usermod tips — authorized account-modify literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run usermod on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any write — never modify production accounts without change control.
3. Record short factual notes; quote short Evidence (login, shell, home, groups — never passwords).
4. Optional: create path → useradd-tips.
5. Optional: group rename/GID → groupmod-tips.
6. Optional: aging → chage-tips.
7. Prefer additive group changes (-aG) when the syllabus wants append — quote the flag you used.
8. Stop at literacy — no attack or unauthorized privilege-escalation cookbooks.

Allowed framing

• Classroom labs reviewing usermod -s / -d / -aG / -L on authorized disposable accounts.
• Binding short factual notes as Evidence (flag intent + resulting getent/id — no secrets).
• Documenting expected vs observed shell/home/group membership for authorized inventory notes.
• Comparing usermod ↔ useradd / groupmod / chage peer tip pages under one binder.
• Testing lock/unlock (-L/-U) drills when the syllabus authorizes them on lab accounts.

Scope we will not cover

• No crack/pirate/keygen via usermod.
• No intentional unauthorized privilege escalation against foreign hosts.
• No secret-theft or password planting against hosts you do not own.
• No cookbooks that add foreign users to privileged groups without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with shadow-utils installed.
2. Create a throwaway account via useradd-tips before any usermod drill.
3. With authorization, change shell or append a lab group; quote id / getent afterward as Evidence.
4. Optional: aging with chage-tips; membership check with groups-tips.
5. Stop at literacy — no attack or unauthorized account-modify cookbooks.

Practical notes for authorized labs

• -aG appends supplementary groups; bare -G replaces — quote which behavior the syllabus asked for.
• Prefer modifying disposable lab accounts; never experiment on shared production UIDs.
• Pair with passwd-tips when password resets are also in scope (separate tool).
• Lock (-L) vs expire (chage) are different levers — keep Evidence labels distinct.
• Never commit before/after passwd dumps to git — even for labs.
• Label lab-only group memberships clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host account modifies → refuse.
• Unauthorized privileged-group append cookbooks → refuse.
• Attack/privilege-escalation framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources