1 / 60

itec 400 User Administration Unix System Directories

itec 400 User Administration Unix System Directories. George Vaughan Franklin University. Topics. User Administration The password file The shadow password file The group file Adding Users Disabling Users Removing Users Unix/Linux System Directories. User Administration. The Pieces:

keita
Download Presentation

itec 400 User Administration Unix System Directories

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. itec 400User AdministrationUnix System Directories George Vaughan Franklin University

  2. Topics • User Administration • The password file • The shadow password file • The group file • Adding Users • Disabling Users • Removing Users • Unix/Linux System Directories

  3. User Administration • The Pieces: • /etc/passwd • /etc/shadow • /etc/group • The Function: • Username Policy • Password Policy • Group Membership Policy • User related commands

  4. The Password file • Located in /etc/passwd. • Serves as the user database for the system. • Information in /etc/passwd is useful for applications. Readable by all. • Historically, /etc/passwd contained user’s password in encrypted form. • Today, encrypted passwords readable by all is too dangerous. • Today, passwords are stored in /etc/shadow. Readable only by root.

  5. The Password File • Format of /etc/passwd (colon separated fields): userName:passWord:UID:GID:userInfo:homeDir:loginApplication Example: vaughang:x:257:100:George Vaughan:/export/home/vaughang:/bin/ksh

  6. The Password File • User Name: • Often generated by a script • Often limited to 8 characters • RedHat: 32 char – any char except newline and colon • Password: • ‘x’ indicates use of /etc/shadow • ‘*’ indicates account is disabled. • Standard limit, 8 chars, unencrypted • Redhat limit, arbitrary length, unencrypted • Never leave this field empty. • UID • A unique user identifier • unsigned 32 bit Integer • root has UID 0 • Most systems: UID < 100: system accounts, UID >= 100: user accounts • Redhat: UID < 500: system accounts, UID >= 500: user accounts

  7. The Password File • GID • A unique group identifier • unsigned 32 bit Integer • 0 for group root, 1 for bin, 2 for daemon • Most systems: UID < 100: system groups, UID >= 100: user groups • Redhat: UID < 500: system groups, UID >= 500: user groups • User Info: • usually user name • can support up to 5 comma-separated subfields used by “finger” command. • GECOS field. Originally used at Bell Labs to store user info for rje to a GE mainframe • Home Directory • Initial directory after login • Login Application • Usually a shell. • /etc/shells contains a list of valid shells on system - user cannot change shell to something not in /etc/shells. • Can be any application - does not have to be in /etc/shells.

  8. The Password File • A simple ASCII file. • Can be edited with standard editor • ‘vipw’ (vi the password file) • allows only one editing session at a time • minimizes corruption due to pilot error or abnormal terminations.

  9. The Shadow Password File • Location on both Linux and Solaris: /etc/shadow • Readable only by root • If used, contains the encrypted password. • Used by default on RH Linux • In RH Linux, /etc/shadow can be edited by vipw.

  10. The Shadow Password File • Format of /etc/shadow (colon separated fields): userName:passWord:changedDate:minLife:maxLife:warn:disable:expireDate:unused example: gvaughan:$1$ItpbrZB2$2g/qNx0DhRmnoXbpA1EQJ/:12198:0:99999:7:::

  11. Encrypted Passwords • Encrypted Passwords: • DES (13 characters in encrypted form) • MD5 (34 characters in encrypted form) • Most Linux distributions support MD5. • MD5 is the default in Redhat • MD5 passwords always begin with “$1$”

  12. The Group File • Permissions for users can be managed on a group basis. • Defines which users are members of which group. • A user can be a member of more than one group (Some systems restrict number of groups a user can be a member of). • The group associated with a user in /etc/passwd file is the user’s primary group.

  13. The Group File • Format of /etc/group (colon separated list): groupName:passWord:GID:userList • Example: cs::102:lint,cs,chen04,christcl,olinger

  14. The Group File • Group Name: on many systems, restricted to 8 char. • Password: • Obsolete, still used in Linux. • Often contains an ‘x’ or nothing. • If field has ‘*’, means group is disabled. • GID • A unique group identifier • unsigned 32 bit Integer • 0 for group root, 1 for bin, 2 for daemon • Most systems: UID < 100: system groups, UID >= 100: user groups • Redhat: UID < 500: system groups, UID >= 500: user groups • User List: comma separated, no spaces

  15. The Group File • If a user is defined as a member of a group in /etc/passwd but not in /etc/group, the file /etc/passwd takes precedence. • On Linux, the file /etc/group can be edited with vigr • Linux supports a shadow group file. • Its location is /etc/gshadow • It is used to store group passwords.

  16. User Related Commands Note: User administration commands will be addressed in later slides. • id • reports UID and GID from /etc/passwd • example: >id root uid=0(root) gid=1(other)groups • groups • reports groups that user is a member of. • example: >groups root other root bin sys adm uucp mail tty lp nuucp daemon

  17. User Related Commands • newgrp • Logs user into new group (that user is a member of) • Example: >groups faculty wheel >touch trash1 >newgrp wheel >touch trash2 >ls –l -rw-rw-r-- 1 vaughang faculty … trash1 -rw-rw-r-- 1 vaughang wheel … trash2

  18. User Related Commands • finger • displays information about a user • example: >finger vaughang Login name: vaughang In real life: George Vaughan Directory: /export/home/vaughang Shell: /bin/ksh On since Feb 17 15:48:34 on pts/7 from dhcp9544228.inet.com 13 seconds Idle Time

  19. Adding Users • 3 different ways to add users: • Manually • Using the ‘useradd’ command • Using a GUI based system administration tool.

  20. Adding Users • Many Unix and Linux distributions provide GUI applications that allow for the creation of user accounts. • However these GUI systems tend to be distribution specific. • Large sites have custom scripts for adding users that enforce local policies

  21. Adding Users • It is good to know how to add users manually: • Useful if problems occur with GUI apps • Useful for writing scripts with site specific policies. • Useful for understanding how user management works at the O.S. level. • Lecture will focus on adding users manually. • Book has good description of GUI apps for adding users.

  22. Adding Users Manually • Activities when adding users: • Edit /etc/passwd file • Edit /etc/shadow file • Edit /etc/group (if necessary) • Set initial password • Setup the new user’s home directory • Copy startup files to user’s home directory • Test the account

  23. Adding Users Manually (Red Hat) • The following scenario adds a new user named ‘dummy1’. • The scenario is simplified yet complete

  24. Adding Users Manually (Red Hat) • Edit /etc/passwd • Use ‘vipw’ for safety dummy1:x:502:502:Mr. Dummy:/home/dummy1:/bin/bash • Edit /etc/shadow • Continue using ‘vipw’ Would you like to edit /etc/shadow now [y/n]? y dummy1:*:0:0:30:7:::

  25. Adding Users Manually (Red Hat) • Change new user’s password # passwd dummy1 Changing password for user dummy1 New password: Retype new password: passwd: all authentication tokens updated successfully • Re-edit /etc/shadow • Set the ‘password changed’ to 0 (1/1/70) • Will force user to change immediately • Edit /etc/group vi /etc/group dummy1:x:502:

  26. Adding Users Manually (Red Hat) • Create user’s home directory # mkdir /home/dummy1 # chown dummy1 /home/dummy1 # ls -ld /home/dummy1 drwxr-xr-x 2 dummy1 root 4096 Feb 17 23:20 /home/dummy1 # chmod 700 /home/dummy1 drwx------ 2 dummy1 root 4096 Feb 17 23:20 /home/dummy1 • Copy login initialization files # cp -rf /etc/skel/.[a-zA-Z]* ~dummy1 # chmod 644 ~dummy1/.[a-zA-Z]* # chown dummy1 ~dummy1/.[a-zA-Z]* # chgrp dummy1 ~dummy1/.[a-zA-Z]*

  27. Adding Users Manually (Red Hat) • Test new account # su - dummy1 # ls -al ~dummy1 total 52 drwx------ 4 dummy1 root 4096 Feb 17 23:47 . drwxr-xr-x 6 root root 4096 Feb 17 23:20 .. -rw------- 1 dummy1 dummy1 28 Feb 17 23:48 .bash_history -rw-r--r-- 1 dummy1 dummy1 24 Feb 17 23:33 .bash_logout -rw-r--r-- 1 dummy1 dummy1 191 Feb 17 23:33 .bash_profile -rw-r--r-- 1 dummy1 dummy1 124 Feb 17 23:33 .bashrc -rw-r--r-- 1 dummy1 dummy1 5450 Feb 17 23:33 .canna -rw-r--r-- 1 dummy1 dummy1 820 Feb 17 23:33 .emacs -rw-r--r-- 1 dummy1 dummy1 118 Feb 17 23:33 .gtkrc drw-r--r-- 3 dummy1 dummy1 4096 Feb 17 23:33 .kde -rw-r--r-- 1 dummy1 dummy1 3511 Feb 17 23:33 .screenrc drwx----- 2 dummy1 dummy1 4096 Feb 17 23:46 .xauth

  28. Adding Users (Notes) • Distributions often come with /etc/skel directory which contains default initialization files that are copied in user home directories. • System wide initialization files: • /etc/profile • /etc/bashrc • Initialization files in user home directory: • $HOME/bash_profile • $HOME/bashrc

  29. Adding Users (Notes) • What is the order of execution of initilaization files upon login? • I added echo statements to the initialization files and here is what I found: • START /etc/profile • END /etc/profile • START /home/gvaughan/.bash_profile • START /home/gvaughan/.bashrc • START /etc/bashrc • END /etc/bashrc • END /home/gvaughan/.bashrc • END /home/gvaughan/.bash_profile • So BASH executes /etc/profile and then $HOME/bash_profile and $HOME/bash_profile executes $HOME/bashrc which then executes /etc/bashrc

  30. Adding Users (Notes) • In Linux, the file /etc/login.defs contains system-wide login controls, such as: • system location of mailboxes • number of login retries • delay between failed login attempts • default values for user admin commands • many other controls…

  31. Adding Users with useradd (Red Hat) • In this scenario, we will add a user with the ‘useradd’ command. • ‘useradd’ has many options - see man page • The user’s name is Michael Johnson

  32. Adding Users with useradd (Red Hat) • Find out the default settings for useradd useradd -DGROUP=100HOME=/homeINACTIVE=-1EXPIRE=SHELL=/bin/bashSKEL=/etc/skel

  33. Adding Users with useradd (Red Hat) • Create user with useradd • useradd -c "Michael Johnson" -g students -G wheel -m -s /bin/ksh johnsonm • -c specifies user information in /etc/passwd • -g defines primary GID (in /etc/passed) • -G defines secondary GID (in /etc/group) • -m creates a home directory in /home if one does not exist • -s overrides default system shell (affects /etc/passwd)

  34. Adding Users with useradd (Red Hat) • Check contents of /etc/passwd, /etc/shadow and /etc/group: # tail /etc/passwdjohnsonm:x:503:200:Michael Johnson:/home/johnsonm:/bin/ksh • Notice in /etc/passwd: • useradd uses next available UID • primary GID is students (see /etc/group below) • home directory is /home/johnsonm • default shell is ksh

  35. Adding Users with useradd (Red Hat) # tail /etc/shadowjohnsonm:!!:12102:0:99999:7::: • Notice in /etc/shadow • password is !! (not defined) • practically infinite max password age

  36. Adding Users with useradd (Red Hat) # tail /etc/groupstudents:x:200:wheel:x:10:root,gvaughan,johnsonm • Notice in /etc/group • johnsonm is explicitly in group wheel • Johnson is not listed in group students, but this Johnson’s primary GID (why?)

  37. Adding Users with useradd (Red Hat) • Change password on johnsonm: # passwd johnsonmChanging password for user johnsonmNew password:Retype new password:passwd: all authentication tokens updated successfully • Test user account: # su - johnsonm$ pwd/home/johnsonm$ ls -altotal 48drwx------ 4 johnsonm students 4096 Feb 18 23:02 .drwxr-xr-x 7 root root 4096 Feb 18 22:58 ..-rw-r--r-- 1 johnsonm students 24 Feb 18 22:58 .bash_logout

  38. Adding Users with useradd (Red Hat) • Switch back to ‘root’ • Reset password age to Jan. 1st, 1970 so new user has to change password upon first login: chage -d 0 –M 15 user_ID • “-d 0” sets last password change to 01/01/70 • “-M 15” requires password to have a max age of 15 days.

  39. Disabling A User Account • Sometimes you may want to disable a user, but not remove user (e.g. really old password) • This can be done quickly by prefixing an ‘*’ to the password in /etc/shadow. • Can also use ‘passwd -l userName’

  40. Disabling A User Account • We can also create a program (pseudo shell) that just displays message why user is prevented access and then just exit. • We than edit /etc/passwd and set the user’s default shell to the pseudo shell. • Don’t add pseudo shell to /etc/shells.

  41. Removing Users • Book provides a list of tasks to be performed if you wish to remove a user account (including home directory, etc.). • See man page for ‘userdel’.

  42. System Directories / bin boot dev home initrd lib lost+found etc misc mnt opt proc usr root sbin tftboot tmp var vmlinuz grub null rc*.d group passwd src include

  43. /bin • Contains executables for basic commands • Examples of commands in /bin: awk, bash, cat, chmod, cp, date, echo, grep, kill, ls, ps, pwd, … • If you create a useful shell or perl script that others would find useful, this is a good location for the script • Don’t replace or change existing system commands in this directory – unless upgrading O.S.

  44. /boot • Contains Kernel executable • /boot/vmlinuz • Contains directory for grub (boot loader) • /boot/grub • The ascii configuration file for grub is: • /boot/grub/grub.conf • Note that /etc/grub.conf is a symbolic link to /boot/grub/grub.conf

  45. /dev • Contains entries for devices such as disk portions, tape drives, printers, etc. • In Unix/Linux, every device is treated as if it were a file. Very nice – O.S. provides a generalized file-like interface to hardware. • /dev/null is a ‘fake’ device which stores nothing: • a ‘bit’ bucket • useful for “throwing away” error or warning messages • example: myprog 2>/dev/null will throw away all error messages.

  46. /etc • Contains many system configuration files. • System Administrators do much work with files here. • Examples of config files and config directories in /etc: passwd, group, shadow, rc*.d, init.d, inittab, hosts, httpd

  47. /home • Usual location for user home directories (other directories may be used for home directories)

  48. /initrd • Facilitates the use of a RAM disk during boot sequence. • the RAM disk version of initrd is used during boot the process to store a minimum set of drivers. • When initrd is no longer needed, it is moved to /initrd so it can be unmounted.

  49. /lost+found • fschk (File System Check) is a utility that is run during the boot process to check the integrity of file systems. • fschk can also be run after the boot process on unmounted files systems. • If fschk finds corrupted files, the corrupted files are placed in /lost+found directory

  50. /misc • Used for mounting: • removable devices such as zip drives • remote filesystems when using network file systems

More Related