Linux is a multi-user multi-task time-sharing operating system. any user who wants to use system resources must first apply for an account from the system administrator and then enter the system as the account. User Accounts can help system administrators track users who use the system and control their access to system resources. They can also help users organize files and provide security protection for users. The user name refers to the account assigned by the system to an individual to log on to the system, and the group refers to a set of users with similar functions and permissions. Linux uses these two levels of system user management to assign different permissions to groups and users to complete system security management. Linux users are generally divided into three categories: Super Users, common users, and virtual users. After you enter the correct user name and password during logon, you can access the system and your home directory. To manage user accounts, you must add, delete, and modify user accounts, manage user passwords, and manage user groups.
I. User Account Management in Linux
The management of user accounts mainly involves adding, modifying, and deleting user accounts.
To add a user account is to create a new account in the system, and allocate resources such as user numbers, user groups, home directories, and logon shells to the new account. The newly added account is locked and cannot be used.
1
, Account add-useraddCommand Format: useradd <option> usernameoption:-C comment specifies an annotation description. -D directory specifies the user's main directory. If this directory does not exist, you can use the-M option to create a main directory. If this option is not specified, the directory with the same name as username is automatically generated in the home directory. -G User Group specifies the user group to which the user belongs. -G User Group specifies the additional group to which the user belongs. You can specify that a user belongs to several additional groups. The group names are separated by commas. The-s shell file specifies the user's logon shell. -U user number specifies the user number of a user. If the-O option is available at the same time, the user ID of another user can be used again. Username specifies the login name of the new account. Example: # useradd-S/bin/sh-G group-g adm, root gem
This command creates a new user gem. the user's logon shell is/bin/sh, which belongs to the group user group and also to the ADM and root user groups. The group user group is the main group. Note: If the specified group does not exist, an error is returned. Here, Linux provides the integrated system management tool userconf, which can be used to manage user accounts in a unified manner.
2
Delete account-userdelCommand Format: userdel <option> usernameoption:-r Delete the user and delete the user's home directory. In general, when deleting a user, you may need to save useful files for the user. Think twice before using this option.
3
, Account Modification-usermodModifying a user account is to change the user's attributes, such as the user ID, main directory, user group, and logon shell. Command Format: usermod <option> usernameoption: common options include-C,-D,-M,-G,-G,-S,-u, and-o, the meanings of these options are the same as those in the useradd command. You can specify a new resource value for the user. -L the new user name specifies a new account, changing the original user name to the new user name.
4
Password Management-passwdAn important part of user management is the management of user passwords. The user account is locked by the system and cannot be used when it is just created. It can only be used after a password is specified, even if it is null. The shell command used to specify and modify the user password is passwd. Super Users can specify passwords for themselves and other users. Common users can only use them to modify their own passwords. Command Format: passwd <option> usernameoption:-L.
-U password unlock.
-D indicates that the account has no password.
-F forces the user to change the password upon next login.
If the default user name is used, modify the password of the current user. When a common user modifies his or her own password, the passwd command First asks for the original password and then asks the user to enter the new password twice. If the two passwords are the same, the original password is not required when the superuser specifies a password for the user.
2. User Group Management in Linux
Each user has a user group. The system can centrally manage all users in a user group. Different Linux systems have different user groups. For example, a user in Linux belongs to a user group with the same name as a user group, which is created at the same time.
User Group management involves adding, deleting, and modifying user groups.
1
, User group add-groupaddCommand Format: groupadd <option> usergrpoption:-g gid specifies the group ID (GID) of the new user group ).
-O is generally used together with the-G option, indicating that the GID of the new user group can be the same as the GID of the existing user group in the system.
2
Delete a user group-groupdelCommand Format: groupdel usergrp
3
, User group properties-groupmod commandCommand Format: groupmod <option> usergrpoption:-g gid specifies a new group ID for the user group. -O and-G options are used at the same time. The new gid of a user group can be the same as the GID of an existing user group in the system. -N new user group: Change the user group name to a new name.
4
Switch user groups-newgrpIf a user belongs to multiple user groups at the same time, you can switch between user groups to have permissions for other user groups. After logging on, you can use the newgrp command to switch to another user group. The parameter of this command is the target user group. For example, the newgrp root command switches the current user to the root user group. The prerequisite for this command is that the root user group is indeed the main group or additional group of the user.
3. system files related to user accounts
There are many methods to complete user management, but each method is actually to modify the relevant system files. Information related to users and user groups is stored in some system files, including/etc/passwd,/etc/shadow and/etc/group. The following describes the content of these files.
1
,/Etc/passwdThis file is the most important file involved in user management. In Linux, each user has a corresponding record row in the/etc/passwd file, which records some basic attributes of this user. This file is readable to all users. Its content is similar to the following example: # Cat/etc/passwd
Root: X: 0: 0: superuser :/:
Daemon: X: 1: 1: System daemons:/etc:
Bin: X: 2: 2: Owner of system commands:/bin:
SYS: X: 3: 3: Owner of system files:/usr/sys:
ADM: X: 4: 4: System Accounting:/usr/ADM:
Uucp: X: 5: 5: uucp administrator:/usr/lib/uuucp:
Auth: X: 7: 21: authentication administrator:/TCB/files/auth:
Cron: X: 9: 16: Cron Daemon:/usr/spool/cron:
Listen: X: 37: 4: network daemon:/usr/NET/NLS:
LP: X: 71: 18: printer administrator:/usr/spool/LP:
SAM: X: 200: 50: Sam san:/usr/SAM:/bin/sh
From the above example, we can see that a row of records in/etc/passwd corresponds to a user, and each row of records is separated by a colon (:) into seven fields. Its format and meaning are as follows: user name: Password: User ID: Group ID: annotation Description: main directory: logon Shell
1) "User Name" is a string representing the user account.Generally, it cannot exceed 8 characters and may consist of uppercase/lowercase letters and/or numbers. The login name cannot contain a colon (:), because the colon is a separator here. For the sake of compatibility, it is recommended that the login name do not contain periods (.), and do not use hyphens (-) or plus signs (+) to start.
2
) "Password" in some systems, stores encrypted user passwords. Although this field only stores the encrypted string of the user's password, it is still a security risk because the/etc/passwd file can be read by all users. Therefore, many Linux systems (such as svr4) now use the Shadow technology to store the encrypted user password in the/etc/shadow file, in the/etc/passwd file, only one special character is stored in the password field, for example, "x" or "*".
3) The "User ID" is an integer used internally to identify users.Generally, it corresponds to the user name one by one. If several user names correspond to the same user ID, the system regards them as the same user, but they can have different passwords, different home directories, and different logon shells.
Generally, the user ID number ranges from 0 ~ 65 535. 0 is the identification number of the Super User Root, 1 ~ 99 is retained by the system and used as the management account. The identification number of a common user starts from 100. In Linux, this limit is 500.
4) the "Group ID" field records the user's user group.It corresponds to a record in the/etc/group file.
5) The "annotation description" field records users' personal information.Such as your real name, phone number, and address. In different Linux systems, the format of this field is not uniform. In many Linux systems, this field stores any comments of the description text and is used as the output of the finger command.
6) "main directory", that is, the user's initial working directoryIt is the directory in which the user logs on to the system. In most systems, the main directories of users are organized in the same specific directory, and the name of the main directories is the user's login name. Each user has the read, write, and execute (Search) permissions on his/her home directory. Other users have the permission to access this directory based on the actual situation.
7) after a user logs on, a process is started to pass user operations to the kernel. This process is a command interpreter or a specific program that the user logs on to the system and runs, that is, Shell.Shell is the interface between users and Linux systems. The system administrator can specify a shell for the user based on the system conditions and user habits. The user's logon shell can also be specified as a specific program (this program is not a command interpreter ). With this feature, we can restrict the user to run only the specified application. After the application is running, the user automatically exits the system.
(8) one type of users in the system is called psuedo users ),These users also have a record in the/etc/passwd file, but cannot log on because their logon shell is empty. They are mainly used to facilitate system management and meet the file owner requirements of the corresponding system processes. Common pseudo-users are as follows. Bin has executable USER command file ADM has account file
Uucp
LP or lpd subsystem usage
Nobody NFS usage
Owned account file
In addition to the pseudo applications listed above, there are also many standard pseudo users, such as audit, Cron, mail, and USENET, which are also required by related processes and files.
Since the/etc/passwd file can be read by all users, if the user's password is too simple or regular, a common computer can easily crack it, therefore, Linux systems with high security requirements separate encrypted passwords and store them separately in a file. The file is a/etc/shadow file. Only a Super User has the permission to read the file, which ensures the security of the user's password.
2
,/Etc/shadow fileThe record lines in this file correspond one to one with those in/etc/passwd. It is automatically generated by the pwconv command based on the data in/etc/passwd. Its file format is similar to/etc/passwd and consists of several fields separated. These fields are: Login Name: encrypted password: last modification time: minimum interval: maximum interval: warning time: inactive time: expiration time: Flag
1) The "Login Name" is the same as the login name in the/etc/passwd file.
2) The "password" field stores the encrypted user password, with a length of 13 characters. If it is blank, the corresponding user has no password and no password is required for Logon. If it contains characters not in the {./0-9a-za-z} collection, the corresponding user cannot log on. 3) "last modification time" indicates the number of days from a certain time point to the last password change. The start time may be different for different systems. For example, in SCO Linux, the start time is January 1, January 1, 1970. 4) "minimum interval" refers to the minimum number of days required between two password changes.
5) The "maximum interval" indicates the maximum number of days for password persistence.
6) The "warning time" field indicates the number of days from when the system starts to warn the user to when the user password is officially invalid.
7) "No activity time" indicates the maximum number of days that the user has not logged on to the activity but the account remains valid.
8) the "expiration time" field shows an absolute number of days. If this field is used, the validity period of the corresponding account is given. After expiration, this account is no longer a legal account and cannot be used for logon. For example, root: DNA kfw28zf38w: 8764: 0: 168: 7 :::
3
,/Etc/groupAll user group information is stored in the/etc/group file. Grouping users is a way to manage users and control access permissions in Linux. Each user belongs to a user group. A group can contain multiple users, and a user can belong to different groups. When a user is a member of multiple groups at the same time, the main group to which the user belongs is recorded in the/etc/passwd file, that is, the default group to which the user belongs during logon, other groups are called additional groups. To access files in an additional group, you must first use the newgrp command to make yourself a member of the group to be accessed. All user group information is stored in the/etc/group file. The format of this file is also similar to the/etc/passwd file. Several fields are separated by a colon (:). These fields include: group name: Password: Group ID number: group user list
1) "group name" is the name of the user group, which consists of letters or numbers. Same as the login name in/etc/passwd, the group name should not be repeated. 2) The "password" field stores the encrypted password of the user group. Generally, users in Linux do not have a password, that is, this field is generally blank, or *. 3) the "Group ID" is similar to the user ID and is also an integer used internally to identify the group. 4) The "group user list" is a list of all users in this group/B]. Different users are separated by commas. This user group may be the user's primary group or an additional group.
Iv. Add User batchAdding and Deleting Users is a breeze for every Linux system administrator. the tricky thing is that if you want to add dozens, hundreds, or even thousands of users, we are unlikely to add useradd one by one, so we must find a simple method to create a large number of users. The Linux system provides a tool to create a large number of users, allowing you to create a large number of users immediately, as follows: (1) edit a text user file first, each column is written in the format of the/etc/passwd password file. Note that the user name, uid, and home directory of each user cannot be the same, the password column can be left blank or enter the X number. The content of user.txt in a sample file is as follows: user001: 600: 100: User:/home/user001:/bin/bash
User002: 601: 100: User:/home/user002:/bin/bash (2) run the command "/usr/sbin/newusers" as root" to import data from user.txt, and create a user: # newusers <user.txt can then run The vipw or VI/etc/passwd command to check whether the data of these users has been displayed in the/etc/passwd file and whether the user's home directory has been created. (3) run the/usr/sbin/pwunconv command to decode the shadow password generated by/etc/shadow and write it back to/etc/passwd, delete the shadow password column of/etc/shadow. This is to facilitate the next step in password conversion, that is, to cancel the shadow password function first. # Pwunconv(4)edit the password reference file for each user. The content of the example file passwd.txt is as follows: user001: Password
User002: Password
(5) run the command/usr/sbin/chpasswd as root to create the user password, chpasswd writes the password encoded by the/usr/bin/passwd command to the/etc/passwd password column. # Chpasswd <passwd.txt (6) after you confirm that the password is encoded into the/etc/passwd password column, run the/usr/sbin/pwconv command to encode the password as shadow password, write the result to/etc/shadow. # Pwconv
In this way, a large number of users are created. Then, you can go to/home to check whether the permission settings of these users in the home directory are correct, and log on to verify that the user password is correct.
5. grant special permissions to common users
In Linux, there are usually more than one administrator. If each administrator uses the root identity for management, it is impossible to figure out who should do what. The best way is to create some common users and assign some system management work to them. We cannot use Su to make them directly root, because these users must know the root password. This method is not safe and does not meet our division of labor needs. The general practice is to use permission settings to classify users with special identities into the same working group and set the permissions of the Working Group. For example, the user wwwadm is required to manage website data. Generally, the httpd owner of the Apache Web server process is www. You can set wwwadm as the same working group as www, set the working group permissions for Apache to store the web directory/usr/local/httpd/htdocs by default to readable, writable, and executable, in this way, every user in this Working Group can manage webpages.
However, this is not the best solution. For example, if the administrator wants to grant the shutdown permission to an ordinary user, the above method is not ideal. You may think that I only want this user to execute the shutdown command as root. It's totally correct. Unfortunately, this feature cannot be implemented in common Linux systems, but sudo is already available in tools. Sudo assigns privileges to different users by maintaining a database mapped to the user name. These privileges can be identified by different commands listed in the database. To obtain a specific permission, qualified users simply enter the sudo and command name on the command line and enter the password again as prompted (the user's own password, not the root user password ). For example, sudo allows a common user to format a disk, but does not grant other root user privileges. 1. The sudo tool is configured by the file/etc/sudoers, which contains a list of all users who can access the sudo tool and defines their privileges. A typical/etc/sudoers entry is as follows: liming all = (all) All enables the user Liming to access all applications as a Super User. For example, the user liming needs to run commands as a Super User, he simply adds the prefix sudo to the command. Therefore, to run the format command as the root user, liming can enter the following command: # sudo/usr/sbin/useradd Sam
Note: The command must write an absolute path./usr/sbin is not in the search path of a common user by default, or add the path: Path = $ path:/usr/sbin; export path. In addition, different system commands have different paths. You can use the command "whereis command name" to find the path. The following output result is displayed: We trust you have stored ed the usual lecture from the local system
Administrator. It usually boils down to these two things:
#1) respect the privacy of others.
#2) Think before you type.
Password: If liming correctly enters the password, the command useradd will be executed as the root user.
Note: The configuration file/etc/sudoers must be edited using the cmddo command.
You only need to add the user name, host name, and license command list to the file/etc/sudoers in the standard format, and save the list to take effect. Let's look at another example.
For example:The administrator needs to allow the gem user to execute the reboot and shutdown commands on the host sun, and add: Gem sun =/usr/sbin/reboot,/usr/sbin/shutdown to/etc/sudoers.
Note: the absolute path must be used for commands to prevent commands of the same name in other directories from being executed, resulting in security risks. Save and exit. When you want to execute the reboot command, you only need to run the following command at the prompt: $ sudo/usr/sbin/reboot
Enter the correct password to restart the server.
If you want to define a group of users, you can add % before the group name and set it, for example, % cuug all = (all) All
2
,You can also use aliases to simplify the configuration file. Aliases are similar to group concepts, including user aliases, host aliases, and command aliases. Multiple users can define them with an alias first, and then use the alias when specifying what commands they can execute. This configuration takes effect for all users. The same is true for host aliases and command aliases. Note that before use, define the user_alias, host_alias, and cmnd_alias items in/etc/sudoers. Add the corresponding names after them and separate them by commas. For example: host_alias Server = No1
User_alias admins = liming, Gem
Cmnd_alias shutdown =/usr/sbin/halt,/usr/sbin/shutdown,/usr/sbin/reboot
Admins Server = Shutdown
For example:Admins all = (all) nopasswd: All indicates that admins is allowed to perform all operations without a password. The "nopasswd:" item defines that the user does not need to enter a password when performing the operation.
3
Sudo Command ParametersSudo <option> Option:-l check which commands can be run in Sudo-V to display the version number.
-H: displays the parameters used by The sudo command.
-V will ask for the password because sudo is not executed during the first execution or within n minutes (N is set to 5 by default. This parameter is re-confirmed. If it is more than n minutes, you will also ask the password. -K will force the user to ask for the password (whether or not it has been more than n minutes) during the next sudo execution ).
-B: Execute the command in the background.
-P prompt can change the password prompt, where % u is replaced with the user's account name, and % H displays the host name. -U username/# this parameter is not added to the UID, which indicates that the command is to be executed as root, but this parameter is added, you can run commands as username (# uid of username ).
-S executes the shell specified by the shell in the environment variable, or the shell specified in/etc/passwd.
-H: Specify the home directory in the environment variable as the Home Directory of the user who wants to change the identity. (If the-u parameter is not added, the system administrator root is used.
