CentOS system management_users and user groups

I. New users and user groups: useradd and groupadd

1. useradd parameters:

-U: indicates the UID mark.

-D: Specifies the home directory. The default value is/home/user name.

-E: Specifies the Account expiration time (this option is also available in the following usermod)

-G: Specify the basic group (group name or GID)

-G: Specify the additional group (group name or GID)

-M: Do not create and initialize the home directory,

-S: Specifies the user's logon shell (default:/bin/bash, usually do not need to change, you can specify when creating a non-Login User

Is/sbin/nologin)

Note: These parameters can be used separately. If they do not conflict with each other, they can be used together during User Creation.

Example 1: Add User stu01, specify UID as 520, host directory as/public/stu01, and specify basic group as users (note: in the system

The GID of the users Group is 100), and the additional group is tech:

[Root @ localhost ~] # Useradd-u520-d/public/stu04-gusers-Gtechstu01

[Root @ localhost ~] # Idstu01

Uid = 520 (stu01) gid = 100 (users) groups = 100 (users), 200 (tech)

Example 2: Add User stu02 and do not create a home directory for the user:

[Root @ localhost ~] # Useradd-M-s/sbin/nologinstu02 // create a non-logged-on user stu02

[Root @ localhost ~] # Cat/etc/passwd | grepstu02

Stu02: x: 1001: 1001:/home/stu02:/sbin/nologin //-s parameter specifies bashshell

2. groupadd parameters:

Gourpadd [-gGID] group name

The-g parameter specifies the GID of the new user group.

[Root @ localhost ~] # Groupadd-g600stu // Add a group stu and specify its GID as 600

[Root @ localhost ~] # Cat/etc/group | grepstu // view stu group information

Stu: x: 600:

Ii. Deleting Users and user groups

1, userdel

-Format: userdel [-r] User Name

Add the-r option and delete the home directory/user email.

Example:

[Root @ localhost ~] # Useradduser1; useradduser2 // Add user1 and user2

[Root @ localhost ~] # Ll-d/home/user1 // var/mail/user1/home/user2 // var/mail/user2 // check whether the home directory and email file of user1 and user2 exist

Drwx ------ 3user1user1409602-1809: 53/home/user1/

Drwx ------ 3user2user2409602-1809: 53/home/user2/

-Rw ---- 1user1mail002-1809: 53/var/mail/user1

-Rw ---- 1user2mail002-1809: 53/var/mail/user2

[Root @ localhost ~] # Userdeluser1; userdel-ruser2 // Add without-r difference

[Root @ localhost ~] # Ll-d/home/user1 // var/mail/user1/home/user2 // var/mail/user2

Ls:/home/user2/: no such file or directory // Delete the home directory after adding-r

Ls:/var/mail/user2: there is no such file or directory. // Delete the email file after adding-r.

Drwx ------ 310021002409602-1809: 53/home/user1/

-Rw ---- 11002mail002-1809: 53/var/mail/user1

[Root @ localhost ~] #

2. groupdel: delete a user group

-Format: groupdel group name

-The deleted target group cannot be the user's basic group.

-When deleting a user group, if the group is a private group of members, the group cannot be deleted. You must delete the members in the group before deleting the group.

[Root @ localhost ~] # Iduser1 // view the basic group and additional group of user1

Uid = 1002 (user1) gid = 1002 (user1) groups = 1002 (user1), 600 (stu)

[Root @ localhost ~] # Grepstu/etc/group

Stu: x: 600: user1, user2

As shown in the preceding operation, the basic group of user1 is user1 and the additional group is stu. Currently, only stu can be deleted, but user1 cannot be deleted directly, because user1 is a basic group, to delete user1, you must first Delete user1 and then user1. The stu group is not a basic group, but an additional group of user1 and user2. therefore, you can delete it directly.

[Root @ localhost ~] # Groupdeluser1 // try to delete the user1 user group. Because user1 is a basic group of user1, you must first Delete user1 before deleting user1.

Groupdel: the user's master group cannot be deleted.

[Root @ localhost ~] # Groupdelstu

[Root @ localhost ~] # After grepstu/etc/group // deletes the stu group, you cannot see the stu group information in the/etc/group file.

3. Add passwords for users and user groups

1. Add a password for the user:

Passwd command:

Options:

-D: Clear the user's password so that you can log on without a password.

-L: the user account is locked.

-S: Check the user account status (locked or not)

-U: Unlock the user account

-- Stdin: Password for standard input (such as pipe)

Note: To delete a password, use passwd-d instead of echo "" | passwd -- stdin User Name

Example:

[Root @ localhosthome] # cat/etc/shadow | grepuser3 // check whether user3 has a password

User3: $1 $4 vGPvNrT $ xrFPE9XQhl. w1jchu10wo/: 16119: 0: 99999: 7 :::

[Root @ localhosthome] # passwd-duser3 // use the-d option to delete a password

Removingpasswordforuseruser3.

Passwd: Success

[Root @ localhosthome] # cat/etc/shadow | grepuser3 // check again and cancel the password

User3: 16119: 0: 99999: 7 :::

[Root @ localhosthome] #

Example:

If you change the password of a user, you can directly enter the passwd user name, enter the interactive password to enter the user, use -- stdin to set the password in non-interactive mode, and import the password directly.

[Root @ localhost/] # echo "123" | passwd -- stdinuser3 // set user3's password to 123 and use -- stdin as the interactive import password.

Changingpasswordforuseruser3.

Passwd: allauthenticationtokensupdatedsuccessfully.

[Root @ localhost/] # passwd-luser3 // lock user3 account

Lockingpasswordforuseruser3.

Passwd: Success

[Root @ localhost/] # grepuser3/etc/shadow // view the password of the locked account. There are two "!"

User3 :!! $1 $4 vGPvNrT $ xrFPE9XQhl. w1jchu10wo/: 16119: 0: 99999: 7 :::

[Root @ localhost/] # passwd-Suser3 // use-S to check if it is locked

User3LK2014-02-180999997-1 (passworlocked .)

[Root @ localhost/] # passwd-uuser3 //-u parameter is unlocked

Unlockingpasswordforuseruser3.

Passwd: Success.

[Root @ localhost/] # After grepuser3/etc/shadow // is unlocked, the password segment of this account does not contain "!"

User3: $1 $4 vGPvNrT $ xrFPE9XQhl. w1jchu10wo/: 16119: 0: 99999: 7 :::

[Root @ localhost/] #

2. User Group password gpasswd

Gpasswd group name: Enter the interactive password input for confirmation.

Gpasswd-r group name:-r option is to remove the password, gpasswd-r group name is to clear the group password

The purpose of the group password is to use the password of the group account that some users want to join the group, and this user is also temporarily added when they join the group, exit to exit the group.

Iv. add and delete user group members

1. Application of gpasswd in user group

-A: defines the Group Administrator list (you can view group administrators and group members in the/etc/gshadow file)

-A: Add group members. Only one group can be added at a time.

-D: deletes only one group member at a time.

-M: defines the list of group members. You can set multiple group members to overwrite the group. After the group is defined, users in the group will be deleted. Note that when writing Multiple member lists, separated by commas)

Example:

[Root @ localhost ~] # Grepuser/etc/gshadow

User :! ::

[Root @ localhost ~] # Gpasswd-auser1user // Add account user1 to the user group

Adding user "user1" to "user" group

[Root @ localhost ~] # Gpasswd-auser2user // Add user2 to the user group

Adding user "user2" to "user" group

[Root @ localhost ~] # Grepuser/etc/gshadow | tail-1 // view members of the user Group

User :! : User1, user2

[Root @ localhost ~] # Gpasswd-Mstu01, stu02user //-M parameter override add multiple users

[Root @ localhost ~] # Cat/etc/gshadow | tail-1 // check again. user1 and user2 are overwritten.

User :! : Stu01, stu02

[Root @ localhost ~] # Gpasswd-dstu01user // remove stu01 from the user group

Deleting user "stu01" from "user" group

[Root @ localhost ~] # Cat/etc/gshadow | tail-1

User :! : Stu02 // after deletion, only stu02 users are left.

[Root @ localhost ~] # Gpasswd-Astu02user // set stu02 as Administrator

[Root @ localhost ~] # Grepuser/etc/gshadow | tail-1

User :! : Stu02: stu02 // In the gshadow file, the third field is the administrator account of the group, which is stu02

[Root @ localhost ~] #

2. usermod is used to change user attributes and add additional groups to user Members.

Only use the-a-G option of usermod (-a indicates adding,-G indicates a group, and-a-G indicates adding an additional group)

Command: usermod-a-G user group Username

[Root @ localhost ~] # Usermod-a-Gtechstu02 // Add an additional group tech for stu02

[Root @ localhost ~] # Idstu02

Uid = 501 (stu02) gid = 1201 (nsd) groups = 1201 (nsd), 200 (tech), 1204 (user)

5. view and modify user and group attributes

1. usermod: Mainly used to modify attributes between users and groups.

Format: usermod [Option] (options can have multiple) User Name

-L: Change the logon name of the user account

-L: Lock the user account (NOTE: When you use usermod-L to lock an account, you can use passwd-u to directly unlock it, but use passwd-l to lock the account, the time when usermod-U is used to unlock the account must be unlocked twice, because two passwords are in front of passwd-l !, Usermod-L has a password before it !, You can check the password segment in the/etc/gshadow file for verification .)

-U: Unlock the user account

-U,-d,-e,-g,-G,-s: Same as useradd

-A: used with-G to add an additional group to the user (only when-G is used to modify the additional group)

Example:

Usermod-e20140630 (OR) user1: to change user1 account expiration time to 20140630

But when using chage-E2014-06-30user1, you cannot use 20140630

[Root @ localhost ~] # Cat/etc/shadow | grepuser1

User1 :!! : 16119: 0: 99999: 7 :::

[Root @ localhost ~] # Usermod-e20140630user1 // modify user1 account expiration time

[Root @ localhost ~] # Cat/etc/shadow | grepuser1

User1 :!! : 16119: 0: 99999: 7: 16251:

[Root @ localhost ~] # Usermod-luser01user1 // modify user1 login name to user01

Usermod: Warning:/var/spool/mail/user1 does not belong to user1

[Root @ localhost ~] #

2. chage: Set the user's password.

-L: list valid password information

-E: Specifies the Account expiration time, YYYY-MM-DD

-I: Specifies how many days after the password expires to lock the account

-M: specifies the minimum number of days for a password.

-M: specifies the maximum number of days for a password.

Example:

[Root @ localhost ~] # Chage-luser01 // view user01 password information

Last password modification time: February 18

Password expiration time: Never

Password expiration time: Never

Account expiration time: Never

Minimum number of days between two password changes: 0

Maximum number of days between two password changes: 99999

Warning days before Password Expiration: 7

[Root @ localhost ~] # Cat/etc/shadow | grepuser01

User01: $1 $609 lnAxS $ qk/Yzf4qd727R9Q2dieQ1.: 16119: 0: 99999: 7 :::

[Root @ localhost ~] # Chage-E2014-07-10user01 // modify user01 account expiration time

[Root @ localhost ~] # Chage-I3user01 // modify user01 User Password locked 3 days after expiration

[Root @ localhost ~] # Chage-m10user01 // no modification allowed within 10 days after password Modification

[Root @ localhost ~] # Chage-M40user01 // The password must be changed again after 40 days

[Root @ localhost ~] # Cat/etc/shadow | grepuser01

User01: $1 $609 lnAxS $ qk/Yzf4qd727R9Q2dieQ1.: 16119: 10: 40: 7: 3: 16261:

[Root @ localhost ~] # Chage-luser01

Last password modification time: February 18

Password expiration time: March 30

Password expiration time: April 02

Account expiration time: July 10

Minimum number of days between two password changes: 10

Maximum number of days between two password changes: 40

Warning days before Password Expiration: 7

[Root @ localhost ~] #

3, id

-Enter an id in the command line to view the user name and Group of the account;

[Root @ localhost ~] # Su-frank

[Frank @ localhost ~] $ Id // id command to directly view the ID and Group of the current user

Uid = 507 (frank) gid = 507 (frank) groups = 507 (frank)

-Id Username: displays information about the user.

[Root @ localhost ~] # Idfrank // view the user ID and Group of the frank user

Uid = 507 (frank) gid = 507 (frank) groups = 507 (frank)

[Root @ localhost ~] # Iduser01 // view the user ID and group of user01

Uid = 1005 (user01) gid = 1005 (user1) groups = 1005 (user1)

[Root @ localhost ~] #

-Id-gn: view the group to which the current user belongs

[Root @ localhost ~] # Su-frank

[Frank @ localhost ~] $ Id-gn // view the current group, which is the frank group. Modify the following

Frank

[Frank @ localhost ~] $ Exit

Logout

[Root @ localhost ~] # Usermod-gtechfrank // change frank's basic group to tech

[Root @ localhost ~] # Su-frank

[Frank @ localhost ~] $ Id-gn // use id-gn to view the current group

Tech

[Frank @ localhost ~] $

4, newgrp

Newgrp user group: adds an additional user group for the current user temporarily (you can exit the group with exit)

Example:

[Root @ localhost ~] # Su-frank

[Frank @ localhost ~] $ Id

Uid = 507 (frank) gid = 200 (tech) groups = 200 (tech)

[Frank @ localhost ~] $ Newkguser

Password: // This password is the user group password set with gpasswd. When a new user is added, enter it. If there is no password, click OK to add it.

[Frank @ localhost ~] $ Id-gn

User // The user group is user. Before modification, the user group is tech.

[Frank @ localhost ~] $ Id

Uid = 507 (frank) gid = 1204 (user) groups = 200 (tech), 1204 (user)

[Frank @ localhost ~] $ Exit // only an additional group temporarily added. You can use exit to exit the group.

Exit

[Frank @ localhost ~] $ Id

Uid = 507 (frank) gid = 200 (tech) groups = 200 (tech)

[Frank @ localhost ~] $ Id-gn

Tech // The user group after exiting is not tech

[Frank @ localhost ~] $

5. groups: view the user group

Groups: view the group to which the current user belongs (including basic group and additional group)

Groups User name: view the group to which the user belongs (including the basic group and the additional group, the previous is the base group)

Note: You can also view the fourth section of the/etc/group and/etc/gshadow files.

[Root @ localhost ~] # Groups // view the group to which the current user belongs

Rootbindaemonsysadmdiskwheel

[Root @ localhost ~] # Groupsuser2 // view the group to which user2 belongs

User2: user2tech // then the basic group of user2 users is user2, there is an additional group, for tech

[Root @ localhost ~] #

Vi. Attachment: passwords of users and user groups and hidden files in the new user's home directory

1. User Password:/etc/passwd and/etc/shadow

/Etc/passwd file: saves the basic information of the user account

[Root @ localhost ~] # Head-1/etc/passwd

Root: x: 0: 0: root:/bin/bash

1234567

The content in passwd is divided into seven fields separated by ":". The meaning of each field is as follows:

Section 1: User Account Name

Note: can be modified using user-luser1user01

Section 2: password characters or placeholders

Note: The encrypted password is stored in the/etc/shadow file.

Section 3: UID of the user account

Note: during creation, useradd-u is used to specify the UID.

Section 4: gid of the basic Group

Note: If you do not specify a basic group when creating a user, a group with the same name as the user is created by default. You can use useradd-gusers/100 to specify the GID of the new user group.

Section 5: full user name

Section 6: Home Directory

Note: At the time of User Creation, use useradd-d to specify

Section 7: path for logging on to the shell program

Note: When creating a user, use useradd-s to specify it. You can also use usermod-s to specify it later.

/Etc/shadow file: stores password string, validity period, and other information

[Root @ localhost/] # head-1/etc/shadow

Root: $1 $ SmlKPNho $ qNqybQOGBSnK6iWmviI6b1: 15908: 0: 99999: 7 :::

123456789

Section 1: User Account Name

Section 2: encrypted password string

Note: Add two "!" after passwd-l is locked "!", After the string is locked with usermod-L, add "!" to the front of the string "!"

Section 3: last password change time

Section 4: minimum valid days of the password. The default value is 0.

Note: You can use chage-m to change the password within several days after the last password change.

Section 5: Maximum number of valid days for a password

Note: in other words, the password must be modified after the valid Number of days. You can use chage-M to modify the password.

Section 6: Number of days of warning after the password expires. The default value is 7.

Note: The reminder is sent seven days before the password is valid for the maximum number of days.

Segment 7: the number of days after the password expires. The default value is null.

Note: After the password expires, that is, after the maximum validity period of the password expires, the user can continue to use this account. If the password is not modified, this time will take effect, this user will be disabled. You can use chage-I to modify

Section 8: Account expiration time. The default value is null.

You can use chage-E or usermod-e to modify the Account expiration time.

For example:

[Root @ localhosthome] # chage-luser01

Last password modification time: February 18

Password expiration time: March 30

Password expiration time: April 02

Account expiration time: July 10

Minimum number of days between two password changes: 10

Maximum number of days between two password changes: 40

Warning days before Password Expiration: 7

[Root @ localhost ~] # Cat/etc/shadow | grepuser01

User01: $1 $609 lnAxS $ qk/Yzf4qd727R9Q2dieQ1.: 16119: 10: 40: 7: 3: 16261:

[Root @ localhost ~] # Usermod-e20140810user01 // or chage-E20140810user01

[Root @ localhost ~] # Cat/etc/shadow | grepuser01

User01: $1 $609 lnAxS $ qk/Yzf4qd727R9Q2dieQ1.: 16119: 10: 40: 7: 3: 16292:

[Root @ localhost ~] # Chage-luser01

Last password modification time: February 18

Password expiration time: March 30

Password expiration time: April 02

Account expiration time: August 10

Minimum number of days between two password changes: 10

Maximum number of days between two password changes: 40

Warning days before Password Expiration: 7

Section 9: this field is retained

2. Default Configuration/etc/login. defs,/etc/useradd, and/etc/skel when creating a user

[Root @ localhost ~] # Grep-vE "^ # | ^ $"/etc/login. defs

MAIL_DIR/var/spool/mail // defines the mail file path

PASS_MAX_DAYS99999 // defines the maximum number of valid days for a password, in the fifth segment of/etc/shadow

PASS_MIN_DAYS0 // The minimum valid days for the password is 0, and the fourth segment of/etc/shadow

PASS_MIN_LEN5 // The minimum password length is 5, which does not work here. It is specified by other files.

PASS_WARN_AGE7 // number of warning days after the password expires

Start value of UID_MIN500 // UID, the third segment in/etc/passwd

UID_MAX60000 // The maximum value of UID, the third segment in/etc/passwd

Start value of GID_MIN500 // GID, fourth segment in/etc/passwd

GID_MAX60000 // maximum value of GID, fourth segment in/etc/passwd

CREATE_HOMEyes // whether to create the Home Directory

UMASK077 // The umask value is 077.

USERGROUPS_ENAByes //

MD5_CRYPT_ENAByes // use MD5 encryption for the password

ENCRYPT_METHODMD5 //

[Root @ localhost ~] # Cat/etc/default/useradd

# Useradddefaultsfile

GROUP = 100 //

HOME =/home // define the home Directory of the user to be created under/HOME

INACTIVE =-1 // whether to enable this account.-1 indicates yes

EXPIRE = //

SHELL =/bin/bash // specify the shell of the new user as/bin/bash

SKEL =/etc/skel // The template for creating a user's home directory is/etc/skel

CREATE_MAIL_SPOOL = yes // whether to create a user's email file

[Root @ localhost ~] # Ll-a/etc/skel // when creating a user, the content in the home directory is to copy the skel, put it in the/home directory and change it to the new user name.

Total 64

Drwxr-xr-x3rootroot40962013-07-10.

Drwxr-xr-x97rootroot1228802-1816: 24 ..

-Rw-r -- 1rootroot332011-05-13.bash_logout

-Rw-r -- 1rootroot1762011-05-13.bash_profile

-Rw-r -- 1rootroot1242011-05-13.bashrc

-Rw-r -- 1rootroot5152011-04-07.emacs

Drwxr-xr-x4rootroot40962012-11-16.mozilla

3. Global configuration file ~ /. Bash_profile ,~ /. Bashrc and ~ /. Bash_logout

Note: You can use ls-a in the user's home directory for viewing.

~ /. Bash_profile: run each time you log on

~ /. Bashrc: execute each time you enter the new Bash Environment

~ /. Bash_logout

4. view the user group information:/etc/group and/etc/gpasswd

/Etc/group view User group Information

[Root @ localhost ~] # Cat/etc/group | tail-1

User: x: 1204: user01, user2

Section 1: group name

Section 2: Password placeholder

Section 3: GID

Section 4: group members (use gpasswd-a to add, gpasswd-d to delete, and gpasswd-M to overwrite multiple members)

[Root @ localhost ~] # Cat/etc/gshadow | tail-1

User: $1 $ u/W2qj. L $ W8GJY5HxyLzphdtgLKpxW0: stu02: user01, user2

Section 1: group name

Section 2: Password (set using gpasswd)

Section 3: Group Administrator (specified by gpasswd-)

Section 4: group members

Summary:

The learning time is not too short. I always want to find a time to take a good note of the user group chapter. Now, I have finished it. Haha

The management of users and user groups this chapter is very round-wound, understanding is also easy, the command is not much, but a lot of options, a question may have several good practices, such as usermod-a-gtechuser01 and gpasswd-auser01tech, although it is all about adding user01 users to the tech group, there are still some differences!