Linux User Management

Linux System User Management

System users

The system users defined by the encyclopedia are: "Customers" who use information systems in their usual sense or are affected by information systems

Popular speaking is the person or "customer" who can use and manage system resources and reach a specific goal.

User Category

System administrator

Normal User

System users

Logged in user

User ID

Uid:linux to differentiate and identify users by UID

Range of UID values according to user classification: 0-65535

System administrator: 0

Normal Users: 1-60000

System User: 1-499,1-999

Login User: 500+,1000+

User groups

Users with the same permissions or user attributes are divided into one class, expressed in groups

User Group classification

Administrators group

Normal Group

User Base Group

User Attach Group

User Group ID

Gid:linux to differentiate and identify user groups through GID

Administrators group: 0

Normal Group: 1-499,1-999

500+,1000+

Note: After the CentOS version from 6 to 7, the default user-created new user ID changed from 500 to starting from 1000

Linux System user-related configuration files

/etc/passwd; Record user's basic information

/etc/group: Record user group basic information

/etc/shadow: Record user password and related information

/etc/gshadow: Record user group password and related information

Default format for each profile:

/etc/passwd;

Name:password:UID:GID:GECOS:directory:shell

Login name: x:uid:gid:comment: Home directory: User default Shell

/etc/group:

Group_name:password:GID:user_list

Group name: x:gid: Group user list

/etc/shadow:

Login name:encrypted password:date of last password change:minimum password age:maximum password Age:password warning Peri Od:password Inactivity Period:account Expiration date:reserved field

User name: Password encryption string: Password Last modified: password minimum expiration: Password expiration period: Password expiry warning period: Password lockout period: Account expiration Date: Reserved field

Example: root:$6$amdz6oa3a.cbr7ug$l1rtcnnacewa5vfa263r9ncfpwzgtjl9x4nq0dncx25wmqdxwapwi7uwtgvo0/ Wau1gexrirvv7wchl8ffhss0:16673:0:99999:7:::

Note: password-encrypted strings are separated by $, divided into three parts

1, encryption algorithm, 6 means SHA512 encryption algorithm

2. Random string

3. Passwords and random strings combined with encrypted strings

Encryption algorithm:

MD5,SHA1, sha224, sha256, sha384, sha512

MD5: With the number 1 identification, according to the fixed algorithm to convert the set password string, if two users set the same password, in the shadow file two users of the encrypted password string is the same. It's a risk point.

SHA512: With the number 6 identification, the user set the password string by the algorithm to add a part of the random string, and then by the fixed encryption algorithm to convert the password to encrypt the string, to minimize the risk of MD5 algorithm

Note: Two or more cryptographic algorithms can be used in combination

Command:

#authconfig--test|grep hashing Password hashing algorithm is sha512

Password Complexity policy:

1, use number, lowercase letters, uppercase, special characters, at least three classes in four categories;

2, long enough;

3, the use of random password;

4. Regular replacement

/etc/gshadow:

Group Name:encrypted Password:administrators:members

Group Name: Encrypted string: Group management: Group members

Command

1. Useradd: Add user

useradd [Options] LOGIN

-C,--comment Comment: User description

-D,--home-dir home_dir: Specify User home directory path

-E,--expiredate expire_date: Specify user lifetime; format yyyy-mm-dd

-G,--gid Group: Specifies the base group to which the user belongs, which must exist beforehand

-G,--groups group1[,group2,... [, GROUPN]] : Specifies the additional group to which it belongs;

-K,--key Key=value: Specifies the value of the parameter in the configuration file/etc/login.defs

-M,--create-home: Create user home Directory

-M,--no-create-home: Do not create home directories for users

-P,--password password: Set user password at creation time

-R,--system: Creating a System User

-S,--shell Shell: Set user default Shell;cat/etc/shells view settable shell types

-U,--uid uid: Specify user UID

Exercise: Create user Oracle, belong to additional group database and Sql,id number 3000, home directory is/home/database, password is 1q2w3e, and specify user's shell as bash;

#groupadd database #groupadd SQL #useradd-G database,sql-u 3000-d/home/database-p 1q2w3e-s/bin/bash Oracle

Result: the password for Oracle in the shadow file is the plaintext password, not the encrypted string?

#passwd Oracle

After re-resetting the Oracle password with the passwd command, the Oracle user password in the shadow file is the encrypted string

This article is from the "Start Again" blog, please be sure to keep this source http://4708705.blog.51cto.com/4698705/1688613

Linux User Management