/etc/default/useradd /etc/login.defs /etc/pam.d/passwd /usr/bin/chage /usr/bin/gpasswd /usr/bin/lastlog /usr/bin/newgidmap /usr/bin/newgrp /usr/bin/newuidmap /usr/bin/passwd /usr/bin/sg ... /usr/sbin/adduser -> useradd /usr/sbin/chgpasswd /usr/sbin/chpasswd /usr/sbin/groupadd /usr/sbin/groupdel /usr/sbin/groupmems /usr/sbin/groupmod /usr/sbin/grpck /usr/sbin/grpconv /usr/sbin/grpunconv /usr/sbin/newusers /usr/sbin/pwck /usr/sbin/pwconv /usr/sbin/pwunconv /usr/sbin/useradd /usr/sbin/userdel /usr/sbin/usermod /usr/sbin/vigr /usr/sbin/vipw
/etc/aliases /etc/bashrc /etc/csh.cshrc /etc/csh.login /etc/dnf/protected.d/setup.conf /etc/environment /etc/ethertypes /etc/exports /etc/filesystems /etc/fstab /etc/group /etc/gshadow /etc/host.conf /etc/hosts /etc/inputrc /etc/motd /etc/motd.d /etc/networks /etc/passwd /etc/printcap /etc/profile /etc/profile.d /etc/profile.d/csh.local /etc/profile.d/lang.csh /etc/profile.d/lang.sh /etc/profile.d/sh.local /etc/protocols /etc/services /etc/shadow /etc/shells /etc/subgid /etc/subuid ...
useradd, usermod, userdelgroupadd, groupmod, groupdel, groupmemspasswd, chfn, chsh
Verify the existence of user0's home directory:
$ ls -l /home $ ls -l /home/user0
root:x:0:0:Super User:/root:/bin/bash bin:x:1:1:bin:/bin:/usr/sbin/nologin daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin adm:x:3:4:adm:/var/adm:/usr/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin operator:x:11:0:operator:/root:/usr/sbin/nologin games:x:12:100:games:/usr/games:/usr/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin nobody:x:65534:65534:Kernel Overflow User:/:/usr/sbin/nologin tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin systemd-oom:x:999:999:systemd Userspace OOM Killer:/:/sbin/nologin dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin sssd:x:998:998:User for sssd:/run/sssd/:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/usr/share/empty.sshd:/usr/sbin/nologin chrony:x:997:997:chrony system user:/var/lib/chrony:/sbin/nologin systemd-coredump:x:996:996:systemd Core Dumper:/:/usr/sbin/nologin rpjday:x:1000:1000:Robert P. J.Day:/home/rpjday:/bin/bash user0:x:1001:1001::/home/user0:/bin/bash
Note:
root:x:0: bin:x:1: daemon:x:2: ... systemd-coredump:x:996: rpjday:x:1000: user0:x:1001:
Note the use of user private groups. Check your own attributes with:
$ id uid=1000(rpjday) gid=1000(rpjday) groups=1000(rpjday),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
You do not need an entry in /etc/group for your account's primary group.
root:!::0:99999:7::: bin:*:20244:0:99999:7::: daemon:*:20244:0:99999:7::: ... systemd-coredump:!*:20743:::::: rpjday:$y$j9T$rEkTh5W7RoZABXoeTINKHge6$XL4PTqdlSIxiP51xD24yHmlCizpYhi14Ot8UwzcQj0C::0:99999:7::: user0:$y$j9T$jCOzJ4lgTqwN9p7mf7fxT/$iglKahqGQ4XzPlD0Z1db/s5Vg0lcH6SikSh0KXCy/FA:20743:0:99999:7:::
You can't view this file:
$ ls -l /etc/shadow ----------. 1 root root 718 Oct 19 11:20 /etc/shadow $
For each account:
$ sudo useradd [-m] user1 $ passwd user1
The output from useradd --help:
Usage: useradd [options] LOGIN
useradd -D
useradd -D [options]
Options:
--badname do not check for bad names
-b, --base-dir BASE_DIR base directory for the home directory of the
new account
--btrfs-subvolume-home use BTRFS subvolume for home directory
-c, --comment COMMENT GECOS field of the new account
-d, --home-dir HOME_DIR home directory of the new account
-D, --defaults print or change default useradd configuration
-e, --expiredate EXPIRE_DATE expiration date of the new account
-f, --inactive INACTIVE password inactivity period of the new account
-F, --add-subids-for-system add entries to sub[ud]id even when adding a system user
-g, --gid GROUP name or ID of the primary group of the new
account
-G, --groups GROUPS list of supplementary groups of the new
account
-h, --help display this help message and exit
-k, --skel SKEL_DIR use this alternative skeleton directory
-K, --key KEY=VALUE override /etc/login.defs defaults
-l, --no-log-init do not add the user to the lastlog and
faillog databases
-m, --create-home create the user's home directory
-M, --no-create-home do not create the user's home directory
-N, --no-user-group do not create a group with the same name as
the user
-o, --non-unique allow to create users with duplicate
(non-unique) UID
-p, --password PASSWORD encrypted password of the new account
-r, --system create a system account
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-s, --shell SHELL login shell of the new account
-u, --uid UID user ID of the new account
-U, --user-group create a group with the same name as the user
-Z, --selinux-user SEUSER use a specific SEUSER for the SELinux user mapping
--selinux-range SERANGE use a specific MLS range for the SELinux user mapping
For the full story:
$ man useradd
$ usermod --help
Usage: usermod [options] LOGIN
Options:
-a, --append append the user to the supplemental GROUPS
mentioned by the -G option without removing
the user from other groups
-b, --badname allow bad names
-c, --comment COMMENT new value of the GECOS field
-d, --home HOME_DIR new home directory for the user account
-e, --expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE
-f, --inactive INACTIVE set password inactive after expiration
to INACTIVE
-g, --gid GROUP force use GROUP as new primary group
-G, --groups GROUPS new list of supplementary GROUPS
-h, --help display this help message and exit
-l, --login NEW_LOGIN new value of the login name
-L, --lock lock the user account
-m, --move-home move contents of the home directory to the
new location (use only with -d)
-o, --non-unique allow using duplicate (non-unique) UID
-p, --password PASSWORD use encrypted password for the new password
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-r, --remove remove the user from only the supplemental GROUPS
mentioned by the -G option without removing
the user from other groups
-R, --root CHROOT_DIR directory to chroot into
-s, --shell SHELL new login shell for the user account
-u, --uid UID new UID for the user account
-U, --unlock unlock the user account
-v, --add-subuids FIRST-LAST add range of subordinate uids
-V, --del-subuids FIRST-LAST remove range of subordinate uids
-w, --add-subgids FIRST-LAST add range of subordinate gids
-W, --del-subgids FIRST-LAST remove range of subordinate gids
-Z, --selinux-user SEUSER new SELinux user mapping for the user account
--selinux-range SERANGE new SELinux MLS range for the user account
$ userdel --help
Usage: userdel [options] LOGIN
Options:
-f, --force force some actions that would fail otherwise
e.g. removal of user still logged in
or files, even if not owned by the user
-h, --help display this help message and exit
-r, --remove remove home directory and mail spool
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-Z, --selinux-user remove any SELinux user mapping for the user
$ passwd user0
Note --stdin option to set password:
$ passwd --help
Usage: passwd [options] [LOGIN]
Options:
-a, --all report password status on all accounts
-d, --delete delete the password for the named account
-e, --expire force expire the password for the named account
-h, --help display this help message and exit
-k, --keep-tokens change password only if expired
-i, --inactive INACTIVE set password inactive after expiration
to INACTIVE
-l, --lock lock the password of the named account
-n, --mindays MIN_DAYS set minimum number of days before password
change to MIN_DAYS
-q, --quiet quiet mode
-r, --repository REPOSITORY change password in REPOSITORY repository
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR directory prefix
-S, --status report password status on the named account
-u, --unlock unlock the password of the named account
-w, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
-x, --maxdays MAX_DAYS set maximum number of days before password
change to MAX_DAYS
-s, --stdin read new token from stdin
$ echo "password" | passwd --stdin user0
GROUP=100 HOME=/home INACTIVE=-1 EXPIRE= SHELL=/bin/bash SKEL=/etc/skel CREATE_MAIL_SPOOL=yes
MAIL_DIR /var/spool/mail UMASK 022 HOME_MODE 0700 PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_MIN_LEN 8 PASS_WARN_AGE 7 UID_MIN 1000 UID_MAX 60000 SYS_UID_MIN 201 SYS_UID_MAX 999 SUB_UID_MIN 524288 SUB_UID_MAX 600100000 SUB_UID_COUNT 65536 GID_MIN 1000 GID_MAX 60000 SYS_GID_MIN 201 SYS_GID_MAX 999 SUB_GID_MIN 524288 SUB_GID_MAX 600100000 SUB_GID_COUNT 65536 PASS_CHANGE_TRIES 5 PASS_ALWAYS_WARN yes ENCRYPT_METHOD YESCRYPT USERGROUPS_ENAB yes CREATE_HOME yes HMAC_CRYPTO_ALGO SHA512
$ tree -a /etc/skel /etc/skel ├── .bash_logout ├── .bash_profile └── .bashrc
EXERCISE: Examine these files.
$ man 1 passwd $ man 1 chsh $ man 1 chfn
$ groupadd --help
Usage: groupadd [options] GROUP
Options:
-f, --force exit successfully if the group already exists,
and cancel -g if the GID is already used
-g, --gid GID use GID for the new group
-h, --help display this help message and exit
-K, --key KEY=VALUE override /etc/login.defs defaults
-o, --non-unique allow to create groups with duplicate
(non-unique) GID
-p, --password PASSWORD use this encrypted password for the new group
-r, --system create a system account
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR directory prefix
-U, --users USERS list of user members of this group
Example:
$ sudo groupadd developers
There are two commands for this:
usermodgroupmod
Add user0 to group developers (do not forget the -a for appending):
$ usermod -aG developers user0
Verify addition:
$ id user0 $ groups user0
Then there's groupmod:
$ groupmod --help
Usage: groupmod [options] GROUP
Options:
-a, --append append the users mentioned by -U option to the group
without removing existing user members
-g, --gid GID change the group ID to GID
-h, --help display this help message and exit
-n, --new-name NEW_GROUP change the name to NEW_GROUP
-o, --non-unique allow to use a duplicate (non-unique) GID
-p, --password PASSWORD change the password to this (encrypted)
PASSWORD
-R, --root CHROOT_DIR directory to chroot into
-P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files
-U, --users USERS comma-separated list of users to add as
members of this group
To give someone superuser access, add them to the wheel group.
$ groupdel --help Usage: groupdel [options] GROUP Options: -h, --help display this help message and exit -R, --root CHROOT_DIR directory to chroot into -P, --prefix PREFIX_DIR prefix directory where are located the /etc/* files -f, --force delete group even if it is the primary group of a user
$ groupmems --help
Usage: groupmems [options] [action]
Options:
-g, --group groupname change groupname instead of the user's group
(root only)
-R, --root CHROOT_DIR directory to chroot into
Actions:
-a, --add username add username to the members of the group
-d, --delete username remove username from the members of the group
-h, --help display this help message and exit
-p, --purge purge all members from the group
-l, --list list the members of the group
First, add them to the wheel group so they can use the sudo command; they will still have to type their password.
$ usermod -aG wheel user1
In addition, add this line to either /etc/sudoers or a file under /etc/sudoers.d:
user1 ALL=(ALL) NOPASSWD: ALL