Linux--GPASSWD

GPASSWD (1) User commands GPASSWD (1)



Name
GPASSWD-Administrators/etc/group and/etc/gshadow

Big
GPASSWD [Options] Group

Stroke
The GPASSWD command is used to Administer/etc/group, And/etc/gshadow. Every group can has administrators, members and a password.

System administrators can use THE-A option to define group administrator (s) and the-m option to define members. They has all rights of
Group administrators and members.

GPASSWD called by a group administrator with a group name is prompts for the new password of the group.

If a password is set the members can still use NEWGRP (1) without a password, and non-members must supply the password.

Please
Group passwords is a inherent security problem since more than one person was permitted to know the password. However, groups is a useful
Tool for permitting co-operation between different users.

Choose
In addition to the-A and-M options, other options cannot be used in conjunction.

The options that GPASSWD can accept are:

*************************************************************************************************************** **************

-R,--remove-password
Remove the password from the named group. The group password would be empty. Only group members would be allowed to use NEWGRP to join the
Named group.
　　　　
-R,--restrict
Restrict the access to the named group. The group password is set to "!". Only group members with a password would be allowed to use
Newgrp to join the named group.

*************************************************************************************************************** **************

-A,--administratorsuser,...
Set up a list of users with administrative privileges.

-M,--membersuser,...
Sets the list of group members.

-A,--adduser
Add user users to groups named group.

-D,--deleteuser
Remove user users from a group named groups.

*************************************************************************************************************** *************

-H,--help
Real-world Help information and exit.

-Q,--rootchroot_dir
Apply changes in the Chroot_dir directory with the configuration files from the Chroot_dir directory.

-a Admin  -a user1 user2    ... -D user1      ... -R     -R Group requires a password to enter the reorganization

Caveats
This tool is operates on The/etc/groupand/etc/gshadow files. Thus You cannot the change of any NIS or LDAP group. This must is performed on
The corresponding server.

With
There are configuration variables in/etc/login.defs that can be used to change the behavior of this tool:

Encrypt_method (String)
This defines the default algorithm for the system encryption password (if the algorithm is not specified on the command line).

The following values can be used: DES (default), MD5, SHA256, SHA512.

Note that this parameter overrides the Md5_crypt_enab variable.

Note: This affects only the generation of the group password. The user password is generated by the PAM and Pam configuration. It is recommended that this variable be set consistent with the PAM configuration.

Max_members_per_group (number)
The maximum number of members for each group entry. When the maximum value is reached, a new entry (line) (with the same name, same password, same GID) starts at/etc/group.

The default value is 0, which means there is no limit on the number of members in the group.

This feature (split group) allows you to limit the length of the group file. This is for ensuring that the NIS group has a longer row than 1024 characters.

If you want to enforce this restriction, you can use 25.
Note: Split groups may not be supported by all tools (even in the Shadow toolset). You should not use this variable unless you really need it.

Md5_crypt_enab (Boolean)
Indicates whether the password must be encrypted using an MD5-based algorithm. If set to Yes, the new password will be used with the newer FreeBSD-compatible MD5-based
Encryption of the algorithm. It supports unlimited lengths of passwords and longer salt strings. If you need to copy the encrypted password to another system that does not understand the new algorithm, set it to No. The default value is No.

This variable was superseded by the Encrypt_method variable or by any command line option used to configure the encryption Algorithm.

This variable is deprecated. You should use Encrypt_method.

Note: This affects only the generation of the group password. The user password is generated by the PAM and Pam configuration. It is recommended that this variable be set consistent with the PAM configuration.

Sha_crypt_min_rounds (number), Sha_crypt_max_rounds (number)
When Encrypt_method is set to SHA256 or SHA512, this determines that the encryption algorithm uses the number of SHA rotations by default (when the number of rotations is not specified by the command line).

Using a lot of rotations can make brute force more difficult. However, it is important to note that more CPU resources are required when authenticating users.
If not specified, LIBC will select the default number of rotations (5000).

The value must be between 1000-999 and 999,999.

This value is used if only one sha_crypt_min_rounds or Sha_crypt_max_rounds value is set.

If Sha_crypt_min_rounds > Sha_crypt_max_rounds, the Big one will be used.

Note: This affects only the generation of the group password. The user password is generated by the PAM and Pam configuration. It is recommended that this variable be set consistent with the PAM configuration.

Text
/etc/group
Group account information.

/etc/gshadow
Security group account information.

Parameter
NEWGRP (1), Groupadd (8), Groupdel (8), Groupmod (8), GRPCK (8), Group (5), Gshadow (5).



Shadow-utils 4.1.5.1 2014-02-17 GPASSWD (1)

Linux--gpasswd