Appendix: Linux User and User Group Management

From: http://bbs.chinaunix.net/viewthread.php? Tid = 438660

Linux is a multi-user multi-task time-sharing operating system. any user who wants to use system resources must first apply for an account from the system administrator and then enter the system as the account. User Accounts can help system administrators track users who use the system and control their access to system resources. They can also help users organize files, and provides security protection for users. Each user account has a unique user name and password. After you enter the correct user name and password during logon, you can access the system and your home directory.

To manage user accounts, you must do the following:
· Add, delete, and modify user accounts.
· User password management.
· User group management.

I. User Account Management in Linux

The management of user accounts mainly involves adding, modifying, and deleting user accounts.

To add a user account is to create a new account in the system, and allocate resources such as user numbers, user groups, home directories, and logon shells to the new account. The newly added account is locked and cannot be used.

1. Add a new user account and use the useradd command. The syntax is as follows:

　　

[Copy to clipboard] [-]

Code:

Useradd option Username

　　The options are described as follows:

[Copy to clipboard] [-]

Code:

-C comment specifies an annotation description.
-D directory specifies the user's main directory. If this directory does not exist, you can use the-M option to create a main directory.
-G User Group specifies the user group to which the user belongs.
-G user group, which specifies the additional group to which the user belongs.
The-s shell file specifies the user's logon shell.
-U user number specifies the user number of a user. If the-O option is available at the same time, the user ID of another user can be used again.

　　User name specifies the login name of the new account.

2. Example

Example 1:

　　

[Copy to clipboard] [-]

Code:

# Useradd-D/usr/SAM-m Sam

This command creates a user sam,
The-D and-m options are used to generate a main directory/usr/Sam for the logon SAM (/usr is the parent directory of the default user main directory ).

　　Example 2:

　　

[Copy to clipboard] [-]

Code:

# Useradd-S/bin/sh-G group-g adm, root gem

This command creates a new user gem. the user's logon shell is/bin/sh, which belongs to the group user group and also to the ADM and root user groups. The group user group is the main group.
A new group may be created here: # groupadd group and groupadd Adm
　
Adding a user account adds a record to a new user in the/etc/passwd file and updates other system files, such as/etc/shadow and/etc/group.

Linux provides the integrated system management tool userconf, which can be used to manage user accounts in a unified manner.

3. delete an account

If a user's account is no longer in use, it can be deleted from the system. To delete a user account, you must delete the user record in system files such as/etc/passwd. If necessary, delete the user's home directory. Delete an existing user account and use the userdel command. The format is as follows:

　　

[Copy to clipboard] [-]

Code:

Userdel option Username

　　The commonly used option is-R, which is used to delete the user's home directory together.

　　For example:

　　

[Copy to clipboard] [-]

Code:

# Userdel Sam

This command deletes the records of the user Sam in the System File (mainly/etc/passwd,/etc/shadow,/etc/group), and deletes the user's home directory.

4. Modify an account

Modifying a user account is to change the user's attributes, such as the user ID, main directory, user group, and logon shell.

Use the usermod command to modify existing user information. The format is as follows:

　　

[Copy to clipboard] [-]

Code:

Usermod option Username

Common options include-C,-D,-M,-G,-G,-S,-u, and-o. These options have the same meaning as those in the useradd command, you can specify a new resource value for the user. In addition, some systems can use the following options:

　　

[Copy to clipboard] [-]

Code:

-L New User Name

This option specifies a new account, changing the original user name to the new user name.

　　For example:

　　

[Copy to clipboard] [-]

Code:

# Usermod-S/bin/KSh-D/home/Z-G developer Sam

This command changes the logon shell of user Sam to KSh, the main directory to/home/Z, and the user group to developer.

5. User Password Management

An important part of user management is the management of user passwords. A user account has no password when it was created, but is locked by the system and cannot be used. It can only be used after a password is specified, even if it is null.

The shell command used to specify and modify the user password is passwd. Super Users can specify passwords for themselves and other users. Common users can only use them to modify their own passwords. Command Format:

　　

[Copy to clipboard] [-]

Code:

Passwd option User Name

Available options:

[Copy to clipboard] [-]

Code:

-L the password is disabled.
-U password unlock.
-D indicates that the account has no password.
-F forces the user to change the password upon next login.
If the default user name is used, modify the password of the current user.

For example, if the current user is Sam, the following command modifies the user's own password:

[Copy to clipboard] [-]

Code:

$ Passwd
Old password :******
New Password :*******
Re-enter new password :*******

If you are a super user, you can specify the password of any user in the following form:

[Copy to clipboard] [-]

Code:

# Passwd Sam
New Password :*******
Re-enter new password :*******

When a common user modifies his or her own password, the passwd command First asks for the original password and then asks the user to enter the new password twice. If the two passwords are the same, the original password is not required when the superuser specifies a password for the user.

For the sake of system security, you should select a complicated password. For example, you 'd better use an 8-bit long password, which contains uppercase letters, lowercase letters, and numbers, it should be different from the name and birthday.

When you specify a blank password, run the following commands:

　　

[Copy to clipboard] [-]

Code:

# Passwd-D Sam

This command deletes the password of the user Sam, so that the system will not ask for the password during the next logon.

The passwd command can also use the-l (LOCK) option to lock a user so that the user cannot log on. For example:

　　

[Copy to clipboard] [-]

Code:

# Passwd-l Sam

2. User Group Management in Linux

Each user has a user group. The system can centrally manage all users in a user group. Different Linux systems have different user groups. For example, a user in Linux belongs to a user group with the same name as a user group, which is created at the same time.
User Group management involves adding, deleting, and modifying user groups. The addition, deletion, and modification of a group are actually updates to the/etc/group file.

1. Add a new user group to use the groupadd command. The format is as follows:
　　

[Copy to clipboard] [-]

Code:

Groupadd option User Group

You can use the following options:

[Copy to clipboard] [-]

Code:

-G gid specifies the group ID (GID) of the new user group ).
-O is generally used together with the-G option, indicating that the GID of the new user group can be the same as the GID of the existing user group in the system.

　　Example 1:
　　

[Copy to clipboard] [-]

Code:

# Groupadd group1

This command adds a new group group1 to the system. The Group ID number of the new group is added with 1 on the basis of the current largest group ID number.

　　Example 2:
　　

[Copy to clipboard] [-]

Code:

# Groupadd-G 101 group2

This command adds a new group group2 to the system and specifies that the Group ID of the new group is 101.

2. to delete an existing user group, run the groupdel command in the following format:
　　

[Copy to clipboard] [-]

Code:

Groupdel User Group

　　For example:
　　

[Copy to clipboard] [-]

Code:

# Groupdel group1

This command deletes group group1.

3. Run The groupmod command to modify the attributes of a user group. The syntax is as follows:
　　

[Copy to clipboard] [-]

Code:

Groupmod option User Group

　　Common options include:

[Copy to clipboard] [-]

Code:

-G gid: specify a new group ID for the user group.
-O and-G options are used at the same time. The new gid of a user group can be the same as the GID of an existing user group in the system.
-N new user group: Change the user group name to a new name.

　　Example 1:
　　

[Copy to clipboard] [-]

Code:

# Groupmod-G 102 group2

This command changes the group ID of group group2 to 102.

　　Example 2:
　　

[Copy to clipboard] [-]

Code:

# Groupmod-G 10000-N Group3 group2

This command changes the ID of group group2 to 10000 and the group name to group3.

4. If a user belongs to multiple user groups at the same time, the user can switch between user groups to have permissions for other user groups. After logging on, you can use the newgrp command to switch to another user group. The parameter of this command is the target user group. For example:
　　

[Copy to clipboard] [-]

Code:

$ Newgrp Root

This command switches the current user to the root user group, provided that the root user group is indeed the user's main group or additional group. Similar to user account management, user group management can also be completed through integrated system management tools.

3. system files related to user accounts

There are many methods to complete user management, but each method is actually to modify the relevant system files. Information related to users and user groups is stored in some system files, including/etc/passwd,/etc/shadow and/etc/group. The following describes the content of these files.

1. the/etc/passwd file is the most important file involved in user management.In Linux, each user has a corresponding record row in the/etc/passwd file, which records some basic attributes of this user. This file is readable to all users. Its content is similar to the following example:

[Copy to clipboard] [-]

Code:

# Cat/etc/passwd

Root: X: 0: 0: superuser :/:
Daemon: X: 1: 1: System daemons:/etc:
Bin: X: 2: 2: Owner of system commands:/bin:
SYS: X: 3: 3: Owner of system files:/usr/sys:
ADM: X: 4: 4: System Accounting:/usr/ADM:
Uucp: X: 5: 5: uucp administrator:/usr/lib/uuucp:
Auth: X: 7: 21: authentication administrator:/TCB/files/auth:
Cron: X: 9: 16: Cron Daemon:/usr/spool/cron:
Listen: X: 37: 4: network daemon:/usr/NET/NLS:
LP: X: 71: 18: printer administrator:/usr/spool/LP:
SAM: X: 200: 50: Sam san:/usr/SAM:/bin/sh

From the above example, we can see that the records in the/etc/passwd line correspond to a user, and the records in each line are separated by colons (seven fields are separated. Their format and meaning are as follows:

　　

[Copy to clipboard] [-]

Code:

User name: Password: User ID: Group ID: annotation Description: main directory: logon Shell

　　1) "User Name" is a string representing the user account.Generally, it cannot exceed 8 characters and may consist of uppercase/lowercase letters and/or numbers. The login name cannot contain a colon (because the colon is a separator here. For the sake of compatibility, it is recommended that the login name do not contain periods (.), and do not use hyphens (-) or plus signs (+) to start.

　　2) The encrypted user password is stored in some systems.. Although this field only stores the encrypted string of the user's password, it is still a security risk because the/etc/passwd file can be read by all users. Therefore, many Linux systems (such as svr4) now use the Shadow technology to store the encrypted user password in the/etc/shadow file, in the/etc/passwd file, only one special character is stored in the password segment, for example, "x" or "*".

　　3) The "User ID" is an integer used internally to identify users.Generally, it corresponds to the user name one by one. If several user names correspond to the same user ID, the system regards them as the same user, but they can have different passwords, different home directories, and different logon shells.

Generally, the user ID number ranges from 0 ~ 65 535. 0 is the identification number of the Super User Root, 1 ~ 99 is retained by the system and used as the management account. The identification number of a common user starts from 100. In Linux, this limit is 500.

　　4) the "Group ID" field records the user's user group.It corresponds to a record in the/etc/group file.

　　5) The "annotation description" field records users' personal information.Such as your real name, phone number, and address. In different Linux systems, the format of this field is not uniform. In many Linux systems, this field stores any comments of the description text and is used as the output of the finger command.

　　6) "main directory", that is, the user's initial working directoryIt is the directory in which the user logs on to the system. In most systems, the main directories of users are organized in the same specific directory, and the name of the main directories is the user's login name. Each user has the read, write, and execute (Search) permissions on his/her home directory. Other users have the permission to access this directory based on the actual situation.

　　7) after a user logs on, a process is started to pass user operations to the kernel. This process is a command interpreter or a specific program that the user logs on to the system and runs, that is, Shell.Shell is the interface between users and Linux systems. There are many types of Linux Shell, each of which has different characteristics. Common examples include SH (Bourne shell), CSH (C shell), KSh (Korn shell), tcsh (tenex/tops-20 Type C shell), and bash (Bourne again shell). The system administrator can specify a shell for the user based on the system conditions and user habits. If no shell is specified, the system uses sh as the default logon shell, that is, the value of this field is/bin/sh.

The user's logon shell can also be specified as a specific program (this program is not a command interpreter ). With this feature, we can restrict the user to run only the specified application. After the application is running, the user automatically exits the system. In some Linux systems, only programs registered in the system can appear in this field.

　　One type of users in the system is called psuedo users ),These users also have a record in the/etc/passwd file, but cannot log on because their logon shell is empty. They are mainly used to facilitate system management and meet the file owner requirements of the corresponding system processes. Common pseudo-users are as follows.

[Copy to clipboard] [-]

Code:

Definition of a pseudo-user
Bin has executable USER command files
Sys owns system files
ADM has account files
Uucp
LP or lpd subsystem usage
Nobody NFS usage

Owned account file

In addition to the pseudo applications listed above, there are also many standard pseudo users, such as audit, Cron, mail, and USENET, which are also required by related processes and files.

Since the/etc/passwd file can be read by all users, if the user's password is too simple or regular, a common computer can easily crack it, therefore, Linux systems with high security requirements separate encrypted passwords and store them in a single file. The file is a/etc/shadow file. Only Super Users have the permission to read the file, which ensures the security of the user password.

2. The record lines in/etc/shadow correspond to the records in/etc/passwd one by one. The pwconv command automatically generates the records based on the data in/etc/passwd.Its file format is similar to/etc/passwd and consists of several fields separated. These fields are:

　　

[Copy to clipboard] [-]

Code:

Login Name: encrypted password: last modification time: minimum interval: maximum interval: warning time: inactive time: expiration time: Flag

1) The "Login Name" is the same as the login name in the/etc/passwd file.
2) The "password" field stores the encrypted user password, with a length of 13 characters. If it is blank, the corresponding user has no password and no password is required for Logon. If it contains characters not in the {./0-9a-za-z} collection, the corresponding user cannot log on.
3) "last modification time" indicates the number of days from a certain time point to the last password change. The start time may be different for different systems. For example, in SCO Linux, the start time is January 1, January 1, 1970.
4) "minimum interval" refers to the minimum number of days required between two password changes.
5) The "maximum interval" indicates the maximum number of days for password persistence.
6) The "warning time" field indicates the number of days from when the system starts to warn the user to when the user password is officially invalid.
7) "No activity time" indicates the maximum number of days that the user has not logged on to the activity but the account remains valid.
8) the "expiration time" field shows an absolute number of days. If this field is used, the validity period of the corresponding account is given. After expiration, this account is no longer a legal account and cannot be used for logon.

　　The following is an example of/etc/shadow:

　　

[Copy to clipboard] [-]

Code:

# Cat/etc/shadow

Root: DNA kfw28zf38w: 8764: 0: 168: 7 :::
Daemon: *: 0: 0 ::::
Bin: *: 0: 0 ::::
SYS: *: 0: 0 ::::
ADM: *: 0: 0 ::::
Uucp: *: 0: 0 ::::
Nuucp: *: 0: 0 ::::
Auth: *: 0: 0 ::::
Cron: *: 0: 0 ::::
Listen: *: 0: 0 ::::
LP: *: 0: 0 ::::
SAM: ekdiseclwpdsa: 9740: 0: 0 ::::

3. All user group information is stored in the/etc/group file.

Grouping users is a way to manage users and control access permissions in Linux. Each user belongs to a user group. A group can contain multiple users, and a user can belong to different groups. When a user is a member of multiple groups at the same time, the main group to which the user belongs is recorded in the/etc/passwd file, that is, the default group to which the user belongs during logon, other groups are called additional groups. To access files in an additional group, you must first use the newgrp command to make yourself a member of the group to be accessed. All user group information is stored in the/etc/group file. The format of this file is also similar to that of the/etc/passwd file. Several fields are separated by colons. These fields include:

　　

[Copy to clipboard] [-]

Code:

Group Name: Password: Group ID: group user list

1) "group name" is the name of the user group, which consists of letters or numbers. Same as the login name in/etc/passwd, the group name should not be repeated.
2) The "password" field stores the encrypted password of the user group. Generally, users in Linux do not have a password, that is, this field is generally blank, or *.
3) the "Group ID" is similar to the user ID and is also an integer used internally to identify the group.
4) The "group user list" is a list of all users in this group/B]. Different users are separated by commas. This user group may be the user's primary group or an additional group.

　　An example of the/etc/group file is as follows:

# Cat/etc/group

[Copy to clipboard] [-]

Code:

Root: 0: Root
Bin: 2: Root, Bin
SYS: 3: Root, uucp
ADM: 4: Root, Adm
Daemon: 5: Root, daemon
LP: 7: Root, lp
Users: 20: Root, Sam

Iv. Add User batch

Adding and Deleting Users is a breeze for every Linux system administrator. the tricky thing is that if you want to add dozens, hundreds, or even thousands of users, we are unlikely to add useradd one by one, so we must find a simple method to create a large number of users. Linux provides a tool to create a large number of users, allowing you to create a large number of users immediately, as follows:

　　(1) edit a text user file firstEach column is written in the format of the/etc/passwd password file. Note that the user name, uid, and home directory of each user cannot be the same, the password column can be left blank or enter the X number. The content of user.txt in a sample file is as follows:

[Copy to clipboard] [-]

Code:

User001: 600: 100: User:/home/user001:/bin/bash
User002: 601: 100: User:/home/user002:/bin/bash
User003: 602: 100: User:/home/user003:/bin/bash
User004: 603: 100: User:/home/user004:/bin/bash
User005: 604: 100: User:/home/user005:/bin/bash
User006: 605: 100: User:/home/user006:/bin/bash

　　(2) run the command/usr/sbin/newusers as root to import data from the user.txt file of the created user and create the user:

　　

[Copy to clipboard] [-]

Code:

# Newusers <user.txt

Then, run vipw or VI/etc/passwd to check whether the data of these users is displayed in the/etc/passwd file and whether the user's home directory has been created.

　　(3) execute the command/usr/sbin/pwunconvDecode the shadow password generated by/etc/shadow, write it back to/etc/passwd, and delete the shadow password column of/etc/shadow. This is to facilitate the next step in password conversion, that is, to cancel the shadow password function first.

　　

[Copy to clipboard] [-]

Code:

# Pwunconv

　　(4) edit the password comparison file for each userThe content of the example file passwd.txt is as follows:

[Copy to clipboard] [-]

Code:

User001: Password
User002: Password
User003: Password
User004: Password
User005: Password
User006: Password

　　(5) run the command as root/usr/sbin/chpasswdCreate a user password. chpasswd writes the password encoded by the/usr/bin/passwd command to the/etc/passwd password column.

　　

[Copy to clipboard] [-]

Code:

# Chpasswd <passwd.txt

　　(6) confirm the password written to the/etc/passwd password column by encoding.Run/usr/sbin/pwconv to encode the password as shadow password and write the result to/etc/shadow.

　　

[Copy to clipboard] [-]

Code:

# Pwconv

In this way, a large number of users are created. Then, you can go to/home to check whether the permission settings of these users in the home directory are correct, and log on to verify that the user password is correct.

5. grant special permissions to common users

In Linux, there are usually more than one administrator. If each administrator uses the root identity for management, it is impossible to figure out who should do what. The best way is to create some common users and assign some system management work to them.

We cannot use Su to make them directly root, because these users must know the root password. This method is not safe and does not meet our division of labor needs. The general practice is to use permission settings to classify users with special identities into the same working group and set the permissions of the Working Group. For example, the user wwwadm is required to manage website data. Generally, the httpd owner of the Apache Web server process is www. You can set wwwadm as the same working group as www, set the working group permissions for Apache to store the web directory/usr/local/httpd/htdocs by default to readable, writable, and executable, in this way, every user in this Working Group can manage webpages.

However, this is not the best solution. For example, if the administrator wants to grant the shutdown permission to an ordinary user, the above method is not ideal. You may think that I only want this user to execute the shutdown command as root. It's totally correct. Unfortunately, this function cannot be implemented in common Linux systems,However, you already have a tool to implement this function-sudo.

Sudo assigns privileges to different users by maintaining a database mapped to the user name. These privileges can be identified by different commands listed in the database. To obtain a specific permission, a user with a certain level of privilege simply enters the sudo and command name on the command line and enters the password again as prompted (the user's own password, is not the root user password ). For example, sudo allows normal users to format disks, but does not grant other root users privileges.

1. The sudo tool is configured by the file/etc/sudoers.This file contains a list of all users who can access the sudo tool and defines their privileges. A typical/etc/sudoers entry is as follows:

　　

[Copy to clipboard] [-]

Code:

Liming all = (all) All

This entry allows the user Liming to access all applications as a Super User. For example, if the user liming needs to run commands as a Super User, he simply needs to add the prefix sudo before the command. Therefore, to run the format command as the root user, liming can enter the following command:

　　

[Copy to clipboard] [-]

Code:

# Sudo/usr/sbin/useradd Sam

Note: The command must write an absolute path./usr/sbin is not in the search path of a common user by default, or add the path: Path = $ path:/usr/sbin; export path. In addition, different system commands have different paths. You can use the command "whereis command name" to find the path.

The following output result is displayed:

[Copy to clipboard] [-]

Code:

We trust you have got ed the usual lecture from the local system
Administrator. It usually boils down to these two things:
#1) respect the privacy of others.
#2) Think before you type.
Password:

If liming correctly enters the password, the command useradd will be executed as the root user.

Note: The configuration file/etc/sudoers must be edited using the cmddo command.

You only need to add the user name, host name, and license command list to the file/etc/sudoers in the standard format, and save the list to take effect. Let's look at another example.

2. Example: The administrator needs to allow the gem user to execute the reboot and shutdown commands on the host sun,Add the following to/etc/sudoers:

　　

[Copy to clipboard] [-]

Code:

Gem sun =/usr/sbin/reboot,/usr/sbin/Shutdown

Note: the absolute path must be used for commands to prevent commands of the same name in other directories from being executed, resulting in security risks.

Save and exit. When you want to execute the reboot command, you only need to run the following command at the prompt:

　　

[Copy to clipboard] [-]

Code:

$ Sudo/usr/sbin/reboot

Enter the correct password to restart the server.

If you want to define a group of users, you can add % before the group name to set it, such:

　　

[Copy to clipboard] [-]

Code:

% Cuug all = (all) All

3. You can also use aliases to simplify the configuration file.Alias is similar to the group concept, including user alias, host alias, and command alias. Multiple users can define them with an alias first, and then use the alias when specifying what commands they can execute. This configuration takes effect for all users. The same is true for host aliases and command aliases. Note that before use, define the user_alias, host_alias, and cmnd_alias items in/etc/sudoers. Add the corresponding names after them and separate them by commas. For example:

[Copy to clipboard] [-]

Code:

Host_alias Server = No1
User_alias admins = liming, Gem
Cmnd_alias shutdown =/usr/sbin/halt,/usr/sbin/shutdown,/usr/sbin/reboot
Admins Server = Shutdown

4. Let's look at this example again:

　　

[Copy to clipboard] [-]

Code:

Admins all = (all) nopasswd: All

Allow admins to perform all operations without a password. "nopasswd:" indicates that the user does not need to enter a password when performing the operation.

5. The sudo command can also add some parameters to complete some auxiliary functions., Such

　　

[Copy to clipboard] [-]

Code:

$ Sudo-l

The following information is displayed:

[Copy to clipboard] [-]

Code:

User liming may run the following commands on this host:
(Root)/usr/sbin/reboot

Root allows Liming to execute the/usr/sbin/reboot command. This parameter allows you to view which commands can be executed in sudo.

6. Enter the sudo command at the command prompt to list all parameters.. Other parameters are as follows:

[Copy to clipboard] [-]

Code:

-V displays the version number.
-H: displays the parameters used by The sudo command.
-V will ask for the password because sudo is not executed during the first execution or within n minutes (N is set to 5 by default. This parameter is re-confirmed. If it is more than n minutes, you will also ask the password.
-K will force the user to ask for the password (whether or not it has been more than n minutes) during the next sudo execution ).
-B: Execute the command in the background.
-P prompt can change the password prompt, where % u is replaced with the user's account name, and % H displays the host name.
-U username/# this parameter is not added to the UID, which indicates that the command is to be executed as root, but this parameter is added, you can run commands as username (# uid of username ).
-S executes the shell specified by the shell in the environment variable, or the shell specified in/etc/passwd.
-H: Specify the home directory in the environment variable as the Home Directory of the user who wants to change the identity. (If the-u parameter is not added, the system administrator root is used .)

Command to be executed as a system administrator (or changed to another person as a-u.

VI. In addition, the instant server provides browser-based Webmin user management functions

Don't talk about it.

=======================================================