User account information is split across three traditional files: /etc/passwd (usernames, UIDs, GIDs, home, shell), /etc/shadow (password hashes and aging, readable only by root), and /etc/group (groups and members). useradd -m -s /bin/bash username creates a user with a home directory and Bash shell; new homes are templated from /etc/skel/. usermod -aG group user appends supplementary groups without removing existing memberships, and id username prints numeric IDs and groups. Password operations include passwd -e or chage -d 0 to expire immediately, chage -l to view aging, and passwd -l to lock an account. pwck and grpck verify the integrity of these files, and /etc/login.defs sets defaults for UID ranges, password aging, and umask. Active sessions are reviewed with last (recent logins from /var/log/wtmp), who (currently logged-in users), and w (logged-in users plus their processes and load averages).
Standard POSIX permissions revolve around chmod, chown, and umask. chmod 755 gives the owner full access and read/execute to group and others; chmod 640 gives owner read/write, group read, and no access to others. umask subtracts bits from defaults, so 022 means new files emerge as 644 and directories as 755. Two special bits matter: the sticky bit (chmod 1777 /tmp) prevents users from deleting others' files in a world-writable directory, and SGID on a directory (chmod g+s) makes new files inherit the directory's group. Hard links point to the same inode and continue to work even if the original name is deleted, while symbolic links point to a path and can cross filesystems. Recursive ownership changes use chown -R user:group /path. SUID binaries are security-relevant and can be audited with find / -perm -4000 -type f 2>/dev/null; world-writable directories with find / -type d -perm -0002 -ls 2>/dev/null; and orphaned files with find / -nouser -o -nogroup 2>/dev/null.
Beyond POSIX bits, ACLs provide finer-grained access control: getfacl filename lists ACLs and setfacl -m u:username:rwx filename grants them. A trailing + in ls -l output indicates an ACL is set, and setfacl -b removes all extended entries. Default ACLs on directories (setfacl -d -m) propagate to new entries. Extended attributes (getfattr -d, lsattr) hold metadata such as security labels and capabilities. chattr +i and chattr -i toggle immutability, and chattr +a sets append-only mode for log files. Linux capabilities allow fine-grained privilege grants without full root, set with setcap cap_net_bind_service+ep /path/to/binary and inspected with getcap. rsync -aAXH --delete src/ dest/ preserves ACLs, xattrs, and hardlinks during synchronization (run as root).
Mandatory access control systems add another layer. SELinux's mode is checked with getenforce (Enforcing, Permissive, Disabled), temporarily relaxed with setenforce 0, and contexts restored with restorecon -Rv /path. AppArmor profiles are viewed with aa-status, which shows loaded profiles and their enforce/complain modes. Sudoers rules are edited with visudo for syntax safety, and a user can review what they may run with sudo -l. fail2ban watches logs and updates firewall rules to block IPs exhibiting brute-force patterns. Shell resource limits are inspected with ulimit -a, raised for the session with ulimit -n 65535, and set permanently in /etc/security/limits.conf. Temporary sysctl changes use sysctl -w key=value, persistent settings live in /etc/sysctl.conf or files under /etc/sysctl.d/, and sysctl --system reloads everything.