Kali Linux Default Password & User Management Guide for Beginners (2026)

When you first start your journey with Kali Linux for beginners, one of the most critical aspects to understand is user management and password security. Whether you've just installed Kali Linux in VirtualBox or set up a dual-boot system, understanding how to properly manage users and passwords is essential for both security and functionality.

In this comprehensive guide, we'll walk you through everything you need to know about Kali Linux's default credentials, changing passwords, creating and managing users, and implementing security best practices that every ethical hacker and penetration tester should follow.

Table of Contents

1. Understanding Kali Linux Default Credentials
2. Changing Your Default Password
3. Creating New User Accounts
4. Understanding Sudo and User Privileges
5. Managing User Groups
6. SSH Key Authentication
7. Implementing Password Policies
8. Security Best Practices
9. User Switching: su vs sudo
10. Managing Multiple Pentesters
11. FAQ

Understanding Kali Linux Default Credentials

The Modern Kali Linux User Model

Since Kali Linux 2020.1, the operating system underwent a significant change in its default user model. Unlike older versions where the system defaulted to the root user, modern Kali Linux installations create a standard non-root user during setup.

Default credentials for Kali Linux:

• Username: kali
• Password: kali

This represents a major security improvement aligned with industry best practices. Running as a non-privileged user by default reduces the risk of accidental system damage and limits the impact of potential security breaches.

Why the Change from Root?

The shift away from running as root by default was implemented for several important reasons:

1. Enhanced Security: Non-root users can't accidentally destroy system files or configurations
2. Industry Alignment: Most modern Linux distributions follow this pattern
3. Better Application Compatibility: Some applications refuse to run as root
4. Intentional Privilege Escalation: Using sudo makes you consciously aware when executing privileged commands

Legacy Root Access

While the default user is now kali, the root account still exists but is typically disabled for direct login. If you need root access, you can:

# Switch to root user temporarily
sudo su

# Or execute a single command as root
sudo command-here

If you absolutely need to enable the root account (not recommended for beginners), you can set a root password:

sudo passwd root

Changing Your Default Password

The very first security task after completing your Kali Linux setup should be changing the default password from kali to something secure.

Changing Your User Password

To change your current user's password, use the passwd command:

passwd

You'll be prompted to:

1. Enter your current password (kali)
2. Enter your new password
3. Confirm your new password

Example output:

Changing password for kali.
Current password: 
New password: 
Retype new password: 
passwd: password updated successfully

Creating a Strong Password

When choosing a new password, follow these guidelines:

✅ Do:

• Use at least 12-16 characters
• Combine uppercase and lowercase letters
• Include numbers and special characters
• Use a passphrase (easier to remember, harder to crack)
• Consider using a password manager

❌ Don't:

• Use dictionary words
• Include personal information (birthdays, names)
• Reuse passwords from other accounts
• Use simple patterns (12345, qwerty, password)

Changing Another User's Password (As Admin)

If you have sudo privileges, you can change another user's password:

sudo passwd username

This is useful when managing multiple user accounts or resetting a forgotten password.

Forcing Password Change on Next Login

For security compliance, you might want to force users to change their password on first login:

sudo passwd -e username

This expires the password immediately, requiring the user to set a new one upon next login.

Creating New User Accounts

When working in a team environment or setting up multiple testing profiles, creating additional user accounts becomes necessary.

Using adduser (Recommended for Beginners)

The adduser command is a user-friendly, interactive tool:

sudo adduser johndoe

This command will:

1. Create the user
2. Create a home directory (/home/johndoe)
3. Prompt for password and personal information
4. Set up default shell and permissions

Interactive prompts:

Enter new UNIX password: 
Retype new UNIX password: 
Full Name []: John Doe
Room Number []: 
Work Phone []: 
Home Phone []: 
Other []: 
Is the information correct? [Y/n] Y

Using useradd (Advanced)

For more control, use the useradd command with specific options:

sudo useradd -m -s /bin/bash -G sudo,adm johndoe
sudo passwd johndoe

Flag breakdown:

• -m: Creates home directory
• -s /bin/bash: Sets default shell to bash
• -G sudo,adm: Adds user to sudo and adm groups

Creating a System User (No Login)

For services and daemons that need a user account but no interactive login:

sudo useradd -r -s /usr/sbin/nologin serviceuser

The -r flag creates a system user with no aging information and a UID below 1000.

Understanding Sudo and User Privileges

What is Sudo?

sudo ("superuser do") allows permitted users to execute commands as root or another user. It's the cornerstone of Linux privilege management.

Advantages of sudo:

• Granular permission control
• Activity logging (who ran what)
• Limited privilege escalation window
• No need to share root password

Granting Sudo Access

To give a user sudo privileges, add them to the sudo group:

sudo usermod -aG sudo username

Never remove the user from existing groups! The -aG flags mean:

• -a: append
• -G: supplementary Groups

Without -a, you'll replace all existing group memberships.

Configuring Sudoers File

The /etc/sudoers file controls sudo permissions. Always edit it with visudo to prevent syntax errors:

sudo visudo

Example configurations:

# Allow user to run all commands without password
username ALL=(ALL) NOPASSWD: ALL

# Allow user to run only specific commands
username ALL=(ALL) /usr/bin/apt, /usr/bin/systemctl

# Allow group to run commands (already default for sudo group)
%sudo ALL=(ALL:ALL) ALL

Sudo Best Practices

1. Always use visudo: It validates syntax before saving
2. Limit NOPASSWD: Only use for trusted automated processes
3. Be specific: Grant access to specific commands when possible
4. Log everything: Keep sudo logs for security auditing
5. Regular reviews: Periodically audit who has sudo access

Managing User Groups

Linux uses groups to manage permissions for multiple users simultaneously. Understanding groups is crucial for effective user management.

Important Kali Linux Groups

Viewing User Groups

To see which groups a user belongs to:

groups username

# Or for current user
groups

# Detailed information
id username

Adding Users to Groups

Add a user to a supplementary group:

sudo usermod -aG groupname username

Common examples for penetration testers:

# Enable Wireshark packet capture
sudo usermod -aG wireshark $USER

# Enable serial device access (hardware hacking)
sudo usermod -aG dialout $USER

# Enable Docker access
sudo usermod -aG docker $USER

Important: Group changes take effect on next login. Either log out and back in, or use:

newgrp groupname

Creating Custom Groups

For team management, create custom groups:

# Create a pentest team group
sudo groupadd pentesters

# Add members
sudo usermod -aG pentesters alice
sudo usermod -aG pentesters bob

# Create a shared directory
sudo mkdir /opt/pentest-reports
sudo chgrp pentesters /opt/pentest-reports
sudo chmod 770 /opt/pentest-reports

Now all members of pentesters group can access shared resources.

Removing Users from Groups

To remove a user from a group without affecting other memberships:

sudo gpasswd -d username groupname

SSH Key Authentication

For remote access to your Kali Linux system or penetration testing from remote machines, SSH key authentication is more secure than password-based authentication.

Understanding SSH Keys

SSH keys work through asymmetric cryptography:

• Private key: Stays on your machine (never share!)
• Public key: Placed on remote servers you want to access

Generating SSH Keys

Create a new SSH key pair:

ssh-keygen -t ed25519 -C "your_email@example.com"

For maximum compatibility (older systems):

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

You'll be prompted:

Enter file in which to save the key (/home/kali/.ssh/id_ed25519): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 

Best practice: Always use a strong passphrase to protect your private key.

Key File Locations

After generation, you'll have:

• ~/.ssh/id_ed25519 - Private key (keep secret!)
• ~/.ssh/id_ed25519.pub - Public key (safe to share)

Adding Public Key to Remote Server

To enable key-based login to a remote server:

ssh-copy-id username@remote-server

This copies your public key to ~/.ssh/authorized_keys on the remote server.

Manual method:

cat ~/.ssh/id_ed25519.pub | ssh username@remote-server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Disabling Password Authentication (SSH)

For maximum security, disable password-based SSH after setting up keys:

1. Edit SSH configuration:

sudo nano /etc/ssh/sshd_config

2. Set these directives:

PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no

3. Restart SSH service:

sudo systemctl restart ssh

⚠️ Warning: Ensure key-based authentication works BEFORE disabling passwords, or you might lock yourself out!

SSH Agent for Passphrase Management

If you use a passphrase on your key (you should!), use ssh-agent to avoid re-entering it:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

You'll enter your passphrase once, and ssh-agent remembers it for the session.

Implementing Password Policies

For professional environments and penetration testing methodologies, implementing password policies ensures security compliance.

Installing libpam-pwquality

Kali Linux uses PAM (Pluggable Authentication Modules) for password policies:

sudo apt update
sudo apt install libpam-pwquality

Configuring Password Requirements

Edit the PAM password quality configuration:

sudo nano /etc/security/pwquality.conf

Recommended settings:

# Minimum password length
minlen = 12

# Require at least one digit
dcredit = -1

# Require at least one uppercase character
ucredit = -1

# Require at least one lowercase character
lcredit = -1

# Require at least one special character
ocredit = -1

# Reject passwords with username
usercheck = 1

# Maximum consecutive characters
maxrepeat = 3

# Reject common weak passwords
dictcheck = 1

Password Aging Configuration

Set password expiration policies:

sudo nano /etc/login.defs

Example configuration:

PASS_MAX_DAYS   90    # Password expires after 90 days
PASS_MIN_DAYS   7     # Can't change password before 7 days
PASS_WARN_AGE   14    # Warn 14 days before expiration

Applying Policies to Existing Users

# Set password expiration for specific user
sudo chage -M 90 -m 7 -W 14 username

# View password aging information
sudo chage -l username

Account Lockout After Failed Attempts

Protect against brute-force attacks:

sudo nano /etc/pam.d/common-auth

Add this line:

auth required pam_tally2.so deny=5 unlock_time=1800

This locks accounts after 5 failed attempts for 30 minutes.

Check failed login attempts:

sudo pam_tally2 --user=username

Reset failed login counter:

sudo pam_tally2 --user=username --reset

Security Best Practices

Implementing these security practices will significantly harden your Kali Linux system.

1. Disable Root Login

If you enabled root login, consider disabling it:

# Lock root account
sudo passwd -l root

# Disable root SSH login
sudo nano /etc/ssh/sshd_config
# Set: PermitRootLogin no
sudo systemctl restart ssh

2. Enable UFW Firewall

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

3. Regular System Updates

sudo apt update && sudo apt upgrade -y
sudo apt dist-upgrade -y
sudo apt autoremove -y

4. Monitor Authentication Logs

# View recent authentication attempts
sudo tail -f /var/log/auth.log

# Check sudo usage
sudo grep sudo /var/log/auth.log

# Find failed login attempts
sudo grep "Failed password" /var/log/auth.log

5. Use Strong Session Timeouts

Edit your bash profile:

echo "TMOUT=1800" >> ~/.bashrc

This logs out inactive sessions after 30 minutes.

6. Implement Two-Factor Authentication

For critical systems, add 2FA using Google Authenticator:

sudo apt install libpam-google-authenticator
google-authenticator

Follow the prompts and scan the QR code with your authenticator app.

7. Regular User Audits

# List all users with login shells
cat /etc/passwd | grep -v /nologin | grep -v /false

# Check sudo group members
getent group sudo

# Review last login times
lastlog

8. Secure Home Directories

Ensure user home directories have proper permissions:

sudo chmod 750 /home/*

This prevents users from browsing each other's files.

User Switching: su vs sudo

Understanding the difference between su and sudo is essential for proper privilege management.

The su Command

su ("switch user") changes your current user identity.

Switch to root:

su -
# or
su - root

Switch to another user:

su - username

The - flag provides a login shell (loads user's environment).

Difference without - flag:

su username    # Non-login shell (keeps current environment)
su - username  # Login shell (loads user's environment)

The sudo Command

sudo executes a single command as another user (default: root).

Execute one command as root:

sudo apt update

Execute command as specific user:

sudo -u username command

Get a root shell (similar to su -):

sudo -i
# or
sudo su -

su vs sudo: Key Differences

When to Use Each

Use sudo when:

• Running occasional administrative commands
• You need audit trails
• Multiple admins manage the system
• You want granular permission control

Use su when:

• Performing lengthy maintenance tasks
• You need a full root environment
• Working on a single-user system
• Troubleshooting user-specific issues

Sudo Session Duration

By default, sudo caches credentials for 15 minutes:

sudo command1   # Enter password
sudo command2   # No password (within timeout)
sudo command3   # No password (within timeout)

Clear sudo cache:

sudo -k

Extend sudo session:

sudo -v  # Refresh timestamp without running a command

Managing Multiple Pentesters

When running a penetration testing lab or managing a team, proper multi-user management becomes crucial.

Scenario: Setting Up a Pentest Team

Let's create a complete multi-penetration tester environment.

Step 1: Create Team Group

sudo groupadd pentesters

Step 2: Create Team Members

sudo adduser alice
sudo adduser bob
sudo adduser charlie

Step 3: Grant Necessary Permissions

# Add to pentesters group
sudo usermod -aG pentesters alice
sudo usermod -aG pentesters bob
sudo usermod -aG pentesters charlie

# Grant sudo access
sudo usermod -aG sudo alice
sudo usermod -aG sudo bob
sudo usermod -aG sudo charlie

# Add to Wireshark group for packet capture
sudo usermod -aG wireshark alice
sudo usermod -aG wireshark bob
sudo usermod -aG wireshark charlie

Step 4: Create Shared Workspace

# Create shared directory
sudo mkdir -p /opt/pentest/shared
sudo chgrp pentesters /opt/pentest/shared
sudo chmod 2770 /opt/pentest/shared

The 2770 permissions mean:

• 2: SetGID (files created inherit group ownership)
• 770: Read/write/execute for owner and group, nothing for others

Step 5: Create Individual Workspaces

# Create isolated directories for each pentester
sudo mkdir -p /opt/pentest/{alice,bob,charlie}
sudo chown alice:pentesters /opt/pentest/alice
sudo chown bob:pentesters /opt/pentest/bob
sudo chown charlie:pentesters /opt/pentest/charlie
sudo chmod 750 /opt/pentest/{alice,bob,charlie}

Step 6: Set Up Project-Specific Access

For different projects, create project groups:

# Project Alpha (Alice and Bob)
sudo groupadd project-alpha
sudo usermod -aG project-alpha alice
sudo usermod -aG project-alpha bob

sudo mkdir /opt/pentest/projects/alpha
sudo chgrp project-alpha /opt/pentest/projects/alpha
sudo chmod 2770 /opt/pentest/projects/alpha

# Project Beta (Bob and Charlie)
sudo groupadd project-beta
sudo usermod -aG project-beta bob
sudo usermod -aG project-beta charlie

sudo mkdir /opt/pentest/projects/beta
sudo chgrp project-beta /opt/pentest/projects/beta
sudo chmod 2770 /opt/pentest/projects/beta

Monitoring Team Activity

Track User Sessions

# See who's logged in
w

# Session history
last

# Current logins
who

Monitor Command Usage

# View sudo commands by user
sudo grep alice /var/log/auth.log | grep COMMAND

# Check bash history (requires appropriate permissions)
sudo cat /home/alice/.bash_history

Resource Usage

# Processes by user
ps aux | grep alice

# Resource consumption
top -u alice

User Isolation Best Practices

1. Private home directories: chmod 750 /home/*
2. Project-based group access: Limit access to what's needed
3. Audit trails: Enable command logging with script or auditd
4. Regular reviews: Periodically audit group memberships
5. Offboarding process: Promptly disable accounts when team members leave

Quick User Offboarding

# Lock account (preserves data)
sudo passwd -l username
sudo usermod -L username

# Expire account immediately
sudo chage -E 0 username

# Archive user data before deletion
sudo tar -czf /backups/username-$(date +%Y%m%d).tar.gz /home/username

# Delete user (after archiving)
sudo userdel -r username

FAQ

1. What is the default username and password for Kali Linux?

The default credentials for modern Kali Linux (2020.1 and later) are:

• Username: kali
• Password: kali

Older versions of Kali Linux used the root user by default, but this has been changed to align with security best practices. You should change the default password immediately after installation.

2. How do I reset my Kali Linux password if I forgot it?

If you've forgotten your password, you can reset it using these steps:

1. Reboot your system and access the GRUB menu (hold Shift during boot)
2. Press 'e' to edit the boot parameters
3. Find the line starting with linux and add init=/bin/bash at the end
4. Press Ctrl+X or F10 to boot
5. Remount the filesystem: mount -o remount,rw /
6. Change password: passwd username
7. Reboot: exec /sbin/init

For VirtualBox installations, check our VirtualBox installation guide for snapshots that can help avoid this situation.

3. Should I enable the root account in Kali Linux?

For beginners, no. The modern approach of using a standard user with sudo access is more secure:

• Reduces risk of accidental system damage
• Forces intentional privilege escalation
• Provides better audit trails
• Aligns with industry standards

However, experienced users may prefer direct root access for certain workflows. If you choose to enable root:

sudo passwd root

Remember: with great power comes great responsibility. Most tasks can be accomplished with sudo without enabling root login.

4. What's the difference between 'sudo su' and 'sudo -i'?

Both commands give you a root shell, but with subtle differences:

sudo su:

• Runs su command with sudo privileges
• Switches to root user
• Loads root's environment (when used with -)

sudo -i:

• Direct sudo option for interactive shell
• Simulates initial root login
• Loads root's environment and startup scripts

sudo su - vs sudo -i: Functionally very similar; both give you a proper root login environment. sudo -i is slightly cleaner as it's a single command, while sudo su - chains two commands.

sudo -s: Runs your current shell as root but keeps your current environment (doesn't load root's profile).

5. How can I allow a user to run specific commands without a password?

This is useful for automation scripts or specific tools. Use visudo to edit sudoers safely:

sudo visudo

Add a line like:

username ALL=(ALL) NOPASSWD: /usr/bin/nmap, /usr/bin/metasploit-framework

This allows username to run nmap and Metasploit without entering a password.

For a group:

%pentesters ALL=(ALL) NOPASSWD: /usr/bin/nmap

Important security note: Be extremely careful with NOPASSWD. Never grant blanket NOPASSWD access (NOPASSWD: ALL) to untrusted users, as it's equivalent to passwordless root access.

Conclusion

Mastering user management and password security in Kali Linux is fundamental to building a secure penetration testing environment. The modern shift from root-only access to a proper user privilege model makes Kali Linux more secure and aligned with professional security practices.

Key takeaways:

✅ Change default passwords immediately after installation ✅ Use sudo for privileged operations (avoid running as root) ✅ Implement strong password policies and regular updates ✅ Use SSH keys instead of passwords for remote access ✅ Create proper user hierarchies for team environments ✅ Enable logging and monitoring for accountability ✅ Regular security audits of user accounts and permissions

Whether you're working through our complete beginners' guide series or preparing for your first professional penetration test, proper user management forms the foundation of a secure and efficient workflow.

For more information on Linux user management, refer to the official Kali Linux documentation and Debian's user management guide.

Remember: security starts with the basics, and proper user management is one of those fundamentals that you can't afford to overlook. Take the time to implement these practices, and you'll build a solid foundation for your penetration testing career.

This tutorial is part of a comprehensive 105-part series on Kali Linux for beginners. Follow along to build your skills from the ground up.