Administrative tasks

Administrative tasks covers user and group accounts, password aging, job scheduling with cron, at and systemd timers, and localisation. Objective 107 of LPIC-1 Exam 102-500, worth 20% of the exam.

Share of the exam
20%
Questions in a real sitting
roughly 12 of 60
Questions in this bank
60
Signed for by a person
0
Machine-checked only
60

Partly checked. None of the 60 questions here has been read against the cited source by a person. 60 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.

Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

What this objective covers

The 60 questions written for this objective cite 3 LPI exam objectives (107.1, 107.2, 107.3) and 25 manual pages (at(1), atq(1), chage(1), chfn(1), crontab(1), crontab(5), date(1), getent(1), gpasswd(1), groupdel(8), groupmod(8), iconv(1), locale(1), locale(7), login.defs(5), nologin(8), passwd(1), passwd(5), run-parts(8), systemd-run(1), systemd.timer(5), timedatectl(1), tzset(3), useradd(8), usermod(8)).

They break down as 40 single-answer questions, 9 choose-several questions and 11 type-the-answer questions.

What this objective is really about

Day-to-day administration, examined through the files and the commands that edit them. Knowing the field layouts of /etc/passwd, /etc/shadow and /etc/group is worth as much here as knowing the commands, because several questions are answered directly from them.

Accounts and groups

The single most dangerous command in this objective is usermod -G without -a, which replaces the entire supplementary group list rather than adding to it. Leaving out the -a is the classic way to drop your own account out of the sudo group and lock yourself out. gpasswd -a is the alternative that can only ever add.

Field layouts: /etc/passwd is name, x, UID, GID, GECOS, home, shell. /etc/shadow is name, hash, last change in days since 1970-01-01, minimum days, maximum days, warning days, inactive days, expiry date, reserved. /etc/group is name, x, GID, and a comma-separated list of supplementary members — primary membership is not in that list, because it lives in the user's own passwd line.

Password aging is chage, and the case of the option matters: -m is the minimum days between changes, -M is the maximum lifetime, -W the warning period, -E the account expiry date. chage -l lists them readably and is the one option an ordinary user may run on their own account. Locking a password with passwd -l or usermod -L prefixes the stored hash so nothing can match it — note that this stops password authentication only, and leaves SSH key logins working.

When accounts come partly from a directory service, getent is the right diagnostic: it queries through the name service switch, so it sees exactly what the login process sees.

Scheduling

Crontab fields are minute, hour, day of month, month, day of week — in that order, which is the reverse of how people say times aloud. Within a field, a comma lists, a hyphen gives an inclusive range, and a slash gives a step. When both day-of-month and day-of-week are restricted, cron runs the job if either matches.

Two formats exist and mixing them is a common error. A user crontab has five time fields then the command. A system crontab — /etc/crontab and files under /etc/cron.d — has an extra user field between them. crontab -e always edits your own crontab, never /etc/crontab.

For one-off jobs use at, not a cron entry you plan to delete later. For jobs that must catch up after the machine was switched off, anacron schedules by period in days rather than clock time. On systemd, a .timer unit carries the schedule and activates a separate .service; OnCalendar is absolute wall-clock time, OnBootSec is relative to boot, and Persistent=true is systemd's answer to anacron. Access to cron and at is controlled by allow and deny files, where the allow file, if it exists, is an exclusive whitelist and the deny file is then ignored entirely.

Locale and time zone

Locale precedence runs LC_ALL first, then the specific category variable, then LANG as the fallback. That is why LC_ALL=C is the standard way to get stable, untranslated output in scripts. locale with no options prints what is in effect; locale -a lists what is installed.

The time zone database is /usr/share/zoneinfo, laid out as Region/City, and the active zone is /etc/localtime. timedatectl set-timezone rewrites it and validates the name. Character encodings worth distinguishing: ASCII is 7-bit and defines 128 characters, ISO-8859 parts are single-byte sets of 256, and UTF-8 encodes all of Unicode in one to four bytes while keeping ASCII byte-identical. iconv converts between them.

Lessons in this objective

The objective cut into the pieces the blueprint declares. Each one has the material written out and the questions that test it.

Drill this objective

The trainer can run a short practice set drawn from this objective alone, which is what the weight column above is for: revise the heavy objectives first.

Practise Administrative tasks

Questions on this objective (page 1 of 3)

Practise Administrative tasks

The other objectives in LPIC-1 Exam 102-500