rh124_account_management [Doku Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== RH124 Account Management ======

===== Related packages and commands =====

==== $ rpm -ql shadow-utils (partial list) ====

<code>
/etc/default/useradd
/etc/login.defs
/etc/pam.d/passwd
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/lastlog
/usr/bin/newgidmap
/usr/bin/newgrp
/usr/bin/newuidmap
/usr/bin/passwd
/usr/bin/sg
...
/usr/sbin/adduser -> useradd
/usr/sbin/chgpasswd
/usr/sbin/chpasswd
/usr/sbin/groupadd
/usr/sbin/groupdel
/usr/sbin/groupmems
/usr/sbin/groupmod
/usr/sbin/grpck
/usr/sbin/grpconv
/usr/sbin/grpunconv
/usr/sbin/newusers
/usr/sbin/pwck
/usr/sbin/pwconv
/usr/sbin/pwunconv
/usr/sbin/useradd
/usr/sbin/userdel
/usr/sbin/usermod
/usr/sbin/vigr
/usr/sbin/vipw
</code>

==== $ rpm -ql setup ====

<code>
/etc/aliases
/etc/bashrc
/etc/csh.cshrc
/etc/csh.login
/etc/dnf/protected.d/setup.conf
/etc/environment
/etc/ethertypes
/etc/exports
/etc/filesystems
/etc/fstab
/etc/group
/etc/gshadow
/etc/host.conf
/etc/hosts
/etc/inputrc
/etc/motd
/etc/motd.d
/etc/networks
/etc/passwd
/etc/printcap
/etc/profile
/etc/profile.d
/etc/profile.d/csh.local
/etc/profile.d/lang.csh
/etc/profile.d/lang.sh
/etc/profile.d/sh.local
/etc/protocols
/etc/services
/etc/shadow
/etc/shells
/etc/subgid
/etc/subuid
...
</code>

==== Basic user and group commands ====

  * ''useradd'', ''usermod'', ''userdel''
  * ''groupadd'', ''groupmod'', ''groupdel'', ''groupmems''
  * ''passwd'', ''chfn'', ''chsh''

===== Everything related to user0 account =====

==== New home directory ====

Verify the existence of ''user0'''s home directory:

<code>
$ ls -l /home
$ ls -l /home/user0
</code>

==== cat /etc/passwd ====

<code>
root:x:0:0:Super User:/root:/bin/bash
bin:x:1:1:bin:/bin:/usr/sbin/nologin
daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator:x:11:0:operator:/root:/usr/sbin/nologin
games:x:12:100:games:/usr/games:/usr/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/usr/sbin/nologin
tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin
systemd-oom:x:999:999:systemd Userspace OOM Killer:/:/sbin/nologin
dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin
sssd:x:998:998:User for sssd:/run/sssd/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/usr/share/empty.sshd:/usr/sbin/nologin
chrony:x:997:997:chrony system user:/var/lib/chrony:/sbin/nologin
systemd-coredump:x:996:996:systemd Core Dumper:/:/usr/sbin/nologin
rpjday:x:1000:1000:Robert P. J.Day:/home/rpjday:/bin/bash
user0:x:1001:1001::/home/user0:/bin/bash
</code>

Note:

  * The lack of encrypted passwords for all of the accounts (where are they?).
  * The number of accounts that run a non-shell command directly.
  * The number of accounts that do not allow a login at all.
==== cat /etc/group (partial) ====

<code>
root:x:0:
bin:x:1:
daemon:x:2:
...
systemd-coredump:x:996:
rpjday:x:1000:
user0:x:1001:
</code>

Note the use of //user private groups//. Check your own attributes with:

<code>
$ id
uid=1000(rpjday) gid=1000(rpjday) groups=1000(rpjday),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
</code>

You do not need an entry in ''/etc/group'' for your account's primary group.
==== cat /etc/shadow (secure) ====

<code>
root:!::0:99999:7:::
bin:*:20244:0:99999:7:::
daemon:*:20244:0:99999:7:::
...
systemd-coredump:!*:20743::::::
rpjday:$y$j9T$rEkTh5W7RoZABXoeTINKHge6$XL4PTqdlSIxiP51xD24yHmlCizpYhi14Ot8UwzcQj0C::0:99999:7:::
user0:$y$j9T$jCOzJ4lgTqwN9p7mf7fxT/$iglKahqGQ4XzPlD0Z1db/s5Vg0lcH6SikSh0KXCy/FA:20743:0:99999:7:::
</code>

You can't view this file:

<code>
$ ls -l /etc/shadow
----------. 1 root root 718 Oct 19 11:20 /etc/shadow
$
</code>
===== Account management =====

==== How class accounts are created ====

For each account:

<code>
$ sudo useradd [-m] user1
$ passwd user1
</code>

==== useradd ====

The output from ''%%useradd --help%%'':

<code>
Usage: useradd [options] LOGIN
       useradd -D
       useradd -D [options]

Options:
      --badname                 do not check for bad names
  -b, --base-dir BASE_DIR       base directory for the home directory of the
                                new account
      --btrfs-subvolume-home    use BTRFS subvolume for home directory
  -c, --comment COMMENT         GECOS field of the new account
  -d, --home-dir HOME_DIR       home directory of the new account
  -D, --defaults                print or change default useradd configuration
  -e, --expiredate EXPIRE_DATE  expiration date of the new account
  -f, --inactive INACTIVE       password inactivity period of the new account
  -F, --add-subids-for-system   add entries to sub[ud]id even when adding a system user
  -g, --gid GROUP               name or ID of the primary group of the new
                                account
  -G, --groups GROUPS           list of supplementary groups of the new
                                account
  -h, --help                    display this help message and exit
  -k, --skel SKEL_DIR           use this alternative skeleton directory
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -l, --no-log-init             do not add the user to the lastlog and
                                faillog databases
  -m, --create-home             create the user's home directory
  -M, --no-create-home          do not create the user's home directory
  -N, --no-user-group           do not create a group with the same name as
                                the user
  -o, --non-unique              allow to create users with duplicate
                                (non-unique) UID
  -p, --password PASSWORD       encrypted password of the new account
  -r, --system                  create a system account
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -s, --shell SHELL             login shell of the new account
  -u, --uid UID                 user ID of the new account
  -U, --user-group              create a group with the same name as the user
  -Z, --selinux-user SEUSER     use a specific SEUSER for the SELinux user mapping
      --selinux-range SERANGE   use a specific MLS range for the SELinux user mapping
</code>

For the full story:

<code>
$ man useradd
</code>

==== usermod ====

<code>
$ usermod --help
Usage: usermod [options] LOGIN

Options:
  -a, --append                  append the user to the supplemental GROUPS
                                mentioned by the -G option without removing
                                the user from other groups
  -b, --badname                 allow bad names
  -c, --comment COMMENT         new value of the GECOS field
  -d, --home HOME_DIR           new home directory for the user account
  -e, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE
  -f, --inactive INACTIVE       set password inactive after expiration
                                to INACTIVE
  -g, --gid GROUP               force use GROUP as new primary group
  -G, --groups GROUPS           new list of supplementary GROUPS
  -h, --help                    display this help message and exit
  -l, --login NEW_LOGIN         new value of the login name
  -L, --lock                    lock the user account
  -m, --move-home               move contents of the home directory to the
                                new location (use only with -d)
  -o, --non-unique              allow using duplicate (non-unique) UID
  -p, --password PASSWORD       use encrypted password for the new password
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -r, --remove                  remove the user from only the supplemental GROUPS
                                mentioned by the -G option without removing
                                the user from other groups
  -R, --root CHROOT_DIR         directory to chroot into
  -s, --shell SHELL             new login shell for the user account
  -u, --uid UID                 new UID for the user account
  -U, --unlock                  unlock the user account
  -v, --add-subuids FIRST-LAST  add range of subordinate uids
  -V, --del-subuids FIRST-LAST  remove range of subordinate uids
  -w, --add-subgids FIRST-LAST  add range of subordinate gids
  -W, --del-subgids FIRST-LAST  remove range of subordinate gids
  -Z, --selinux-user SEUSER     new SELinux user mapping for the user account
      --selinux-range SERANGE   new SELinux MLS range for the user account
</code>

==== userdel ====

<code>
$ userdel --help
Usage: userdel [options] LOGIN

Options:
  -f, --force                   force some actions that would fail otherwise
                                e.g. removal of user still logged in
                                or files, even if not owned by the user
  -h, --help                    display this help message and exit
  -r, --remove                  remove home directory and mail spool
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -Z, --selinux-user            remove any SELinux user mapping for the user
</code>

==== Changing someone's password ====

<code>
$ passwd user0
</code>

Note ''%%--stdin%%'' option to set password:

<code>
$ passwd --help
Usage: passwd [options] [LOGIN]

Options:
  -a, --all                     report password status on all accounts
  -d, --delete                  delete the password for the named account
  -e, --expire                  force expire the password for the named account
  -h, --help                    display this help message and exit
  -k, --keep-tokens             change password only if expired
  -i, --inactive INACTIVE       set password inactive after expiration
                                to INACTIVE
  -l, --lock                    lock the password of the named account
  -n, --mindays MIN_DAYS        set minimum number of days before password
                                change to MIN_DAYS
  -q, --quiet                   quiet mode
  -r, --repository REPOSITORY   change password in REPOSITORY repository
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       directory prefix
  -S, --status                  report password status on the named account
  -u, --unlock                  unlock the password of the named account
  -w, --warndays WARN_DAYS      set expiration warning days to WARN_DAYS
  -x, --maxdays MAX_DAYS        set maximum number of days before password
                                change to MAX_DAYS
  -s, --stdin                   read new token from stdin
</code>

<code>
$ echo "password" | passwd --stdin user0
</code>

===== The files and directories =====

==== /etc/default/useradd ====

<code>
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes
</code>

==== /etc/login.defs (with comments, blank lines deleted) ====

<code>
MAIL_DIR	/var/spool/mail
UMASK		022
HOME_MODE	0700
PASS_MAX_DAYS	99999
PASS_MIN_DAYS	0
PASS_MIN_LEN	8
PASS_WARN_AGE	7
UID_MIN                  1000
UID_MAX                 60000
SYS_UID_MIN               201
SYS_UID_MAX               999
SUB_UID_MIN		   524288
SUB_UID_MAX		600100000
SUB_UID_COUNT		    65536
GID_MIN                  1000
GID_MAX                 60000
SYS_GID_MIN               201
SYS_GID_MAX               999
SUB_GID_MIN		   524288
SUB_GID_MAX		600100000
SUB_GID_COUNT		    65536
PASS_CHANGE_TRIES	5
PASS_ALWAYS_WARN	yes
ENCRYPT_METHOD YESCRYPT
USERGROUPS_ENAB yes
CREATE_HOME	yes
HMAC_CRYPTO_ALGO SHA512
</code>
==== /etc/skel ====

<code>
$ tree -a /etc/skel
/etc/skel
├── .bash_logout
├── .bash_profile
└── .bashrc
</code>

**EXERCISE**: Examine these files.

===== Changing your own account properties =====

<code>
$ man 1 passwd
$ man 1 chsh
$ man 1 chfn
</code>

===== Managing groups =====

==== Creating new groups with groupadd ====

<code>
$ groupadd --help
Usage: groupadd [options] GROUP

Options:
  -f, --force                   exit successfully if the group already exists,
                                and cancel -g if the GID is already used
  -g, --gid GID                 use GID for the new group
  -h, --help                    display this help message and exit
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -o, --non-unique              allow to create groups with duplicate
                                (non-unique) GID
  -p, --password PASSWORD       use this encrypted password for the new group
  -r, --system                  create a system account
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       directory prefix
  -U, --users USERS             list of user members of this group
</code>

Example:

<code>
$ sudo groupadd developers
</code>

==== Adding users to groups ====

There are two commands for this:

  * ''usermod''
  * ''groupmod''

Add ''user0'' to group ''developers'' (do **not** forget the ''-a'' for appending):

<code>
$ usermod -aG developers user0
</code>

Verify addition:

<code>
$ id user0
$ groups user0
</code>

Then there's ''groupmod'':

<code>
$ groupmod --help
Usage: groupmod [options] GROUP

Options:
  -a, --append                  append the users mentioned by -U option to the group 
                                without removing existing user members
  -g, --gid GID                 change the group ID to GID
  -h, --help                    display this help message and exit
  -n, --new-name NEW_GROUP      change the name to NEW_GROUP
  -o, --non-unique              allow to use a duplicate (non-unique) GID
  -p, --password PASSWORD       change the password to this (encrypted)
                                PASSWORD
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -U, --users USERS             comma-separated list of users to add as
                                members of this group
</code>

To give someone superuser access, add them to the ''wheel'' group.



==== Deleting groups ====

<code>
$ groupdel --help
Usage: groupdel [options] GROUP

Options:
  -h, --help                    display this help message and exit
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -f, --force                   delete group even if it is the primary group of a user
</code>

==== groupmems ====

<code>
$ groupmems --help
Usage: groupmems [options] [action]

Options:
  -g, --group groupname         change groupname instead of the user's group
                                (root only)
  -R, --root CHROOT_DIR         directory to chroot into

Actions:
  -a, --add username            add username to the members of the group
  -d, --delete username         remove username from the members of the group
  -h, --help                    display this help message and exit
  -p, --purge                   purge all members from the group
  -l, --list                    list the members of the group
</code>

===== Giving someone superuser access =====

First, add them to the ''wheel'' group so they can use the ''sudo'' command; they will still have to type their password.

<code>
$ usermod -aG wheel user1
</code>

In addition, add this line to either ''/etc/sudoers'' or a file under ''/etc/sudoers.d'':

<code>
user1 ALL=(ALL) NOPASSWD: ALL
</code>