Article Title: security management users and groups in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
In Linux, users are the subject of activities and directly enjoy the right to operate and control system files and resources. Therefore, how to manage users in the system, this is the first step for system administrators to ensure system security.
In Linux, every file and program belongs to a specific "user ". Each user is identified by a unique identity, which is called a user ID (UID ). In addition, each user in the system must belong to at least one "User Group", that is, a user group established by the system administrator. This group contains many system users. Like a user, a user group is identified by a unique identity, which is called a user group ID (GroupID, GID ). Users can belong to multiple user groups. Access to a file or program is based on its UID and GID. A program in execution inherits the rights and access permissions of users who call it.
User Files and group files
1. User Account file --/etc/passwd
The/etc/passwd file is one of the key Unix security files. Each row of this file stores one user data, and each data item of the user data is separated by a colon. As follows:
The first two items in each line are the login name and the encrypted password, the second two numbers are UID and GID, and the other one is any information about the user that the system administrator wants to write. The last two items are two path names: one is the HOME directory allocated to the user, and the other is the shell to be executed after the user logs on (if it is a space, the default value is/bin/sh ). All user passwords are encrypted and usually adopt irreversible encryption algorithms, such as DES. Any user with a UID of 0 has the root user (System Administrator) access permission. Generally, the login name of the user with a UID of this special value is "root ". Any other user or user name that has a UID of 0 may compromise system security.
2. User shadow file-shadow
Since the/etc/passwd file is globally readable and the password encryption algorithm is public, if a malicious user obtains the/etc/passwd file, you can calculate and compare all possible plaintext values by using the same algorithm until they are the same, thus cracking the password. Therefore, to address this security problem, Linux/Unix widely uses the "shadow (shadow) file" mechanism to transfer the encrypted password to the/etc/shadow file, this file is only readable by the root Super User, And the ciphertext field of the/etc/passwd file is displayed as an x, which minimizes the chance of ciphertext leakage. Each line of the/etc/shadow file contains nine fields separated by eight colons. The format is as follows.
Username: passwd: lastchg: min: max: warn: inactive: expire: flag
Each domain indicates the following meaning: user Login Name, encrypted user password, the number of days from January 1, January 1, 1970 to the last password modification, the number of days between the two passwords, and the maximum number of days when the password is valid (if it is 99999 indicates that it never expires) the number of days before the password expires, the system issues a warning to the user, the number of days before the user name is valid, the time when the user is not allowed to log on, and reserved fields (not used currently ).
3. User group account file --/etc/group
The/etc/passwd file contains the default group ID (GID) of each user ). In the/etc/group file, the GID is mapped to the name of the user group and other members in the same group.
The/etc/group file contains group information. Each GID in/etc/passwd should have corresponding entry items in the file. The entry items list the group name and the users in the group, in this way, users in each group can be easily understood. Otherwise, users in the same group must be searched from the beginning to the end in the/etc/passwd file based on the GID, which provides a quick way to find users. The/etc/group file does not need to control the group's permission, because the system uses the UID and GID from the/etc/passwd file to determine the file access permission, even if the/etc/group file does not exist in the system, users with the same GID can share files with group access permission. A group can have a password just like a logon user. If the second domain of the/etc/group file entry is not empty (usually indicated by x), it is considered as an encrypted password.
The content of each row in the/etc/group file is as follows: User group name, password of the user group that has been encrypted, user group ID (GID), and list of member users separated by commas.
4. group account file --/etc/gshadow
Like a user account file, a group account file is used to enhance the security of the group password and prevent hackers from launching brute-force attacks, A security mechanism is used to separate the group password from other information of the group. The format is as follows: User Group name, encrypted group password, and group member list.
Verify user and group files
1. Use the pwck and grpck commands to verify the user and group files
The users and group account files described above are all very important for the system to verify users and groups. Once an error occurs in the preceding file, the system may be affected. For this reason, Linux provides the pwck and grpck commands to verify the user and group files respectively to ensure consistency and correctness of the two files. The following sections describe them respectively.
Pwck is used to verify the consistency between the user account file (/etc/passwd) and the shadow file (/etc/shadow). It verifies the format and data correctness of each field in each data item in the file. If an error is found, this command will prompt you to delete the data item with the error.
This command verifies whether each data item has the correct number of domains, unique usernames, legal users and group IDs, legal main group groups, legal home directories, and legal logon shells. If the number of domains and user name are found to be incorrect, the error is fatal. You need to delete the entire data item. All other errors are non-fatal. You may need to modify them instead of deleting the entire data item. The following example shows how to use this command:
// Cat/etc/passwd
// Display the original user account file in the system
// Verify that the super user does not exist in the system
User adm: directory/var/adm does not exist
User news: directory/etc/news does not exist
User uucp: directory/var/spool/uucp does not exist
User gopher: directory/var/gopher does not exist
User pcap: directory/var/arpwatch does not exist
User super: no group 200
User super: directory/home/super does not exist
Pwck: no changes
// Edit the account file again and add the incorrect data item "super: x: 200: 200: superman:/home/super :"
// Perform verification
# Pwck/etc/passwd
User adm: directory/var/adm does not exist
User news: directory/etc/news does not exist
User uucp: directory/var/spool/uucp does not exist
User gopher: directory/var/gopher does not exist
User pcap: directory/var/arpwatch does not exist
User super: no group 200
User super: directory/home/super does not exist
Invalid password file entry
Delete line ''? Y
Pwck: the files have been updated
The results of the two verification operations are different. For the first time, the user is not required to delete the incorrect data item because the number of fields in the data item is not incorrect, the number of second-level fields is one less (there should have been seven items, but there are only six items), so it is a fatal error and the system prompts the user to delete it, the user is sure to delete the file before it passes verification. Similarly, you can use this command to verify the consistency of the/etc/shadow file.
Similar to the pwck command, the grpck command is used to verify the consistency and correctness of the group account file (/etc/group) and the shadow file (/etc/gshadow. This command verifies the format and correctness of each field in each data item in the file. If an error is found, this command will prompt you to delete the data item with the error.
This command verifies whether each data item has the correct number of domains, unique group ID, valid members, and administrator lists.
If the number of domains and group names are found to be incorrect, the error is fatal. You need to delete the entire data item. All other errors are non-fatal. You may need to modify them instead of deleting the entire data item.
The following example shows how to use this command:
// Cat/etc/group // display the original user account file in the system
Root: x: 0: root, patterson
Bin: x: 1: root, bin, daemon
Daemon: x: 2: root, bin, daemon
Sys: x: 3: root, bin, adm
Adm: x: 4: root, adm, daemon
Tty: x: 5:
Disk: x: 6: root
Lp: x: 7: daemon, lp
Kmem: x: 9:
Supersun: x: 501: liyangsuper
Liyangsuper: x: 502:
Patterson1: x: 504:
Programmer: x: 2500:
Jerry: x: 503:
Manager: x: 2500:
# Vi/etc/group
// Edit the account file and add the incorrect data item "test: x"
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
A Free Trial That Lets You Build Big!
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
