Services and User Management
systemd units
Services are units described by files in /etc/systemd/system (administrator) and /usr/lib/systemd/system (packages). After editing a unit, run systemctl daemon-reload. start runs now; enable starts at boot; enable --now does both. mask makes a unit impossible to start - stronger than disable. Targets group units (multi-user.target ≈ runlevel 3). Check state with systemctl status and logs with journalctl -u name -b.
Users and groups
Accounts live in /etc/passwd (world-readable), hashes in /etc/shadow (root only), groups in /etc/group. passwd fields: name:x:UID:GID:comment:home:shell. useradd is the low-level tool, adduser the friendlier Debian wrapper. Remember -m for home, -s for shell, -G for supplementary groups, -r for system accounts. usermod -aG group user appends; omitting -a replaces the group list - a classic trap. Lock with passwd -l or usermod -L; delete with userdel -r to remove the home directory. chage manages expiry and password aging.
Privilege
sudo runs one command as another user, is audited, and can be scoped per command; su opens a shell. Edit sudo policy only with visudo, or drop files in /etc/sudoers.d. PAM modules implement authentication; sshd can use keys instead of passwords.
Traps: enabling a service does not start it, and disabling does not stop it. status=203/EXEC points at a bad ExecStart. restart and reload are different.
Worked example: a custom unit needs [Unit] Description/After=network.target, [Service] ExecStart=/usr/local/bin/app with Restart=on-failure, and [Install] WantedBy=multi-user.target; then daemon-reload and enable --now.