User Management and special permissions in Linux

User Management in Linux
Linux has three types of users
A. Super User: root has all permissions for the operating system. UID is 0.
B. Common users: Non-administrator users with limited permissions. UID: 500-6000
C. Pseudo-user: facilitates system management and meets the requirements of the owner of the corresponding system process file. The pseudo-user cannot log on to the system, UID: 1-499
Manage users through the/etc/passwd file. Only accounts and passwords are defined.
Passwd:
One account per line, with seven parts separated by semicolons
User name: Password (x, indicating a password): UID: GID: User information:/home/(user's home directory):/bin/bash (User Login environment)
Shadow:
User name: Password: last password modification time: maximum interval: minimum interval: warning time: inactive time: expiration time
Password: the first character is "!" Indicates that the user cannot log on
Password time: in seconds
Maximum time interval: Password Change frequency. 0 indicates that the password can be changed at any time.
Minimum Time Interval: the password must be changed within the minimum time. "99999" indicates that the password will never expire.
Warning time: prompt to change the password before expiration
No activity time: extended time
Expiration time: Validity Period

Create an account:
Principle (manual addition instead of using the useradd command ):
1. Add a record to/etc/passwd
2. Create the user's home directory and permissions
3. Set the default configuration file in the user's home directory
4. Set the user's initial password
Command: useradd or adduser
Useradd username [-u uid] [-g gruop] [-s/bin/sh |/sbin/nologin] [-d/home/username]...
Passwd username
Userdel [-r] username (delete user,-r indicates Delete home directory)
Usermod-l new_username old_username (do not change the Home Directory)
Usermod-L username (User locked)
Usermod-U username (unlock user)
Deprecated account: Comment the row of the user in/etc/passwd, that is, add "#". The class is deleted, but the user information is not deleted. This is the difference.
Passwd-S username Lock password
Passwd-U username unlock Password
/Etc/skel if the directory contains files, the contents of this folder will be in the user's home directory when the directory is created, which is equivalent to a template.
 
User Group Management
A. Private Group: if you do not specify A group when creating A user, A new group with the same user name will be created.
B. Standard Rent: You can accommodate multiple users. If you use a standard group to create a user, you should specify the group to which the user belongs.
Configuration file:
/Etc/group
Group_name: x: GID: username_list (separated by commas)
Group password (x) is generally not used
Groupadd group_name
Groupmod-n new_name old_name
The group account deleted by groupdel group_name must exist and cannot be a private group.
Gpasswd-a username group_name add existing users to the group
Gpasswd-d username group_name
Groups username: view the group of a user
Id [opition] username to view UID and GID Information
Finger [opition] username to view user information, including the Home Directory, startup Shell, and user name
 
 
Special Linux Permissions
 
Special Permission s
SetUID
When a command has the SetUID permission, when a common user executes this command, it will be executed as the command owner ,,
Ll/etc/passwd/etc/shadow
-Rw-r -- rxx 1 root 1795 Sep 25 :12/etc/passwd
-R -------- 1 root 1239 Sep 25/etc/shadow (storage password)
Ll/usr/bin/passwd
-Rwsr-xr-x 1 root 11960 Jul 17 2006/urs/bin/passwd
This is why ordinary users can change their passwords!

Special permission: sticky t
Adhesion bit definition: When a directory with a permission of 777 is granted a adhesion bit, each user can only Delete Files Owned by himself in this directory.
For example:
Ll/tmp
Drwxrwxrwt 8 root 4096 Sep 25 09:55/tmp

Special Permission chattr
The Administrator cannot delete files.
Add permission: chattr + I file name (the File Permission does not seem to change after execution)
I. cannot be modified or deleted.
A can only append (such as log files)
There are also some other permissions, a total of 11!
View this special permission: lsattr filename
 
User permission assignment
Configure sudo
Edit: External do (VI cannot be used for editing)
Username Host Name (IP) = command 1, command 2, command 3 ,... (Absolute path)
Run, then
Sodu Authorization password
The system will prompt the password and enter the authorization password instead of the root password.
Query sudo-l
Case: authorize zhangsan to manage Apche
Install it as the source code version. Installation Directory:/apache
Mongodo
Zhangsan localhost. locadomain =/apche/bin/httpd,/bin/vi/apache/conf/httpd. conf
 
Linux complex permission control: ACL
Responsible for permission Allocation Management
For partitions
Mount-o remount, acl/home, or modify the configuration file/etc/fstab, added to ults, acl
Settings:
Setfacl-m u: username: rwx filename
Getfcal/filename
Author: "Xiao K Studio"