy to secure with the practice. The user and group tasks are the fastest to complete if the candidate is fluent with the commands.

The file structure problem. The user data is stored in the plain text files. The /etc/passwd is the user accounts (the username, the UID, the GID, the home, the shell). The /etc/shadow is the passwords and the aging (the hash, the last change, the min, the max, the warn, the inactive, the expire). The /etc/group is the groups and the members. The /etc/gshadow is the group passwords. The exam tests the understanding of the fields, not just the commands .

The sudo problem. The sudo configuration is the security boundary. The /etc/sudoers file must be edited with the visudo command, which validates the syntax and prevents the lockout. The %wheel group, the NOPASSWD tag, and the ALL=(ALL:ALL) ALL line are the exam-relevant syntax. The direct edit of the /etc/sudoers is the common mistake that breaks the system .

The PAM problem. The PAM (Pluggable Authentication Modules) is the authentication framework. The /etc/pam.d/ directory contains the service-specific configurations. The pam_pwquality enforces the password complexity, the pam_limits applies the resource limits, and the pam_tally2/pam_faillock locks the accounts after the failed logins. The exam tests the basic PAM configuration, not the custom module development.

The trade-off. The domain is small, but the concepts are the foundation for the security. The permission model, the privilege escalation, and the resource limits appear in the other domains (the files, the services, the SELinux). The review must be complete, even if the domain is 10%.

a. The user and group lifecycle

The objectives: the create, the modify, the delete, and the password management. The commands: useradd, usermod, userdel, groupadd, groupdel, passwd, chage, id, groups.

# Create a user with the home, the shell, and the groups
sudo useradd -m -s /bin/bash -G developers alice

# Set the password
sudo passwd alice

# Modify the user (add the group, change the shell)
sudo usermod -aG wheel alice
sudo usermod -s /bin/zsh alice

# Password aging
sudo chage -M 90 -W 7 -I 14 alice

# Create a group
sudo groupadd developers

# Check the identity
id alice
groups alice

# Delete the user (and the home)
sudo userdel -r alice

The -m creates the home directory. The -s sets the login shell. The -G adds the supplementary groups. The -aG appends the group without removing the existing ones (the missing -a is the common mistake that removes the user from the other groups). The chage -M 90 sets the maximum password age to 90 days. The -W 7 sets the warning to 7 days. The -I 14 sets the inactivity to 14 days. The userdel -r removes the home and the mail spool .

b. The `sudo` and the privilege escalation

The objectives: the configure the sudo, the grant the privileges, and the validate the syntax. The commands: visudo, sudo -l, /etc/sudoers.d/.

# Safe edit of the sudoers
sudo visudo

# Add a user to the wheel group (the RHEL default)
sudo usermod -aG wheel alice

# Add a drop-in file for the specific user
echo "alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl" | sudo tee /etc/sudoers.d/alice
sudo chmod 440 /etc/sudoers.d/alice

# Check the privileges
sudo -l -U alice

The visudo validates the syntax before saving, which prevents the lockout. The %wheel ALL=(ALL:ALL) ALL is the standard line that grants the full privileges to the wheel group. The /etc/sudoers.d/ is the drop-in directory for the per-user rules. The file permissions must be 440 or the sudo refuses to read them. The NOPASSWD tag skips the password prompt for the specific commands .

c. The PAM, the limits, and the environment

The objectives: the PAM configuration, the resource limits, and the environment profiles. The commands: /etc/pam.d/, ulimit, /etc/security/limits.conf, /etc/profile, /etc/skel.

# PAM password quality
sudo tee /etc/security/pwquality.conf <<'EOF'
minlen = 12
dcredit = -1
ucredit = -1
EOF

# Resource limits (the persistent)
echo "alice soft nofile 4096" | sudo tee -a /etc/security/limits.conf
echo "alice hard nofile 8192" | sudo tee -a /etc/security/limits.conf

# The runtime limit
ulimit -n 4096

# The environment profile
echo "export EDITOR=vim" | sudo tee -a /etc/profile.d/custom.sh

# The template for the new users
echo "alias ll='ls -la'" | sudo tee /etc/skel/.bashrc

The pwquality.conf sets the password complexity. The limits.conf sets the per-user or per-group limits (the soft is the current, the hard is the ceiling). The ulimit is the runtime change (the per-session). The /etc/profile.d/*.sh is the system-wide environment. The /etc/skel/ is the template that the useradd -m copies to the new home .

Complete Example Session

# ============================================
# PART 1: CREATE THE USER AND GROUP
# ============================================

sudo groupadd developers
sudo useradd -m -s /bin/bash -G developers alice
sudo passwd alice

# ============================================
# PART 2: PASSWORD AGING
# ============================================

sudo chage -M 90 -W 7 -I 14 alice
sudo chage -l alice

# ============================================
# PART 3: MODIFY THE USER
# ============================================

sudo usermod -aG wheel alice
id alice

# ============================================
# PART 4: SUDO ACCESS
# ============================================

echo "alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl" | sudo tee /etc/sudoers.d/alice
sudo chmod 440 /etc/sudoers.d/alice
sudo -l -U alice

# ============================================
# PART 5: PAM QUALITY
# ============================================

echo "minlen = 12" | sudo tee -a /etc/security/pwquality.conf

# ============================================
# PART 6: LIMITS
# ============================================

echo "alice soft nofile 4096" | sudo tee -a /etc/security/limits.conf
ulimit -n

# ============================================
# PART 7: ENVIRONMENT
# ============================================

echo "export EDITOR=vim" | sudo tee /etc/profile.d/custom.sh

# ============================================
# PART 8: SKELETON
# ============================================

echo "alias ll='ls -la'" | sudo tee /etc/skel/.bashrc

# ============================================
# PART 9: CLEANUP
# ============================================

sudo userdel -r alice
sudo groupdel developers

The nine parts trace the Domain 3 objectives: the user and group, the aging, the modify, the sudo, the PAM, the limits, the environment, the skeleton, and the cleanup.

Quick Reference

User and Group Commands

Command	Purpose
`useradd -m -s`	Create the user
`usermod -aG`	Append the group
`userdel -r`	Delete the user and the home
`groupadd`	Create the group
`passwd`	Set the password
`chage`	Password aging
`id`	Show the UID and the GID

Sudo

Command	Purpose
`visudo`	Safe edit of `/etc/sudoers`
`/etc/sudoers.d/`	Drop-in rules
`sudo -l -U`	Check the privileges

PAM and Limits

File	Purpose
`/etc/pam.d/`	PAM service configs
`/etc/security/pwquality.conf`	Password quality
`/etc/security/limits.conf`	Resource limits
`ulimit`	Runtime limits

Environment

File	Purpose
`/etc/profile`	System-wide login
`/etc/profile.d/*.sh`	Drop-in scripts
`/etc/skel/`	New user template

Best Practices

✅ Do This:

sudo useradd -m -s /bin/bash alice
<!-- Create the home and the shell -->               # ✅

sudo usermod -aG wheel alice
<!-- Use -a to append the group -->                  # ✅

sudo visudo
<!-- Edit the sudoers safely -->                     # ✅

❌ Don’t Do This:

sudo usermod -G wheel alice
<!-- Removes the user from the other groups -->      # ❌

sudo nano /etc/sudoers
<!-- Syntax error locks out the sudo -->             # ❌

sudo userdel alice
<!-- Leaves the home directory -->                  # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
User removed from the groups	Used `-G` without `-a`	Use `-aG`
Sudo broken	Edited `/etc/sudoers` directly	Use `visudo`
Sudo drop-in ignored	Wrong permissions	`chmod 440`
Password aging not applied	Used `passwd` only	Use `chage`
Limits not persistent	Used `ulimit` only	Add to `limits.conf`

Real-World Examples

1. Create User

useradd -m -s /bin/bash alice

2. Set Password

passwd alice

3. Add Group

usermod -aG wheel alice

4. Password Aging

chage -M 90 alice

5. Sudo Drop-in

echo "alice ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/alice

6. Check Sudo

sudo -l -U alice

7. PAM Quality

echo "minlen = 12" >> /etc/security/pwquality.conf

8. Limits

echo "alice soft nofile 4096" >> /etc/security/limits.conf

9. Profile

echo "export EDITOR=vim" > /etc/profile.d/custom.sh

10. Skeleton

echo "alias ll='ls -la'" > /etc/skel/.bashrc

Visual

Domain 3 Structure

┌──────────────────────────────────────────────┐
│  Domain 3: Users and Groups (10%)            │
│  ├── User lifecycle                          │
│  ├── Group lifecycle                         │
│  ├── Password and aging                      │
│  ├── Sudo privileges                         │
│  ├── PAM configuration                       │
│  ├── Resource limits                         │
│  └── Environment profiles                    │
└──────────────────────────────────────────────┘

Sudo Flow

┌──────────────────────────────────────────────┐
│  User runs sudo command                      │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  /etc/sudoers + /etc/sudoers.d/              │
│  → Rule matches?                             │
└──────────┬───────────────────────┬───────────┘
           │ YES                   │ NO
           ▼                       ▼
┌──────────────────────┐  ┌──────────────────────┐
│  Password required?  │  │  Permission denied   │
│  ├─ YES → prompt     │  └──────────────────────┘
│  └─ NO  → run        │
└──────────────────────┘

Summary

Item	Value
Domain weighting	10%
User create	`useradd -m -s -G`
User modify	`usermod -aG`
User delete	`userdel -r`
Password aging	`chage`
Sudo edit	`visudo`
Sudo drop-in	`/etc/sudoers.d/`
PAM quality	`/etc/security/pwquality.conf`
Limits	`ulimit`, `limits.conf`
Environment	`/etc/profile.d/`, `/etc/skel/`

Key takeaways:

The domain is 10% of the exam. The weight is small, but the concepts (the permissions, the privilege escalation, the limits) appear in the other domains. The review must be complete.
The -aG is the trap. The usermod -G without the -a removes the user from the other groups. The -aG appends the group. The exam tests the append.
The visudo is the only safe edit. The /etc/sudoers direct edit with the syntax error locks out the sudo. The visudo validates the syntax. The drop-in files in /etc/sudoers.d/ must have the 440 permissions.
The chage is the password aging. The -M is the max age, the -W is the warning, the -I is the inactivity. The passwd sets the password; the chage sets the policy.
The limits.conf is the persistence. The ulimit is the per-session. The limits.conf is the persistent. The pam_limits applies the limits at login.

Remember: Domain 3 is the users and groups. The useradd, the usermod, the chage, the visudo, the ulimit, the limits.conf. The -aG is the append. The visudo is the safe. The chage is the aging. The exam tests the syntax and the file structure.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!