Users and groups management

Users are stored in /etc/passwd file in next format:

user:x:1000:1000:denis,,,:/home/user:/bin/bash

1. Username
2. Has password in /etc/shadow
3. uid = user id
4. gid = group id
5. Friendly username, might include email or phone
6. Default home directory
7. Default shell or no login

Encrypted password are stored in /etc/shadow file.

Groups are listed in /etc/group.

Create user accounts

Defaults for creating user account are located in /etc/adduser.conf.

There it’s possible to configure user default directory, prefix for default directory, skeleton for default directory.

Modifying and deleting user accounts

• Login as user "su username"
• Changing password "passwd" or using with sudo, if user do not know the password
• Changing shell possible using "chsh"
• Change user info "chfn username"
• Change user name "usermod -l newusername oldusername"
• Change default directory "usermod -d /home/user -m username"

Create and modify groups

• Create a group "sudo addgroup name"
• Add user to group "sudo adducer username groupname"
• Add user to group "sudo usermod -a -G groupname username"
• Modify or delete group "groupmod/delgroup"

Home folder templating and global environment configuration

There is a possibility to set skeleton in /etc/skel.

Configure and monitor user resources.

To check resources used by user "top -u username".

Same with "ps -u username".

Setting limits for users "/etc/security/limits.etc".

Configure permissions to allow group collaboration

• To change folder group "chgrp groupname folder"
• Allowing write for group "chmod g+w folder"
• Check user group "/etc/group"
• Forcing all files belong to a group, not user "chmod g+s folder"

Granting users and groups sudo access

Check if user has sudo access "/etc/sudoers".

Possible to assign user to "sudo" group.

Authentication tools

PAM (pluggable authentication modules) configuration location is /etc/pam.d folder.

LDAP: Lightweight directory access protocol, you would need server + client.

Packages needed ldap-utils (client), slapd(server).

Reconfigure LDAP server:

dpkg reconfigure ldap-auth-config

To configure LDAP on the machine we need to add changes to "/etc/nsswitch.conf":

• passwd: compat ldap
• group: compat ldap
• shadow: compat ldap

Kerberos needs Key Distribution Center (KDC) to work.

We need krb5-kdc and krb5-admin-server to work with Kerberos.

Теги

• technology