Linux: Users, Processes & Services

User

An identity on the system — UID, primary group, home directory, default shell

Group

Allows multiple users to share permissions

UID/GID 0

root

UID/GID 1-999 (or similar, distro-dependent)

System accounts/groups, reserved for services

UID/GID 1000+

Regular human user accounts

Primary Group

The default group a user belongs to — every file they create is owned by it until changed

Secondary Group

Additional groups a user belongs to for shared permissions, doesn't change file ownership defaults

sudo

Runs a single command with elevated privileges — logged, scoped, tied to your own account

su

Switches to another user's full session (commonly root) until you exit

Why sudo over su for root access

Per-user audit trail — su as root loses track of who actually ran what

/etc/sudoers

Defines who can use sudo and what they're allowed to run

visudo

Safely edits /etc/sudoers — validates syntax before saving, prevents a broken file from locking out all sudo access

/etc/skel

Template directory — its contents get copied into a new user's home directory when the account is created

/etc/passwd

User account information (username, UID, GID, home dir, shell)

/etc/passwd field order

username:x:UID:GID:comment:home_dir:shell

/etc/shadow

Stores encrypted passwords and password aging info — only root can read it

/etc/group

Group information (group name, GID, member list)

/etc/gshadow

Stores group passwords (rarely used) and group administrators

wheel vs sudo group

RHEL uses "wheel" for sudo access by default

useradd

Create a new user (low-level

useradd -m

Create the user's home directory (not automatic with useradd on all distros)

usermod -aG

Add a user to a group WITHOUT stripping existing secondary groups (-a = append)

usermod -G (no -a) danger

Overwrites the user's ENTIRE secondary group list

userdel -r

Delete a user AND their home directory

passwd username

Set/change a user's password

chage

View/set password aging policy (expiration, warning period)

groupadd / groupdel

Create / delete a group

groups username

Show which groups a user belongs to

id username

Show UID, GID, and full group membership

getent passwd

Queries the actual user database via NSS — reflects LDAP/other sources too, not just the local file

who / w

Show who's currently logged in (w adds what they're doing)

last

Show login history

Process

A program currently executing — has a PID, PPID, owner, state, priority, open files, threads

PPID

Parent process ID — the process that spawned this one

Foreground process

Blocks the shell until it completes

Background process

Runs independently, shell stays free for new commands

Daemon

A background process running continuously, independent of any login session

Job

A task managed as a unit by the shell — lets you manage multiple tasks in one session

Process State R

Running or ready to run

Process State S

Interruptible sleep, waiting for an event

Process State D

Uninterruptible sleep, usually waiting on disk/IO

Process State T

Stopped (Ctrl+Z or SIGSTOP)

Process State Z (Zombie)

Completed process still in the process table because its parent hasn't read its exit status

Reaping a zombie

Parent calls wait()

Process priority / niceness

Value from -20 (highest priority) to 19 (lowest)

nice

Start a new process with a specified priority

renice

Change the priority of an already-running process

ps aux

a=all users, u=user-oriented detail, x=no controlling terminal (catches daemons)

ps -ef

UNIX-style equivalent of ps aux, interchangeable

top

Continuous live process stream (q=quit, P=sort CPU, M=sort memory, k=kill)

htop

Improved, interactive version of top

kill -15 (SIGTERM)

Graceful stop — asks the process to shut down cleanly

kill -9 (SIGKILL)

Force immediate stop — no cleanup, last resort

kill -19 (SIGSTOP)

Pause a process

kill -18 (SIGCONT)

Resume a paused process

kill -1 (SIGHUP)

Reload config, or terminate if the process doesn't handle it specially

jobs

See existing jobs and their numbers

fg %1

Bring a background job to the foreground

bg %1

Resume a stopped job in the background

command &

Start a process in the background, register as a job

nohup command &

Same as above, but detached from the session — survives a closed SSH connection

systemd

Default init system, PID 1, every process descends from it

systemctl

Primary command-line tool for interacting with systemd

.service unit file

Tells systemd how to start/stop/restart/supervise a daemon

[Unit] section

Metadata/dependencies — Description, After (ordering, not a hard requirement)

[Service] section

Execution behavior — ExecStart, Restart policy, User to run as

[Install] section

What happens on enable — e.g. WantedBy=multi-user.target

systemctl start/stop/restart

Control a service right now

systemctl status

Current state plus recent log lines

systemctl enable vs start

enable = starts on boot

systemctl reload

Re-read config without a full restart (if the service supports it)

Active (running) state

Service running normally

Inactive state

Service not running

Failed state

Crashed or exited with an error

Masked state

Completely blocked from starting, even manually — stronger than disabled

Static state

Cannot be enabled directly — started by another unit

systemctl mask / unmask

Force-block a service from starting / reverse that block

Systemd Target

Modern equivalent of runlevels — defines system state via the units needed to reach it

multi-user.target

Fully booted, multi-user, networking, no GUI — standard server target (~old runlevel 3)

graphical.target

multi-user.target plus a display manager/GUI (~old runlevel 5) — targets are layered, not exclusive

systemctl get-default / set-default

Check / set the current default boot target

systemctl isolate

Switch to a target live, without rebooting

timedatectl

Shows/sets current time, timezone, NTP sync status

timedatectl set-timezone

Sets the system timezone (Region/City format)

timedatectl list-timezones

Lists all valid timezone identifiers

NTP

Protocol that synchronizes a system's clock against an authoritative time source, correcting drift