Lecture – Users and groups Unix account management 1

User management Adding/Removing Users UNIX: Traditionally, user account details are stored in the /etc/passwd file (/etc/group, /etc/shadow) This file has the format: username:password:uid:gid:comment:home dir:shell one way to get a list of usernames on a system: cut –d: -f1 /etc/passwd Do not edit this file directly, use useradd / userdel / groupadd / groupdel commands 2

useradd (linux) Create a new user or update default new user information useradd [-c comment] [-d home_dir] [-e expire_date] [-f inactive_time] [-g initial_group] [-G group[,...]] [-m [-k skeleton_dir] | -M] [-n] [-o] [-p passwd] [-r] [-s shell] [-u uid] login useradd -D [-g default_group] [-b default_home] [-e default_expire_date] [-f default_inactive] [-s default_shell] The –D option causes system defaults specified in /etc/login.defs to be used for this account creation 3

userdel Delete a user account and related files userdel [-r] login The userdel command modifies the system account files, deleting all entries that refer to login. The named user must exist. The options which apply to the userdel command are: -r Files in the user’s home directory will be removed along with the home directory itself and the user’s mail spool. Files located in other file systems will have to be searched for and deleted manually. 4

groupadd (linux)… Create a new group groupadd [-g gid [-o]] [-r] [-f] group Creates a new group account using the values specified on the command line and the default values from the system. The new group will be entered into the system files as needed. Options: -g gid The numerical value of the group’s ID. This value must be unique, unless the -o option is used. The value must be non-negative. The default is to use the smallest ID value greater than 500 and greater than every other group. Values between 0 and 499 are typically reserved for system accounts. 5

…groupadd (linux) -r instructs groupadd to add a system account. The first available gid lower than 499 will be automatically selected unless the -g option is also given on the command line. -f the force flag. This will cause groupadd to exit with an error when the group about to be added already exists on the system. If that is the case, the group won’t be altered (or added again). Also modifies the way -g option works. When you request a gid that it is not unique and you don’t specify the –o option too, the group creation will fall back to the standard behavior (adding a group as if neither -g or –o options were specified). 6

groupdel (linux) Delete a group groupdel group The groupdel command modifies the system account files, deleting all entries that refer to group. The named group must exist. You must manually check all filesystems to insure that no files remain with the named group as the file group ID. 7

groupdel (linux) Delete a group groupdel group The groupdel command modifies the system account files, deleting all entries that refer to group. The named group must exist. You must manually check all filesystems to insure that no files remain with the named group as the file group ID. 8

Managing Users Whether in the UNIX or Windows (or other) environment, it is best practice to manage users, where possible, on a per-group basis Wherever possible, settings and configurations should be managed on a per-group basis For this reason, the management of group settings is as important in any multi-user environment as is the management of individual settings 9

Managing Groups One approach to the management of groups is a hierarchical approach, whereby the user community is divided into a number of groups based on roles within the organisation In this way, an individual may belong to several groups, each of which may have a different combination of security settings etc. If we can be assured users have only setting which are assigned on a per-group basis, it becomes easier for us to ensure that all users with similar or identical roles are subject to the same rules 10

Managing Users and Groups in the Windows Environment Microsoft provides a network server platform based on the SMB (Server Message Block) protocol The management tools and the features of these server platforms have changed somewhat over the years, but remain broadly the same This module includes emulation of SMB on UNIX using SaMBa 11