Linux (4)-details on user management

User Management-there are a lot of things to learn about user information and password configuration file user management. Of course, there will be no simple introduction of two User Creation commands. There are too many such articles.
Let's take a look at the important configuration files in two user management processes! Let's see where your configuration files are stored. User information file:/etc/passwd Password File:/etc/shadow user group file:/etc/group user group password file:/etc/gshadow user configuration file: www.2cto.com/etc/login. defs/etc/default/useradd new user information file:/etc/skel logon information: /etc/motd ============================ detailed description of the user information file ========== ====================================================== let's take a look at the user what is stored in the information file [root @ localhost ~] # Vi/etc/passwdroot: x: 0: 0: root:/bin/bashdaemon: x: 2: 2: daemon:/sbin/nologinadm: x: 3: 4: adm:/var/adm:/sbin/nologinlp: x: 4: 7: lp:/var/spool/lpd:/sbin/nologinsync: x: 5: 0: sync:/sbin:/bin/syncshutdown: x: 6: 0: shutdown:/sbin/shutdownhalt: x: 7: 0: halt: /sbin:/sbin/haltmail: x: 8: 12: mail:/var/spool/mail:/sbin/nologinnews: x: 9: 13: news: /etc/news:/sbin/nologin ........ each row contains one user's information. each user's information consists of seven parts: root: x: 0: 0: Root:/root: /bin/bashroot username used by the user to log on to the system x Password bit 2 UID user identification number 2 GID default group identity root annotation description such as storing the user's full name and other information/root directory the default directory/bin/bash command interpreter used by the user after logging on to the system, the default value is bash UID? The UID above is detailed here. In fact, it determines the user's permissions, which is determined by the UID number. Linux users include: (root UID = 0) normal users: (UID 500 ~ 60000) pseudo-user: (UID 1 ~ 499) so we can modify the user's UID number to modify the user type. If the root UID number is 500, then the root user is changed to a normal user, if you change the UID of the fnngj user to 0, it has the super power of the root user. Www.2cto.com [root @ localhost ~] # After Entering vi/etc/passwd, modify it. After saving and exiting, it will be OK. Pseudo-user? What is the use of a pseudo-user when it comes to user types? 1. pseudo users are bin, daemon, shutdown, and halt related to systems and program services. By default, any Linux system has these pseudo users. Mail, news, games, apache, ftp, mysql, and sshd are related to processes in linux. 2. pseudo users do not need to or cannot log on to the system. there can be no home directory ============================ password file DETAILS ======== =================================== user password file, why is there no password in the user information file?
In fact, the oldest linux location is actually password-based. Because it is not completely secure, the password is stored separately,
Now we only use x to indicate that the password is stored here. Why do I need to put the password in/etc/shadow [root @ bogon/] # ls-l/etc/shadow-r -------- 1 root 1021 February 27 21:31/etc/shadow I can see only the administrator root has the permission to view and modify this file. Now let's see what is stored in the password file? [Root @ bogon/] # more/etc/shadowroot: $1 $5DlBd7m8 $ tF. az6hWi27oaaFw7OpFs.: 15391: 0: 99999: 7: bin: *: 15391: 0: 99999: 7: daemon: *: 15391: 0: 99999: 7 ::: adm: *: 15391: 0: 99999: 7: lp: *: 15391: 0: 99999: 7: sync: *: 15391: 0: 99999: 7:: shutdown: *: 15391: 0: 99999: 7: halt: *: 15391: 0: 99999: 7: mail: *: 15391: 0: 99999: 7: news: *: 15391: 0: 99999: 7: uucp: *: 15391: 0: 99999: 7: operator: *: 15391: 0: 99999: 7: games: *: 15391: 0: 99999: 7 :::.... .............................. We also break down the first behavior example. Root: $1 $5DlBd7m8 $ tF. az6hWi27oaaFw7OpFs.: 15391: 0: 99999: 7: root User Name $1 $5DlBd7m8 $ tF. az6hWi27oaaFw7OpFs. password Encryption password MD515391 last modification time linux here as January 1, 1970 January 1 is 366, and so on, I changed the password to 15391. 0 minimum interval this field indicates how long it will take to change the password. The password of the "0" table can be changed at any time. The maximum interval of 99999 is to prevent the password from being stolen and endanger the security of the entire system. Therefore, you have to change the password within this period, otherwise, the account will be temporarily invalid. The above 99999 indicates that the password does not need to be re-entered. It is best to set a period of time to change the password. Ensure system security 7. The password change period is approaching the warning period: When the password expiration period of the account is approaching, the system issues a warning based on the setting of this field, remind the user that "your password will expire in n days. Please reset the password as soon as possible. The default value is seven days. Account expiration time: if the user does not re-enter the password after the warning period, the password becomes invalid, and the user does not report it to the Administrator within the time limit of this field, so that the account is re-enabled, this account will be temporarily invalid. Account cancellation Date: This date is the same as the third field. It uses the date setting method since January 1, 1970. This field indicates that this account cannot be used after the date specified in this field. This field is usually used in the toll service system. You can specify a date so that the account cannot be used again. Retained: The last field is retained to check whether new features are added in the future. Q: Since the shadow file saves the password but the passwd file does not save the password, why not cancel the password in the passwd file? In fact, before the password is stored, it is first placed in the passwd file and then converted to the shadow file. Next, let's verify [root @ bogon/] # grep root/etc/passwd/etc/shadow/etc/passwd: root: x: 0: 0: root:/root: /bin/bash/etc/passwd: operator: x: 11: 0: operator:/root:/sbin/nologin/etc/shadow: root: $1 $5DlBd7m8 $ tF. az6hWi27oaaFw7OpFs.: 15391: 0: 99999: 7 ::: [root @ bogon/] # pwunconv write the password back to [root @ bogon/] # grep root/etc/passwd/etc/shadow/etc/passwd: root: $1 $5DlBd7m8 $ tF. az6hWi27oaaFw7OpFs.: 0: 0: root:/bin/bash/etc/passwd: operator: *: 11: 0: operator:/root:/sbin/nologingrep:/etc/shadow: No file or directory [root @ bogon/] # pwconv is converted to the shdow file, in normal times, this action is automatically completed by linux. [Root @ bogon/] # grep root/etc/passwd/etc/shadow/etc/passwd: root: x: 0: 0: root:/root: /bin/bash/etc/passwd: operator: x: 11: 0: operator:/root:/sbin/nologin/etc/shadow: root: $1 $5DlBd7m8 $ tF. az6hWi27oaaFw7OpFs.: 15456: 0: 99999: 7: linux authenticates user logon by verifying the existence of the user name through the passwod file, and then verifies that the password corresponding to the user name is correct through the shadow file, it is necessary to understand the underlying things. We do not need to learn how to create user commands. We can add users to two files by using the vim command. This is the charm of linux. Unlike windows, we know not only its nature, but also its nature. The command "will be possessed by the soul" permission continues the learning of user management. We know in the previous section that only the root user can modify the password file. Why can the common user modify his/her password, this is because the commands we perform have root permissions like "soul attachment. This section is not difficult to understand, but my content is also written along the train of thought, in order, it is best to test it. ^_^ Highlights: ================================ setUID = 4 All People setGID = 2 group sticky position = 1 Others ============================================ create a user: [root @ localhost ~] # Useradd lisi added a user lisi [root @ localhost ~] # Passwd lisi: Set the lisi password Changing password for user wangwu. new UNIX password: enter the password bad password: it is based on a dictionary wordRetype new UNIX password: confirm the PASSWORD passwd: all authentication tokens updated successfully again. the above is not a recommended way to create a user. Any user should belong to a group. Creating such a "personas" is practically meaningless. Www.2cto.com [root @ localhost ~] # Grep lisi/etc/passwdlisi: x: 502: 502:/home/lisi:/bin/bash from the above information, the system creates a lisi group by default. The Group ID is 504. User switchover: [root @ localhost ~] # Su -- lisi root switch to lisi user [lisi @ localhost root] $ su -- root lisi User Switch to rootPassword: It is required for normal users to switch to root users! Dear user! A common user needs a password to switch to another common user! Change password: [lisi @ localhost root] $ passwdChanging password for user lisi. changing password for wangwu (current) UNIX password: Enter the original password New UNIX password: Enter the new password Retype New UNIX password: confirm the new password passwd: all authentication tokens updated successfully again. the above is the foundation, and the following is the focus .. Thinking: in the previous section, we mentioned that only the root user can operate the shadow file that stores the user password. Why can a common user change the password? ====================================== SetUID ==================== ======================= here is a definition of Dongdong ---- setUID: when an executable program has the setUID permission, the user executes the program as the owner of the program. Haha! The wolf cannot talk to the goat, but the goat can talk to the goat. As a result, the Wolf put on the coat of the goat, and then lived happily together with the goat. Roar. In fact, the user executes this program as a command. The passwd command authorizes the SetUID permission. Therefore, common users can use the passwd command to change the password. Let's do a test !! Very interesting. Do you want to try it? Switch to the lisi user. [Lisi @ localhost ~] $ Touch file01 touch creates a file01 file [lisi @ localhost ~] $ Ls-l file01 www.2cto.com-rw-r -- 1 lisi 0 May 5 22:14 file01 we can see that the file created with the touch command is lisi, the Group belongs to the lisi group and switches to the root [root @ localhost ~] # Ls-l/bin/touch-rwxr-xr-x 1 root 38056/bin/touch careful friends will find that there is another one before the permission. That's right! SetUID belongs to this bit. SetUID = 4 now we can grant the setUID permission to the touch command in two ways. [Root @ localhost ~] # Chmod u + s/bin/touch [root @ localhost ~] # Chmod 4755/bin/touch read my previous articles about the incomprehensible user permissions. Switch to the [lisi @ localhost ~] Directory again $ Touch file02 Create File file02 [lisi @ localhost ~] $ Ls-l file02-rw-rw-r -- 1 root lisi 0 May 5 22:35 file02 this time we found that the same command touch, this time the created file owner changed to the root remove setUID permission in two ways: [root @ localhost ~] # Chmod u-s/bin/touch [root @ localhost ~] # Chmod 755/bin/touch ======================== setGID ======== ======================================== setGID is used together with setUID, it adds group permissions. SetGID = 2 add setGID as follows: [root @ localhost ~] # Chmod g + s/bin/touch [root @ localhost ~] # For General chmod 2755/bin/touch commands, we cannot grant the setUID permission at will. If we grant the setUID command to vi commands, we will undoubtedly leave a post for linux, then we can use the vi command to modify the user and password information file. So which commands are set with setUID? We can look for it. [Root @ localhost ~] # Find/-perm-4000-o-perm-2000 find the setUID (-perm-4000) or (-o) in the current directory) with setGID (-perm-2000) permission command www.2cto.com ================================== ======================================= what is the role of the adhesion position, let's look at an example to make it easier to understand .. [Root @ localhost test] # mkdir abc create a directory abc [root @ localhost test] # touch abc/newfile create a file newfile [root @ localhost test] # chmod 777 abc sets permissions for this directory to all users with all permissions [root @ localhost test] # ls-ld abcdrwxrwxrwx 2 root 4096 May 5 23:44 abc [root @ localhost test] # ls- l abc/newfile has the permission that others do not have to delete or modify. -Rw-r -- 1 root 0 May 5 23:44 abc/newfile switched to lisi user [lisi @ localhost test] $ rm-rf abc and killed newfile In the abc directory., the lisi user has all permissions on the abc directory, but has no permission to delete the newfile file. This is linux's File Permission provision. Assume that both Zhang San and Li Si have ownership of a folder, and there are also Li Si's files under this folder. If Zhang San is unhappy with Li Si's files, then he got rid of it, and Li Si went up and cried. Why is it possible to stop Li Si from crying? Here, the adhesive bit is used. The adhesion bit is 1 Tb. If a permission is set to 777 and the directory has a adhesion bit, each user can create a file in this directory, but can only Delete Files Owned by the user. [Root @ localhost test] # chmod o + t abc [root @ localhost test] # chmod 1755 abc Let's delete it again: [lisi @ localhost abc] $ rm newfilerm: Do you want to delete a write-protected General empty file 'newfile '? Yrm: The 'newfile' cannot be deleted. You can delete files created by yourself if you have insufficient permissions! [Root @ localhost test] # touch newfile2 [root @ localhost test] # rm newfile2 rm: Do you want to delete the 'newfile2' normal empty file '? Y author