User groups and Rights management

I. User Management

1.userdel [Option]...login

-r: Delete User home directory

Instance:

Delete the Gentoo account and delete the home directory

[Email protected] home]# Lsgentoo wangcai Zhang Zhang1 zhang2[[email protected] home]# userdel-r gentoo[[email prote CTED] home]# Lswangcai Zhang Zhang1 zhang2

2.id[option] ... [User]

-u:uid

-g:gid

-g:groups

-n:name

Instance:

(1) Add-on group showing zhang2

[[email protected] testdir]# id-gn zhang3-n show name Zhang3 zhang2

3.su

SU Username: non-login switch, does not read the target user's configuration file, does not change the current working directory

Su-username: Login switch, will read the target user's profile, switch to home directory, completely switch

Change Identity Execution Command:

Su [-] username-c ' COMMAND '

Options:

-| --login

Su-| Username equivalent to Su-username

4.chage: For password effectiveness management, which is used to modify the expiration date of the account and password

Chage [Option]...login

Options

-D: Specify the last modified date of the password

-E: Password expiration date, after this day, the secondary account will not be available

-I: Number of days to lock account after password expires

-L: Lists the lifetime of the user and password

-M: Maximum number of days for password retention

-W: Number of days to receive warning messages before the password expires

Instance:

(1) Next login force reset Password

Chage-d 0 Tom

5. Groupadd Create a new workgroup

Groupadd [Option]...group_name

-G: Specify group ID number

-r: Create a system group. centos<500

centos<1000

Modification of 6.groupmod Group properties

Groupmod[option]...group

Options:

-N: New name

-G: New GID

Instance:

(1) Modify the group name and GID of the Zhang3

[Email protected] testdir]# groupmod-n Tom Zhang3-g 666

7.groupdel Group Deletion

Groupdel Group

8.gpasswd

GPASSWD [Optiom]group

Options:

-A User: Add user to the specified group

-D User: Remove users from the specified group

-A User1,user2 ...: Set up a list of users with administrative privileges

Instance:

(1) Set the User1 as the Sales group administrator

[Email protected] ~]# Gpasswd-a user1 Sales

(2) Remove the user2 from the sales group

[Email protected] ~]# gpasswd-d user1 salesremoving user user1 from group sales

9.groupmems changing and modifying group members

Group [options][action]

Options:

-G: Change to specified group (root)

Action

-A: Specify user join Group

-D: Remove users from the group

-P: Clear all Members from the group

-L: Show Group Members list

Instance:

(1) Add the Zhang3 user to the Zhang4 group

[Email protected] testdir]# Usermod-ag Zhang4 zhang3

or [[email protected] testdir]# groupmems-g zhang4-a zhang3 (zhang3 user is a member of ZHANG4 group followed by G or G option)

or [[email protected] testdir] #gpasswd-a zhang3 Zhang4

View group members with GROUPMEMS-LG Zhang4

(2) View members of the ZHANG4 group

[Email protected] testdir]# groupmems-l-G zhang4zhang3

Two. File permissions

1.chown modified file owner and owner group

Chown[option] ... [OWNER] [: [GROUP]] FILE ...

Usage:

chown[-r][user name [file or directory]

chown[-r][User name: group name [file or directory]

chown[-r][: Group name [file or directory]

chown[-r][User name: [File or directory]

chown [options]--refrence=refile file ... file permissions are the same as refile

2.CHGRP Group of changed genera

Chgrp[option]...group file

Chgrp[option] ... refrence=refile file ...

Options:

-R: Recursive

Instance:

(1) Change the owner and owner Group of BB file to User1 and sales

[email protected] testdir]# ll bb-rw-r--r--. 1 root root 0 3 10:31 bb[[email protected] testdir]# chown user1:sales bb[[email protected] testdir]# ll bb-rw-r--r-- . 1 User1 Sales 0 3 10:31 BB

(2) Change the genus of BB to User1

[Email protected] testdir]# chgrp user1 bb[[email protected] testdir]# ll bb-rw-r--r--. 1 User1 user1 0 3 10:31 bb

3.chmod Modifying file permissions

Chmod[option]...mode files

Mode

To modify all permissions for a class of users:

u= g= 0= ug= a= u= g=

Modify one or some of the permissions of a class of users

u+ u-g+ g-o+ o-a+ A-+-

Chmod[option] ...--reference=rfile FILE ... Refer to the permissions of rfile file, change file to the same rfile;

Instance:

(1) Add Execute permission to AA file

[Email protected] testdir]# chmod u+x aa[[email protected] testdir]# ll aa-rwxr--r--. 1 user2 user2 0 3 10:31 AA

(2) Assign the read, write, execute permission to the owner of AA, assign read and execute permission to the group of AA, assign the permission of execution to other users

[Email protected] testdir]# chmod 751 Aa[[email protected] testdir]# ll aa-rwxr-x--x. 1 user2 user2 0 3 10:31 AA or [[email protected] testdir]# chmod u=rwx,g=rx,o=x aa[[email protected] testdir]# ll aa-rwx R-x--x. 1 user2 user2 0 3 10:31 AA

4.umask

The Umask value can be used to retain the Create file permission

New file Permission: 666-umask

If the resulting result has an execute (odd) permission on a bit, its permissions +1

New DIR Permission: 777-umask

Non-privileged user umask is 002

Root Umask is 022.

Umask: View

umask#: Setting

umask002

Umask–s Mode display

Umask–p output can be called

Global Settings:/ETC/BASHRC user settings: ~/.BASHRC

Three. Special permissions on the Linux file system

SUID, SGID, Sticky

1.suid

The Suid property can only be used on binary executables and is not valid for directories

Permission settings:

chmod u+s File:

chmod u-s File:

Instance:

(1) View/etc/shadow on the Zhang user

[[email protected] testdir]# ll /bin/cat-rwxr-xr-x. 1 root root 54048  Nov 20  2015 /bin/cat[[email protected] testdir]# su -  zhanglast login: wed aug  3 19:28:16 cst 2016 on pts/0[[ email protected] ~]$ cat /etc/shadowcat: /etc/shadow: permission denied[[ Email protected] ~]$ su password: [[email protected] zhang]# chmod  u+s /bin/cat[[email protected] zhang]# su - zhanglast login: wed  aug  3 19:30:27 cst 2016 on pts/0[[email protected] ~]$  cat /etc/shadowroot:$6$ahlqxg.a$g85xt17r4kpl.dictfaee3j7ua0eoovzqsum7exqbu/ Q4qm04vw7fsnnjbzrwtpnw90elu3mxphymuimkh4ck1:17008:0:99999:7:::bin:*:16659:0:99999:7:::d aemon:*:16659:0:99999:7 ::: Adm:*:16659:0:99999:7:::lp:*:16659:0:99999:7:::...... 

2.sgid

chmod g+s File

chmod g-s File

When Sgid is applied to a directory, the owning group of the files or subdirectories that are created in that directory is the group to which the directory belongs

When Sgid is applied to an executable file, other users have the owning group of the execution file when they use the execution file.

3.Sticky

chmod o+s File

chmod o-s File

Sticky can only be applied on the directory with W+X permissions, when the user has the sticky attribute, all files or subdirectories of that directory, no matter what permissions only the file owner and root user can do delete action.

Instance:

Prevent other users from deleting files in a directory that has write permissions

[[email protected] testdir]$ mkdir dir[[email protected] testdir]$ CD Dir[[email protected] dir]$ touch AA BB [Email prot Ected] dir]$ chmod o+t/testdir/dir[[email protected] dir]$ ll-d/testdir/dirdrwxrwxr-t. 2 Zhang Zhang 4096 3 21:36/testdir/dir[[email protected] dir]# su tom[[email protected] dir]$ rm-f/testdir/dir/aar M:cannot remove '/testdir/dir/aa ': Permission denied

Four. Set the specific properties of the file (can protect some important files, avoid misoperation)

Chattr +i cannot be deleted, renamed, changed

Chattr+a can only increase

Lsattr Display Specific Properties

Five. Use of ACLs

1. What is ACLL

It is primarily intended to provide permission settings other than the Read,write,execute permissions of the Owner,group,others

It focuses on the following projects:

User, user group,

Default property (Mask): Default permissions that are set when new files/directories are created in this directory

2. How to start an ACL

CentOS7.0 the XFS and Ext4 file systems created by default have ACL capabilities.

Prior to centos7.x, the default manually created Ext4 file system has no ACL functionality and needs to be manually incremented.

(1) View Mount parameters feature mount

(2) Add ACL function manually

Tune2fs–o ACL/DEV/SDB1

Or

Mount–o acl/dev/sdb1/mnt

Use of 3.ACL

Getfacl: Get ACL Settings item for a file/directory

SETFACL: Setting ACL rules for a directory/file

(1) Setfacl usage

Setfacl [-BKRD] [{-m|-x} ACL parameter] file

-M: Set ACL permissions

-X: Remove ACL permissions, not shared with M

-B: Remove all ACL permissions

-r: Recursive set ACL, including subdirectories will be set up

-D: Sets the default ACL parameter, the detachment directory is valid, the new file in the directory inherits the default value of the directory

Instance:

(1) For a specific user Zhang

[Email protected] zhang]# cat/etc/issue >/testdir/f2[[email protected] zhang]# ll/testdir/f2-rw-r--r--.  1 root root 4 21:11/testdir/f2[[email protected] zhang]# setfacl-m u:zhang:-/testdir/f2 Disable Read access for the Zhang user [email Protected] zhang]# su-zhanglast Login:thu 4 21:07:14 CST on Pts/1[[email protected] ~]$ Cat/testdir/f2cat: /testdir/f2:permission denied insufficient authority

(2) Clear the ACL permissions set on the Zhang user

[Email protected] zhang]# setfacl-b/testdir/f2[[email protected] zhang]# ll/testdir/f2-rw-r--r--. 1 root root 4 21:11/testdir/f2

(3) Setfacl-m File.acl file|directory

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/85/71/wKiom1ejU53xBC-tAAFCkuvQ_xE180.png "title=" 1.png " alt= "Wkiom1eju53xbc-taafckuvq_xe180.png"/>

(4) Setfacl-m D:u:wang:rx directory

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M01/85/71/wKioL1ejU66hgY2nAAJb5Nymgwk521.png "title=" 2.png " alt= "Wkiol1eju66hgy2naajb5nymgwk521.png"/>

4.getfacl View ACL permissions l list

Getfacl file

Instance:

[Email protected] zhang]# GETFACL/TESTDIR/F2

Getfacl:removing leading '/' from absolute path names

# FILE:TESTDIR/F2

# Owner:root

# Group:root

user::rw-

user:zhang:rw-

group::r--

mask::rw-

other::r--

5.mask

The permissions set by the user or group must be within the scope of the mask's permission set to take effect, which is the effective permission

Instance:

You can set the mask permissions to modify other users ' permissions on the file

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M01/85/71/wKiom1ejU9OQE9VWAACNZ5gXG-4975.png "title=" 3.png " alt= "Wkiom1eju9oqe9vwaacnz5gxg-4975.png"/>

6. Access Control List

ACL: Flexible implementation of permissions control

Common usage

Mount-o acl/directory

Getfacl file |directory

Setfacl-m u:wang:rwx File|directory

SETFACL-RM g:sales:rwx Directory

Setfacl-m File.acl File|directory

Setfacl-m G:SALESGROUP:RW file| Directory

Setfacl-m D:u:wang:rx Directory

Setfacl-x U:wang File |directory

Setfacl-x File.acl Directory

This article from "zhang1003995416" blog, reproduced please contact the author!

User groups and Rights management