Users and Permissions in Linux

Linux is a multi-user multi-process operating system, in order to achieve the effective management and configuration of resources in the system, the use of the login account and the corresponding account permissions to restrict the users of each landing system.

Users login to the Linux system, the user will be authenticated (authentication), through the system account and password to achieve. When the user logs in successfully, it will be authorized by users according to the previously set account permissions, which specifies which resources (authorization) They can access and use. At the same time, in order to prevent the logged-in user malicious on the system operation, affect the interests of other users, but also the use of all logged users to monitor the behavior (audition).

Linux can set different permissions for all users in the system, but when there are too many users on the system, one operation is obviously a hassle. We can add multiple users to a user group and set permissions on the user group uniformly to authorize each user in the group.

But the above is a logical, human understanding of the information, but the computer itself is unable to understand the user name, the user name for it is only a string. How do I make a computer differentiate between users of different names? In this case, to refer to the concept of UID, each user will typically have a unique UID to facilitate the computer to identify the user, and the same computer will use GID to distinguish between different groups.

========================================================================= users can be divided into roughly two categories

Administrator

Ordinary users, and can be divided into two categories of ordinary users

System users

Login User

The UID of the user is represented in the computer with a 16-bit (bit) binary, where the UID of the administrator is 0, the UID of the system user is in Red Hat 6,CENTOS6 Upper 1~499, the login user is 500-60000, and the Red Hat 7,centos7 is 1~999 respectively. 1000-60000.

How does the system relate the user name to the UID? is resolved by name resolution library file/etc/passwd

User group classification is more complex, there are usually three ways of grouping

The first: grouping using and user approximation, i.e.

Administrators group

General user groups

System User Group

Login User Group

The second type:

Basic Group of users: Any user must have at least one base group. If the administrator does not specify, the system typically creates a basic group that is the same as the user's name when the user is created.

Additional groups for users: Users can belong to multiple additional groups in addition to the basic group

The third type:

User's private group: The group name is the same as the user name and contains only one user

User's public group: Multiple users are included in the group

The group's indicator GID is also represented by a 16-bit binary number, and the identity range is the same as the user uid, please refer to the above UID's identity range. The name resolution library file for the group is/etc/group.

=============================================================

The password information of the previous user is also stored in plain text in/etc/passwd this file, but this design is not safe, so, now passwd to store the password location only a placeholder "x", and the actual location of the password in/etc/ Shadow, the password file for the group is/etc/gshadow. And, these passwords are one-way encrypted after storage, the problem comes, what is one-way encryption? (You can skip to the next section to continue browsing)

There are usually three kinds of encryption methods commonly used:

Symmetric encryption: Use the same key for encryption and decryption

Asymmetric encryption: Encryption and decryption using a pair of keys, public key and private key

One-way encryption: Use an algorithm to convert a password into a data signature that can only be encrypted and cannot be decrypted.

The following two characteristics of the data signature are:

Fixed-length output: The signature length of the output is consistent regardless of the number of characters in the original file

Avalanche effect: As long as the source files make a small change, the signature will be turned upside down to prevent someone to use the signature changes to scrutinize the source file content.

The common one-way secret Way has MD5 (message digest) algorithm, can output 128-bit signatures, of course, the more the number of signature bits, the more secure the source file, so centOS6 above version has been the default use of the SHA (Secure Hash Algorithm) algorithm, can support up to 512 bits.

=============================================================

Let's take a look at the contents of/etc/passwd this file: Altogether 7 columns separated

The first column is the user name of all users on the current system

The second column is the password placeholder

The third column is the user uid

The fourth column is the GID of the user base Group

The fifth column is the user's comments, comments information

The sixth column is the user's home directory path

The seventh column is the default shell used by the user when logging into the account

Next up is/etc/shadow.

The first column is the user name

The second column is the encrypted signature field

The third column is the number of days that the user last modified the password to today, which is calculated by default starting in 1970.1.1

The fourth column is the minimum user password days: If the number of days is not enough, users can not change their passwords

The fifth column is the maximum number of days that a user's password will be used: The user password can only be used for so many days.

The sixth column is the number of warning days for the user's password: the password expires in the early days of the warning user

Seventh, the user's password inactive days: The password expires after a maximum of a few days, and then will be disabled

Users and permissions in Linux