====== RH124 Account Management ======
===== Related packages and commands =====
==== $ rpm -ql shadow-utils (partial list) ====
/etc/default/useradd
/etc/login.defs
/etc/pam.d/passwd
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/lastlog
/usr/bin/newgidmap
/usr/bin/newgrp
/usr/bin/newuidmap
/usr/bin/passwd
/usr/bin/sg
...
/usr/sbin/adduser -> useradd
/usr/sbin/chgpasswd
/usr/sbin/chpasswd
/usr/sbin/groupadd
/usr/sbin/groupdel
/usr/sbin/groupmems
/usr/sbin/groupmod
/usr/sbin/grpck
/usr/sbin/grpconv
/usr/sbin/grpunconv
/usr/sbin/newusers
/usr/sbin/pwck
/usr/sbin/pwconv
/usr/sbin/pwunconv
/usr/sbin/useradd
/usr/sbin/userdel
/usr/sbin/usermod
/usr/sbin/vigr
/usr/sbin/vipw
==== $ rpm -ql setup ====
/etc/aliases
/etc/bashrc
/etc/csh.cshrc
/etc/csh.login
/etc/dnf/protected.d/setup.conf
/etc/environment
/etc/ethertypes
/etc/exports
/etc/filesystems
/etc/fstab
/etc/group
/etc/gshadow
/etc/host.conf
/etc/hosts
/etc/inputrc
/etc/motd
/etc/motd.d
/etc/networks
/etc/passwd
/etc/printcap
/etc/profile
/etc/profile.d
/etc/profile.d/csh.local
/etc/profile.d/lang.csh
/etc/profile.d/lang.sh
/etc/profile.d/sh.local
/etc/protocols
/etc/services
/etc/shadow
/etc/shells
/etc/subgid
/etc/subuid
...
==== Basic user and group commands ====
* ''useradd'', ''usermod'', ''userdel''
* ''groupadd'', ''groupmod'', ''groupdel'', ''groupmems''
* ''passwd'', ''chfn'', ''chsh''
===== Everything related to user0 account =====
==== New home directory ====
Verify the existence of ''user0'''s home directory:
$ ls -l /home
$ ls -l /home/user0
==== cat /etc/passwd ====
root:x:0:0:Super User:/root:/bin/bash
bin:x:1:1:bin:/bin:/usr/sbin/nologin
daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator:x:11:0:operator:/root:/usr/sbin/nologin
games:x:12:100:games:/usr/games:/usr/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/usr/sbin/nologin
tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin
systemd-oom:x:999:999:systemd Userspace OOM Killer:/:/sbin/nologin
dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin
sssd:x:998:998:User for sssd:/run/sssd/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/usr/share/empty.sshd:/usr/sbin/nologin
chrony:x:997:997:chrony system user:/var/lib/chrony:/sbin/nologin
systemd-coredump:x:996:996:systemd Core Dumper:/:/usr/sbin/nologin
rpjday:x:1000:1000:Robert P. J.Day:/home/rpjday:/bin/bash
user0:x:1001:1001::/home/user0:/bin/bash
Note:
* The lack of encrypted passwords for all of the accounts (where are they?).
* The number of accounts that run a non-shell command directly.
* The number of accounts that do not allow a login at all.
==== cat /etc/group (partial) ====
root:x:0:
bin:x:1:
daemon:x:2:
...
systemd-coredump:x:996:
rpjday:x:1000:
user0:x:1001:
Note the use of //user private groups//. Check your own attributes with:
$ id
uid=1000(rpjday) gid=1000(rpjday) groups=1000(rpjday),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
You do not need an entry in ''/etc/group'' for your account's primary group.
==== cat /etc/shadow (secure) ====
root:!::0:99999:7:::
bin:*:20244:0:99999:7:::
daemon:*:20244:0:99999:7:::
...
systemd-coredump:!*:20743::::::
rpjday:$y$j9T$rEkTh5W7RoZABXoeTINKHge6$XL4PTqdlSIxiP51xD24yHmlCizpYhi14Ot8UwzcQj0C::0:99999:7:::
user0:$y$j9T$jCOzJ4lgTqwN9p7mf7fxT/$iglKahqGQ4XzPlD0Z1db/s5Vg0lcH6SikSh0KXCy/FA:20743:0:99999:7:::
You can't view this file:
$ ls -l /etc/shadow
----------. 1 root root 718 Oct 19 11:20 /etc/shadow
$
===== Account management =====
==== How class accounts are created ====
For each account:
$ sudo useradd [-m] user1
$ passwd user1
==== useradd ====
The output from ''%%useradd --help%%'':
Usage: useradd [options] LOGIN
useradd -D
useradd -D [options]
Options:
--badname do not check for bad names
-b, --base-dir BASE_DIR base directory for the home directory of the
new account
--btrfs-subvolume-home use BTRFS subvolume for home directory
-c, --comment COMMENT GECOS field of the new account
-d, --home-dir HOME_DIR home directory of the new account
-D, --defaults print or change default useradd configuration
-e, --expiredate EXPIRE_DATE expiration date of the new account
-f, --inactive INACTIVE password inactivity period of the new account
-F, --add-subids-for-system add entries to sub[ud]id even when adding a system user
-g, --gid GROUP name or ID of the primary group of the new
account
-G, --groups GROUPS list of supplementary groups of the new
account
-h, --help display this help message and exit
-k, --skel SKEL_DIR use this alternative skeleton directory
-K, --key KEY=VALUE override /etc/login.defs defaults
-l, --no-log-init do not add the user to the lastlog and
faillog databases
-m, --create-home create the user's home directory
-M, --no-create-home do not create the user's home directory
-N, --no-user-group do not create a group with the same name as
the user
-o, --non-unique allow to create users with duplicate
(non-unique) UID
-p, --password PASSWORD encrypted password of the new account
-r, --system create a system account
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-s, --shell SHELL login shell of the new account
-u, --uid UID user ID of the new account
-U, --user-group create a group with the same name as the user
-Z, --selinux-user SEUSER use a specific SEUSER for the SELinux user mapping
--selinux-range SERANGE use a specific MLS range for the SELinux user mapping
For the full story:
$ man useradd
==== usermod ====
$ usermod --help
Usage: usermod [options] LOGIN
Options:
-a, --append append the user to the supplemental GROUPS
mentioned by the -G option without removing
the user from other groups
-b, --badname allow bad names
-c, --comment COMMENT new value of the GECOS field
-d, --home HOME_DIR new home directory for the user account
-e, --expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE
-f, --inactive INACTIVE set password inactive after expiration
to INACTIVE
-g, --gid GROUP force use GROUP as new primary group
-G, --groups GROUPS new list of supplementary GROUPS
-h, --help display this help message and exit
-l, --login NEW_LOGIN new value of the login name
-L, --lock lock the user account
-m, --move-home move contents of the home directory to the
new location (use only with -d)
-o, --non-unique allow using duplicate (non-unique) UID
-p, --password PASSWORD use encrypted password for the new password
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-r, --remove remove the user from only the supplemental GROUPS
mentioned by the -G option without removing
the user from other groups
-R, --root CHROOT_DIR directory to chroot into
-s, --shell SHELL new login shell for the user account
-u, --uid UID new UID for the user account
-U, --unlock unlock the user account
-v, --add-subuids FIRST-LAST add range of subordinate uids
-V, --del-subuids FIRST-LAST remove range of subordinate uids
-w, --add-subgids FIRST-LAST add range of subordinate gids
-W, --del-subgids FIRST-LAST remove range of subordinate gids
-Z, --selinux-user SEUSER new SELinux user mapping for the user account
--selinux-range SERANGE new SELinux MLS range for the user account
==== userdel ====
$ userdel --help
Usage: userdel [options] LOGIN
Options:
-f, --force force some actions that would fail otherwise
e.g. removal of user still logged in
or files, even if not owned by the user
-h, --help display this help message and exit
-r, --remove remove home directory and mail spool
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-Z, --selinux-user remove any SELinux user mapping for the user
==== Changing someone's password ====
$ passwd user0
Note ''%%--stdin%%'' option to set password:
$ passwd --help
Usage: passwd [options] [LOGIN]
Options:
-a, --all report password status on all accounts
-d, --delete delete the password for the named account
-e, --expire force expire the password for the named account
-h, --help display this help message and exit
-k, --keep-tokens change password only if expired
-i, --inactive INACTIVE set password inactive after expiration
to INACTIVE
-l, --lock lock the password of the named account
-n, --mindays MIN_DAYS set minimum number of days before password
change to MIN_DAYS
-q, --quiet quiet mode
-r, --repository REPOSITORY change password in REPOSITORY repository
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR directory prefix
-S, --status report password status on the named account
-u, --unlock unlock the password of the named account
-w, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
-x, --maxdays MAX_DAYS set maximum number of days before password
change to MAX_DAYS
-s, --stdin read new token from stdin
$ echo "password" | passwd --stdin user0
===== The files and directories =====
==== /etc/default/useradd ====
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes
==== /etc/login.defs (with comments, blank lines deleted) ====
MAIL_DIR /var/spool/mail
UMASK 022
HOME_MODE 0700
PASS_MAX_DAYS 99999
PASS_MIN_DAYS 0
PASS_MIN_LEN 8
PASS_WARN_AGE 7
UID_MIN 1000
UID_MAX 60000
SYS_UID_MIN 201
SYS_UID_MAX 999
SUB_UID_MIN 524288
SUB_UID_MAX 600100000
SUB_UID_COUNT 65536
GID_MIN 1000
GID_MAX 60000
SYS_GID_MIN 201
SYS_GID_MAX 999
SUB_GID_MIN 524288
SUB_GID_MAX 600100000
SUB_GID_COUNT 65536
PASS_CHANGE_TRIES 5
PASS_ALWAYS_WARN yes
ENCRYPT_METHOD YESCRYPT
USERGROUPS_ENAB yes
CREATE_HOME yes
HMAC_CRYPTO_ALGO SHA512
==== /etc/skel ====
$ tree -a /etc/skel
/etc/skel
├── .bash_logout
├── .bash_profile
└── .bashrc
**EXERCISE**: Examine these files.
===== Changing your own account properties =====
$ man 1 passwd
$ man 1 chsh
$ man 1 chfn
===== Managing groups =====
==== Creating new groups with groupadd ====
$ groupadd --help
Usage: groupadd [options] GROUP
Options:
-f, --force exit successfully if the group already exists,
and cancel -g if the GID is already used
-g, --gid GID use GID for the new group
-h, --help display this help message and exit
-K, --key KEY=VALUE override /etc/login.defs defaults
-o, --non-unique allow to create groups with duplicate
(non-unique) GID
-p, --password PASSWORD use this encrypted password for the new group
-r, --system create a system account
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR directory prefix
-U, --users USERS list of user members of this group
Example:
$ sudo groupadd developers
==== Adding users to groups ====
There are two commands for this:
* ''usermod''
* ''groupmod''
Add ''user0'' to group ''developers'' (do **not** forget the ''-a'' for appending):
$ usermod -aG developers user0
Verify addition:
$ id user0
$ groups user0
Then there's ''groupmod'':
$ groupmod --help
Usage: groupmod [options] GROUP
Options:
-a, --append append the users mentioned by -U option to the group
without removing existing user members
-g, --gid GID change the group ID to GID
-h, --help display this help message and exit
-n, --new-name NEW_GROUP change the name to NEW_GROUP
-o, --non-unique allow to use a duplicate (non-unique) GID
-p, --password PASSWORD change the password to this (encrypted)
PASSWORD
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-U, --users USERS comma-separated list of users to add as
members of this group
To give someone superuser access, add them to the ''wheel'' group.
==== Deleting groups ====
$ groupdel --help
Usage: groupdel [options] GROUP
Options:
-h, --help display this help message and exit
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-f, --force delete group even if it is the primary group of a user
==== groupmems ====
$ groupmems --help
Usage: groupmems [options] [action]
Options:
-g, --group groupname change groupname instead of the user's group
(root only)
-R, --root CHROOT_DIR directory to chroot into
Actions:
-a, --add username add username to the members of the group
-d, --delete username remove username from the members of the group
-h, --help display this help message and exit
-p, --purge purge all members from the group
-l, --list list the members of the group
===== Giving someone superuser access =====
First, add them to the ''wheel'' group so they can use the ''sudo'' command; they will still have to type their password.
$ usermod -aG wheel user1
In addition, add this line to either ''/etc/sudoers'' or a file under ''/etc/sudoers.d'':
user1 ALL=(ALL) NOPASSWD: ALL