Linux Basics/User management

User management functions Functions: adding, deleting user, setting password, modifying Adding user: adduser(under Ubuntu), useradd thumb|useradd's interactive guide in Ubuntu (adduser) Adding user Syntax: useradd [options] username Options: -u number: setting the user id (UID) -c: note -g group: setting group membership -d /home/user: setting HOME folder to /home/user. -s /bin/bash: default shell (here the user gets bash as default -G group1, group2: separating them with commas, if the user is member of other groups -m -k /home/existing <username>: it creates the home folder based on an existing user's home folder. -m switch refers to create home directory, -k indicates where we want to copy the default files from (e.g. /etc/skel -> the skeleton folder of the home folder) so the command looks like this: useradd -c "test account" -u 1001 -g users -G info,sysadmin -d /home/test -s /bin/bash -m -k /etc/skel test getent User information: getent getent passwd <username> If we want to get information about infotech group: getent group infotech /etc/passwd file Location of user data: /etc/passwd Content of /etc/passwd is like: janos:x:1000:1000:Nagy János:/home/janos:/bin/bash Passwd file's entries are separated with comma, and the explanation of the fields are the following: Username. Encrypted password. User ID(uid). Group ID (gid). Full name and other information Home folder Selected shell /etc/shadow file Content of /etc/shadow file is like: smithj:Ep6mckrOLChF.:10063:0:99999:7::: As with the passwd file, each field in the shadow file is also separated with ":" colon characters, and are as follows Username, up to 8 characters. Case-sensitive, usually all lowercase. A direct match to the username in the /etc/passwd file. Password, 13 character encrypted. A blank entry (eg. ::) indicates a password is not required to log in (usually a bad idea), and a ``*'' entry (eg. :*:) indicates the account has been disabled. The number of days (since January 1, 1970) since the password was last changed. The number of days before password may be changed (0 indicates it may be changed at any time) The number of days after which password must be changed (99999 indicates user can keep his or her password unchanged for many, many years) The number of days to warn user of an expiring password (7 for a full week) The number of days after password expires that account is disabled The number of days since January 1, 1970 that an account has been disabled A reserved field for possible future use chage Changing user rules: chage We can regulate with changing it when will the password of a user expires. For example, output of chage -l joska will display the data for it: Last password change : Feb 28, 2019 Password expires : never Password inactive : never Account expires : never Minimum number of days between pasword change : 0 Maximum number of days between pasword change : 99999 Number of days of warning before password expires : 7 We want joska user's password to expire in 10 days: chage -M 10 joska When will we want joska's password to expire? chage -E "2019-12-31" joska Lockdown after inactive days We lock joska's password after 10 inactive days. chage -I 10 joska chage --inactive 10 joska User password User password: passwd Changing own password: # passwd With superuser privilege we can change anybody's password: # passwd username Storing password encrypted: /etc/shadow Generating password: # makepasswd chfn Modifying user data: chfn We need finger package for it. e.g.: # chfn -f János janos # chfn --full-name "Nagy János" janos Kapcsolók: -f, --full-name -o, --office -- office room number -p, --office-phone - office phone number -h, --home-phone - home phone number Deleting user Deleting user: deluser, userdel It's recommended to regulate it with help of /etc/deluser.conf, We should look up deluser.conf(5) manual. e.g.: deluser --remove-home deluser --remove-all-files deluser --backup deluser –backup-to Handling user groups Creating group: addgroup, groupadd Location of group data: /etc/group /etc/group file can be edited manually (text editor, mcedit, nano etc) by root. A group is created with every user's name (like in case of kathy user a kathy group is created). Adding to group: gpasswd -a kathy infotech We add kathy to infotech group Csoportból kivétel: gpasswd -d kathy infotech We delete kathy from infotech group Handling user groups (and user data) „usermod” command: Changing user accounts. Adding user mary to infotech group: usermod -a -G infotech mary (For -a the group name is appended, so the other group remains for that user. If we omit -a, then all the existing groups the user is assigned in gets deleted for that user. Usermod command's other switches: -u value user: it changes user ID (UID) -g group user: it changes user group (e.g. usermod -g infotech mari) -G group1,group2: it adds the user to the given groups (but without appending) usermod -G human,economy,sysadmin mary -L user: it locks the access of the user / bans the user (so you can't log in) usermod -L -e 1970-01-01 mary (expiration date can be older than the current date) (--lock) -e value: expire date (--expiredate) -U user: unlocks the ban from the user -d user: setting new home folder (--home) -s user: setting shell (--shell) id command: Requesting information about the user. group member: id id -nG User accounts and handling "default" User account settings In /etc/login.defs directory/file there can be set some properties for users. For example, where should the user emails be stored. MAIL_DIR /var/mail Logging failed logins into /var/log/faillog file: FAILLOG_ENAB yes Logging unknown usernames in case of failed logins: LOG_UNKFAIL_ENAB no Logging successful logins: LOG_OK_LOGINS no Controlling passwords. By default, when it's gonna expire, when the user can change it, what's the minimum length of the password, and when the warning should be: PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_MIN_LEN 5 PASS_WARN_AGE 7 User ID minimum and maximum ID's in case of useradd: UID_MIN 1000 UID_MAX 60000 Minimum and maximum number group IDs: GID_MIN 1000 GID_MAX 60000 Denying login after this number of fails: LOGIN_RETRIES 5 The length of lockdown after exceeding the number of unsuccessful logins: LOGIN_TIMEOUT 60 User defaults /etc/default folder contains it. E.g. /etc/default/useradd # useradd defaults file GROUP=100 HOME=/home INACTIVE=-1 EXPIRE= SHELL=/bin/bash SKEL=/etc/skel CREATE_MAIL_SPOOL=yes /etc/skel folder contains the base home directory's content.