dcsimg

User and Group Management 101

Whether you're new to managing users and groups or just need a quick refresher, this tutorial will sharpen your sys admin chops.

OK, class settle down, find your seats, fire up your Linux systems and follow along with me for this user and group administration tutorial. This article is your short course on user and group administration using some commands that you’ve perhaps never seen or used before. User management doesn’t have to induce hair pulling (yours or theirs) nor does it have to make you hate user’s existence. Following a single, simple rule will make your life as a system administrator easier: Give your users access to what they need, no more and no less.

Any salty system administrator (SA) will tell you that you’re supposed to manage users with group permissions, and that’s true, but you still have to create those users, place them into groups, remove users and manage user access. It is these basic user management activities that you’ll explore in this week’s post.

Group Commands

Let’s appease those rusty old system administrators by first learning about groups and how to manage them. Group definitions reside in the /etc/group file. A standard Linux /etc/group file contains the following information: groupname:x:groupid:user list.

The “x” in the group definition file is a deprecated placeholder for a group password.

To find out which groups you belong to, type groups at a command prompt.

$ groups
khess rdpusers

By default on most Linux systems, when an administrator creates a new user account, the system automatically creates a group account with the same name as the user account. An SA can specify a group when he creates the account but the group must already exist.

Here are two illustrative examples:

# useradd fred

# grep fred /etc/passwd
fred:x:504:506::/home/fred:/bin/bash

# grep fred /etc/group
fred:x:506:
# useradd -g 100 -c "Bob Alobdob" bob

# grep bob /etc/passwd
bob:x:505:100:Bob Alobdob:/home/bob:/bin/bash

# grep bob /etc/group
#

Why did the system return no response when you typed in grep bob /etc/group? It’s because the users group is Bob’s primary group. If users were a secondary group, Bob’s username would appear in the list. For example, create a new user with rpdusers (Group ID 504) as a secondary group.

# useradd -G 504 -c "Jon Shmon" john

# grep john /etc/passwd
john:x:506:507:Jon Shmon:/home/john:/bin/bash

# grep john /etc/group
rdpusers:x:504:khess,john
john:x:507:

A group must exist before you assign users to it. The groupadd command creates new groups with a specific Group ID (GID) and name.

# groupadd -g 1040 accounting

# grep 1040 /etc/group

accounting:x:1040:

You may also create a new group with just a group name and the system will assign a GID for you with the command, # groupadd groupname.

The groupmod command allows you to change the group name but the SA will have to change any files associated with the old group manually.

# groupmod -n accounting beancounters
# grep 1040 /etc/group
beancounters:x:1040:

Note: Don’t confuse chgrp (changes group permissions) with groupmod (changes the name of a group).

You can remove a group with the groupdel command.

# groupdel beancounters

If you prefer to edit configuration files directly, although you shouldn’t, the vigr command edits the /etc/group file in a safe manner by setting locks so that only one administrator at a time can edit the file.

Administrators rely heavily on the “group” commands for group administration, user administration and in scripting those functions for automated solutions.

User Commands

I call this collection of utilities the “user” commands because their functionality centers on user administration and not on action taken by the users themselves. Even if a user knows the location of these commands (/usr/sbin), they still can’t issue them without root privilege.

For example, a clever user on your system tries to issue useradd and vipw.

$ /usr/sbin/useradd steve
useradd: Only root may add a user or group to the system.

$ /usr/sbin/vipw
vipw: Couldn't lock file: Permission denied
vipw: /etc/passwd is unchanged

The User commands have their Group analogs; you add a new user with useradd, modify a user account with usermod and delete a user account with userdel. And you edit the /etc/passwd file directly with vipw. You’ve already seen the useradd command in action in the Group Commands discussion.

The usermod allows SAs to alter any user account attribute including the user’s real name (comment field), home directory name, account expiration date, disabling functionality, group add and change, login name, account locking and unlocking, alter the user’s shell and more.

# grep khess /etc/passwd
khess:x:500:500:Kenneth Hess:/home/khess:/bin/bash

# usermod -c "Ken Hess" khess

# grep khess /etc/passwd
khess:x:500:500:Ken Hess:/home/khess:/bin/bash

The usermod command requires some restraint and careful typing when issuing commands that can make a user account unusable. Let’s say that Bob Alobdob, from an example in the Group discussion, wants his login name and home directory changed to robert.

# usermod -d "/home/robert" -m -l robert bob 

# grep robert /etc/passwd
robert:x:505:100:Bob Alobdob:/home/robert:/bin/bash

Notice how I explicitly entered “/home/robert” in the command? If you don’t specify the whole path, Robert won’t have a home directory nor will its contents exist anymore. The command, as shown, changes his current home directory from /home/bob to /home/robert, his login from bob to robert and the -m moves the contents of his “bob” home directory to his “robert” home directory. User permissions change to robert as well for all files in his home directory.

Note: You cannot change the login name of a currently logged in user.

The userdel command’s function might seem obvious to you but you might surprise yourself after issuing the command to find that the user’s home directory is still intact.

Why would any programmer allow that directory to remain as clutter on your home filesystem? This is actually a failsafe mechanism and you should thank the thoughtful programmer who maintains userdel.

What if two user names only differ by a single letter and you removed the wrong one? The incorrectly deleted user’s home directory and files were wiped from the system with a slip of your finger. With the failsafe mechanism in place, you have to manually remove the home directory and hopefully you would catch your error before doing so.

This introduction to user and group administration will point you in the right direction in your own duties as a new system administrator. Remember to think in terms of groups and add users to those groups as needed. Use the administrative tools and utilities provided to you and avoid directly editing any system file.

Have you ever wanted to see more information from your system than proc files or dmesg could give you? Well, your search is over. There are native tools that give you more than you imagined and we’ll have a look at them next week.

Comments on "User and Group Management 101"

We came across a cool web page which you may possibly take pleasure in. Take a look when you want.

Always a significant fan of linking to bloggers that I really like but don?t get quite a bit of link adore from.

Every as soon as inside a when we pick out blogs that we read. Listed beneath are the latest websites that we select.

We came across a cool internet site which you may well appreciate. Take a appear for those who want.

Wonderful story, reckoned we could combine a number of unrelated information, nonetheless definitely really worth taking a look, whoa did one discover about Mid East has got much more problerms too.

Every when in a while we pick out blogs that we study. Listed below are the newest sites that we decide on.

Very handful of web-sites that transpire to be detailed beneath, from our point of view are undoubtedly well really worth checking out.

Below you will obtain the link to some web pages that we believe you’ll want to visit.

Here are some links to web-sites that we link to since we consider they may be really worth visiting.

The time to study or stop by the material or sites we have linked to below.

Check below, are some completely unrelated sites to ours, nevertheless, they may be most trustworthy sources that we use.

Just beneath, are several absolutely not related internet sites to ours, nonetheless, they may be surely worth going over.

The time to read or check out the content or websites we’ve linked to below.

The time to read or visit the content or sites we have linked to beneath.

One of our guests not long ago recommended the following website.

Below you?ll locate the link to some websites that we assume you must visit.

Every as soon as in a though we pick out blogs that we study. Listed beneath would be the latest sites that we choose.

Please visit the web pages we adhere to, which includes this one particular, as it represents our picks in the web.

Here are some links to sites that we link to mainly because we assume they may be really worth visiting.

Here are several of the web pages we advocate for our visitors.

Below you will find the link to some websites that we assume it is best to visit.

The time to read or check out the material or sites we have linked to below.

Please stop by the web sites we stick to, which includes this 1, because it represents our picks from the web.

The time to study or visit the material or web sites we’ve linked to below.

Here are a few of the web sites we recommend for our visitors.

Here is an excellent Weblog You might Uncover Interesting that we encourage you to visit.

The time to read or pay a visit to the content or sites we have linked to beneath.

We like to honor many other internet websites on the net, even if they aren?t linked to us, by linking to them. Beneath are some webpages really worth checking out.

Usually posts some very intriguing stuff like this. If you are new to this site.

Here is a great Blog You might Obtain Fascinating that we encourage you to visit.

Always a large fan of linking to bloggers that I enjoy but really don’t get a lot of link enjoy from.

Check below, are some completely unrelated sites to ours, even so, they may be most trustworthy sources that we use.

Please take a look at the internet sites we adhere to, including this a single, because it represents our picks in the web.

Here is a great Blog You may Come across Interesting that we encourage you to visit.

You are my aspiration, I possess few web logs and infrequently run out from to brand : (.

Below you will discover the link to some web pages that we feel you need to visit.

I’ve been surfing online greater than 2 hours today,
yet I never found any interesting article like yours.
It’s pretty worth enough for me personally. In my view, if
all web owners and bloggers made good content while you did, the net will be considerably more useful than ever before.

My web blog … EdwinZBorson

Wonderful story, reckoned we could combine a few unrelated information, nevertheless seriously really worth taking a look, whoa did a single study about Mid East has got extra problerms too.

The time to read or stop by the content material or web sites we’ve linked to below.

Very handful of web sites that happen to be in depth beneath, from our point of view are undoubtedly effectively really worth checking out.

Usually posts some very exciting stuff like this. If you?re new to this site.

Below you will obtain the link to some sites that we consider you need to visit.

Wonderful story, reckoned we could combine a couple of unrelated information, nonetheless definitely worth taking a appear, whoa did one particular master about Mid East has got additional problerms too.

The time to study or check out the content or sites we’ve linked to beneath.

Check beneath, are some totally unrelated internet websites to ours, on the other hand, they’re most trustworthy sources that we use.

Very handful of internet websites that come about to become comprehensive beneath, from our point of view are undoubtedly nicely really worth checking out.

The info mentioned in the write-up are a number of the most beneficial out there.

That is the finish of this write-up. Right here you will uncover some web pages that we consider you?ll value, just click the hyperlinks.

Here are some of the internet sites we recommend for our visitors.

Always a huge fan of linking to bloggers that I appreciate but don?t get a lot of link love from.

Leave a Reply