Managing Users and Groups
Mod 9.1 Managing Users and Groups
Objective 3.3
Windows
Local Users & Groups console:
- create, modify accounts, set password polices, disable or enable accounts, assign users to specific groups
Local Windows Groups:
- create groups on job or functions, add users to appropriate groups, assign permissions to groups, adjust access when users change roles
Linux
Users:
- command line “useradd”
- useradd: create a new user
- userdel: delete user
- usermod - modify user properties
- passwd - change user password
Groups:
- groupadd: create group
- groupdel: delete group
- groupmod: modify group properties
- usermod -G: add user to groups
Password Policies
Mod 9.1 Managing Users and Groups
Objective 3.3
Standard Password Guideline
- Min 12+ characters, complex (upper/lowercase, numbers, symbols)
- Expiration periods (30-90 days)
- Account lockout after failed attempts, password history
Password Auditing:
- Penetration testing tools: Kali Linux
Common Password Attacks
- Dictionary, Brute Force, Password spraying, Credential stuffing
Enforcing Password Policies
Mod 9.1 Managing Users and Groups
Objective 3.3
Windows
Local Security Policies or Group Policy (locally or domain wide)
- Password complex requirements
- Min password length, history (max/min password age)
- Account lockout thresholds, duration
Linux
Pluggable Authentication Modules (PAM) Comfiguration: /etc/pam.d/common-password
- min password length, required character types, dictionary word checks, password reuse restrictions
- phrases, multi-factor authentication, password manager
Multifactor Authentication
Mod 9.1 Managing Users and Groups
Objective 3.3
3 Types: use 2 type increase security
What you know
- only user knows, Password or passphrase, PIN number, security questions
What you have
- physical items, smart card, security token, mobile device (SMS or app verify)
What you are
- biometric id, fingerprint, facial recognition, retina or iris scan, voice recognition
Single Sign-On (SSO)
Mod 9.1 Managing Users and Groups
Objective 3.3
Single Sign-On: users to authenticate once gain access to multiple systems w/o re-entering credentials
- improved user experience, reduced password fatigue, centralized authentication management
- streamlined access control, simplified user provisioning & deprovisioning
Active Directory, LDAP, SAML, OAuth, Open ID Connect
Access Controls
Mod 9.1 Managing Users and Groups
Objective 3.3
Windows
File & Folder Security: NTFS permissions control access at the file system level
- Read, Write, Read & Execute, Modify, Full Control
NTFS Permissions:
- Read: View files and execute programs
- Change: Read capabilities plus ability to add, modify, and delete files
- Full Control: All permissions, including changing permissions
Share permissions: Everyone - Full Control
NTFS permissions: Specific granular permissions
Linux
Absolute Mode: permissions are added to Users, Groups, Others 3 digit code
4 = Read (r)
2= Write (w)
1 = Execute (x)
Ex:
755: Owner (rwx), Group (r-x), Others (r-x)
644: Owner (rw-), Group (r–), Others (r–)
777: Owner (rwx), Group (rwx), Others (rwx)
Symbolic Mode: uses letter to add Users, Groups, Others, All
u = user/owner
g = group
o = others
a = all (user, group, others)
Operations:
(+) = add permission
(-) = remove permission
(=) = set exact permission
Ex:
chmod u+x file: Add execute permission for owner
chmod go-w file: Remove write permission for group and others
chmod a=r file: Set read-only permission for all
Account Auditing
Mod 9.1 Managing Users and Groups
Objective 3.3
Account Auditing: track activities, detect suspicious behavior, ensure compliance
User Auditing: tracks individual, login attempts, resource access
Group Auditing: changes to group membership & permissions
Third-party Auditing: external tools provide advanced monitoring & reporting capabilities
Guidelines for Secure Admin
Mod 9.1 Managing Users and Groups
Objective 3.3
User Account Management
Password Security
Permission Management
Picture
Server Roles Requirements
Mod 9.2 Manage Server Functions
Objective 2.3
(1) General Servers
- File, Print, Web, Directory
(2) Database & Application
- Database servers, Application/Middleware, Messaging/Email
(3) Network Infrastructure
- DNS Servers, DHCP servers, VPN servers
(4) Virtualization
- VM hosts, Hypervisors, Container platforms
(5) Collaboration
- Chat servers, Video Conferencing, Document sharing
Directory Service Config
- Active Directory: provide centralized authentication & management of resources
- User/Computer account management, Group Policy application
- Resource organization, security implementation
Storage Management in Windows
Mod 9.2 Manage Server Functions
Objective 2.3
- Separate OS & data drives
- RAID levels, regular backup schedules
- Monitor storage utilization, Planning for capacity growth
Linux Directory Structure
/root
- base of the Linux filesystem hierarchy containing all other
directories and files
/home
- personal directories for each user (/home/username)
/var
- variable data files change during system operations
- log files (/var/log), Spool directories (/var/spool), Temp files (/var/tmp), Database files (/var/lib)
swap
- special partition used as virtual memory when physical RAM is full
- configured during install, sized to RAM and workload
Virtual Memory
Mod 9.2 Manage Server Functions
Objective 2.3
Ubuntu Linux Swap Recommendations
- Less than 2GB RAM: 2x RAM size
- 2-8GB RAM: Equal to RAM size
- 8-64GB RAM: At least 4GB
- More than 64GB RAM: At least 8GB
Data Transfers
Mod 9.2 Manage Server Functions
Objective 2.3
Data Transfers: secure & reliable data transfer tool for server management
Windows
- Robocopy: robust file copy utility w/ resume capabilities
- XCOPY: Extended copy command w/ more options than standard copy
- WinSCP: GUI tool for secure file transfer using SCP/SFTP
Linux
- rysnc: fast, versatile file copying tool with delta-transfer algorithm
- scp: secure copy based on SSH protocol
- sftp: secure FTP for interactive file transfers
Administrative Interfaces
Mod 9.2 Manage Server Functions
Objective 2.3
Console: direct connection, where the sysadmin stands at the server using a keyboard and mouse directly connected to the device
Remote Desktop: GUI on a remote device port 3389, Windows = Windows RDP, Linux = X Windows, VNC
SSH: standard tool to connect to Linux servers and network devices
Web interface: manage Linux servers,
Monitoring
Mod 9.2 Manage Server Functions
Objective 2.3
Windows
Performance Monitor: track system metrics
- real time performance graphs, Data collector sets, custom alerts
Event Viewer: troubleshooting & monitoring server health
- System events, application logs, security audits, setup events, forwarded events
Monitoring
Mod 9.2 Manage Server Functions
Objective 2.3
Linux
top: command provides system performance
- system uptime, load averages, tasks running, sleeping, stopped, zombie
- CPU usage breakdown (user, system, idle)
- Memory usage (total, used, free, buffers)
- Process details sorted by resource usage
Sar (system activity reporter): collect, reports, saves system, activity info
- analyzing performance bottlenecks, tracking historical performance patters, capacity planning, generating performance reports
Uptime: provides quick overview of
- current time, system uptime duration, number of logged-in users, load average for 1, 5, 15 mins
du (Disk Usage): estimates file space usage
- disk usage by directory, human readable (-h), summarize totals only (-s)
df (Dick Free): available & used disk space
- reports filesystem capacity, mount points, percentage used
Monitoring
Mod 9.2 Manage Server Functions
Objective 2.3
Enterprise environments often require more sophisticated
monitoring solutions
Ex: Nagios, Zabbix, PRTG, SolarWinds, and cloud-native monitoring services
Monitoring
Mod 9.2 Manage Server Functions
Objective 2.3
Log File Management
(1) Log File Retention
- Define retention periods based on compliance requirements
- Implement log rotation to manage file sizes
- Archive historical logs for long-term storage
- Ensure sufficient storage for log files
(2) Log Shipping
- Forward logs to a central server
- Implement SIEM solutions for analysis
- Ensure secure transmission of log data
Hardware Hardening
Mod 9.3 Configure Server Hardening
Objective 3.5
Disable Unneeded Components
- NIC, External USB ports, Audio Devices, Bluetooth
Configure Boot Order
- Secure Boot, OS as first boot device, full disk encryption
BIOS/UEFI Password
- Admin password, TPM or enhanced security
Operating System Hardening
Mod 9.3 Configure Server Hardening
Objective 3.5
Remove Unneeded Services
- disable or remove applications, ID all running services
Change Default Settings
- change default ports for service, rename admin accounts, disable guest accounts, account lockout, file permissions
Configure Firewall
- block inbound traffic, restrict IP address
Application Hardening
Mod 9.3 Configure Server Hardening
Objective 3.5
Applications updated w/security patches, remove or disable features, least privilege principles, secure authentication, disable automatic information collection
Host Security
Mod 9.3 Configure Server Hardening
Objective 3.5
- Antivirus/Antimalware: Detects and removes malicious software
- Host-based Firewall: Controls inbound and outbound connections
- Intrusion Detection/Prevention: Identifies and blocks attack attempts
- Application Control: Restricts execution to approved applications
- Behavior Monitoring: Identifies suspicious activities
- File Integrity Monitoring: Detects unauthorized changes to critical files
Patching
Mod 9.3 Configure Server Hardening
Objective 3.5
Firmware Drivers
- update server BIOS/UEFI firmware, storage controller firmware current
- update network interface drivers
OS & Application Updates
- security patches promptly
- test updates in non production environments, implement automated patch management
Guidelines for Server Hardening
Mod 9.3 Configure Server Hardening
Objective 3.5
Minimize Attacks, Keep Systems Updated, Automate Security, Monitor/Audit
Picture
-
Mod 1 Understanding Server Administration Concepts14
-
Mod 2 Understanding Virtualization and Cloud Computing18
-
Mod 3 Understanding Physical and Network Security Concepts18
-
Mod 4 Managing Physical Assets17
-
Mod 5 Managing Server Hardware21
-
Mod 6 Configuring Storage Management19
-
Mod 7 Installing and Configuring an Operating System39
-
Mod 8 Troubleshooting OS, Application, and Network Configurations13
-
Mod 9 Managing Post-Installation Administrative Tasks23
-
Mod 10 Managing Data Security12
-
Mod 11 Managing Service and Data Availability23
-
Mod 12 Decommissioning Servers15
