Study Hub / CompTIA Linux+ (XK0-006) / Domain 2.0
CompTIA Linux+ (XK0-006) Domain 2.0: Services and User Management — Explained
Domain 2.0 is Linux administration's daily bread: the services that run the system, the users and groups that use it, and the permission model that keeps them separated. Conceptual first, commands second — this page teaches the why behind the commands.
Services: what runs the system
- systemd — the init system on modern distributions: starts services at boot, restarts failed ones, and manages their state. Units describe services, timers, mounts, and more.
- Service states — enabled (starts at boot) vs. active (running now) are independent: a service can be active-but-not-enabled (dies on reboot) or enabled-but-inactive (starts next boot). This distinction matters in practice.
- Targets — groups of units defining system states (multi-user, graphical). Replacing the old runlevel concept.
- Logs — the journal (journald) centralizes service logs; syslog compatibility remains. When a service misbehaves, its unit logs are the first place to look.
Users and groups: identity on Linux
- Users — every process runs as a user. Human users log in; system/service users (no login shell) exist so daemons don't run as root.
- UID 0 is root — the superuser, exempt from permission checks. Everything powerful — and everything dangerous — flows from UID 0.
- Groups — collections of users for shared access. A user has one primary group and can belong to many secondary groups.
- sudo — lets permitted users run specific commands as root (or others) without sharing the root password. The sudoers configuration defines who may do what — least privilege in action.
- Password aging and account controls — expiry, minimum age, warning periods, and lockout. Dormant accounts get locked or removed — the Linux version of offboarding.
Permissions: the rwx model
- Three triples — every file has permissions for user (owner), group, and other: read (r=4), write (w=2), execute (x=1). 755 = rwxr-xr-x.
- Directories differ — on a directory, read lists contents, write creates/deletes entries, execute allows entering/traversing it. A directory with r but no x shows filenames you can't open.
- Ownership — every file has an owner user and an owner group; only the owner (or root) changes permissions. chown changes who owns; chmod changes what they may do.
- Special bits — setuid (run as the file's owner — how passwd lets users change their password), setgid (new files inherit the directory's group — the shared-folder trick), sticky bit (on /tmp: you can only delete your own files).
- Defaults — umask subtracts from full permissions for new files. A umask of 022 gives files 644 and directories 755.
The must-memorize table: permission numbers
Octal to meaning — decode on sight.
| Octal | Symbolic | Meaning |
|---|---|---|
| 7 | rwx | Read, write, execute — full control |
| 6 | rw- | Read and write, no execute |
| 5 | r-x | Read and execute, no write |
| 4 | r-- | Read only |
| 3 | -wx | Write and execute, no read (rare) |
| 2 | -w- | Write only (rare) |
| 1 | --x | Execute only (rare) |
| 0 | --- | No permissions at all |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A shared project directory must let team members create files, but every new file should belong to the project group automatically. Which mechanism does this?
- A. A. Setting the setgid bit on the directory
- B. B. Setting the sticky bit on the directory
- C. C. Giving the directory 777 permissions
- D. D. Making every user the directory owner
Show answer & reasoning
A. setgid on a directory makes new files inherit the directory's group instead of the creator's primary group — the standard shared-folder pattern. The sticky bit (B) controls deletion (only your own files); 777 (C) is a security disaster, not a group strategy.
2. A web service is configured to run as its own dedicated user account with no login shell, instead of as root. Why?
- A. A. To make the service start faster
- B. B. Least privilege — a compromised service shouldn't hand over root
- C. C. To reduce memory usage
- D. D. Because root cannot run network services
Show answer & reasoning
B. A service running as root that gets exploited gives the attacker root. A dedicated unprivileged user contains the blast radius — the process can only touch what that user may touch. That's least privilege applied to daemons, and it's why service users exist.
3. A file has permissions 640. Which statement is true?
- A. A. Everyone can read the file
- B. B. The owner can read and write; the group can read; others have no access
- C. C. The group can write but not read
- D. D. The owner has full control including execute
Show answer & reasoning
B. Decode: 6 = rw- (owner: read+write), 4 = r-- (group: read), 0 = --- (other: nothing). It's the classic "my group can read my work, the world can't" setting — common for config files with secrets readable by a service group.
4. An administrator wants users to run only the backup script as root, without knowing the root password. Which tool and concept is this?
- A. A. su — switching to the root account entirely
- B. B. sudo — delegated, audited privilege for specific commands
- C. C. chmod — changing the script's permissions
- D. D. chown — giving users ownership of the script
Show answer & reasoning
B. sudo grants specific commands as root (configured in sudoers), logging each use — delegation without sharing the password. su (A) hands over a full root shell (all-or-nothing); chmod/chown (C, D) change file permissions, not user privilege. "Specific commands as root, no password sharing" → sudo.
This was one domain. The simulator drills all 5.
This free preview covered Services & User Management (Domain 2.0, 20%). Not covered here: Security (Domain 3.0, 18%); Troubleshooting (Domain 5.0, 22%). Linux security hardening and scenario troubleshooting stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full Linux+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy