Hot answers tagged users
43
There's probably an easier way, but I do this:
See who's logged into your machine -- use who or w:
> who
mmrozek tty1 Aug 17 10:03
mmrozek pts/3 Aug 17 10:09 (:pts/2:S.0)
Look up the process ID of the shell their TTY is connected to:
> ps t
PID TTY STAT TIME COMMAND
30737 pts/3 Ss 0:00 zsh
Laugh at their ...
27
For the same reasons why each daemon should have minimal rights. Apache can run as root. It is designed to perform one task and surely nothing bad can happen?
But assume apache is not bug-free. Bugs are discovered from time to time. Sometimes it can even be arbitrary code execution or similar. Now with apache running as root, it can access anything — for ...
27
When booting, append init=/bin/bash (or a path to any other functional shell) to your boot options - you will be dropped straight to a single user shell. You might need to do mount -o remount,rw / before modifying the /etc/passwd entry in that environment. After that, just reboot or do exec /sbin/init 3. Just do not type exit or press Ctrl+D, as these would ...
25
passwd -l
is what you want.
That will lock the user account. But you'll still be able to
su - user
but you'll have to su - user as root.
Alternatively, you can accomplish the same thing by prepending a ! to the user's password in /etc/shadow (this is all passwd -l does behind the scenes). passwd -u will undo it.
22
Try
usermod -m -l <new-login-name> -d <new-home-dir> <old-login-name>
The -m option moves the old home directory's contents to the new one given by the -d option which is created if it doesn't already exist. See the man page for more info:
man usermod
17
TL;DR: No, password are stored as hashes which can (in general) not be recovered.
Linux doesn't store plain-text passwords anywhere by default. They are hashed or otherwise encrypted through a variety of algorithms. So, in general, no, this isn't possible with stored data.
If you have passwords stored somewhere other than the /etc/passwd database, they ...
16
How about using the su command?
$ whoami
user1
$ su - user2
Password:
$ whoami
user2
$ exit
logout
If you want to log in as root, there's no need to specify username:
$ whoami
user1
$ su -
Password:
$ whoami
root
$ exit
logout
Generally, you can use sudo to launch a new shell as the user you want; the -u flag lets you specify the username you want:
$ ...
16
Under no circumstances would anyone want to do that. This is what sudo is for, to give users the ability to run things as root. Giving a non-root user all the permissions of root is inadvisable because they would then be able to do literally anything, so if that user account was hijacked, you'd be in trouble.
Summary of above: Don't try to give the user ...
16
On Debian, the adduser package contains a deluser program which removes a user from a group if you pass both as arguments:
deluser user group
If your distribution doesn't have adduser, you can edit /etc/group and /etc/gshadow manually.
vigr
vigr -s
15
For past logins:
last "$USER_NAME"
Also, the command who lists current logins.
If you're looking for the date of the user's last login, some systems provide it directly, for example lastlog -u "$USER_NAME" on Linux or lastlogin "$USER_NAME" on FreeBSD. It's also available in the output of finger, but not in an easy-to-parse form. In any case, it's ...
15
root is a user (the super user) and wheel is a group (of super users I guess).
chown root:wheel myfile
means making myfile belong to the user root and the group wheel (read man chown for more information).
15
Well, OpenSSH private keys with empty passphrases are actually not encrypted.
Encrypted private keys are declared as such in the private key file. For instance:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,7BD2F97F977F71FC
BT8CqbQa7nUrtrmMfK2okQLtspAsZJu0ql5LFMnLdTvTj5Sgow7rlGmee5wVuqCI
...
15
ulimit is made for this.
You can setup defaults for ulimit on a per user or a per group basis in
/etc/security/limits.conf
ulimit -v KBYTES sets max virtual memory size. I don't think you can give a max amount of swap. It's just a limit on the amount of virtual memory the user can use.
So you limits.conf would have the line (to a maximum of 4G of ...
13
You probably did a copy that preserved the original group and owner of these files. Within linux internally the owner and group is basically just an id (in your case, the number 515). This id is then mapped on a group and user name listed in /etc/passwd or /etc/group. You will see that in those files, you can find the name of the user and also the id used ...
13
When you delete a user, the user information is completely removed, so there is no direct information that that ID was ever used.
(The authoritative user information is stored in /etc/passwd, which is a simple list.)
To prevent this, either
force another ID when creating new users, or
keep the user entry around (just disable logins) as long as you ...
13
/etc/passwd shows each user's primary group. /etc/group shows users who have a given group as one of their supplementary groups. For example, my username dan has the group dan as its primary group, so that is what appears in the group field in /etc/passwd. The user dan is also in the groups wheel, mailadmin and svn, so the entries for those groups in ...
12
By looking at /etc/passwd in the backups taken of your system from the day/week/period before the user deletion.
If userdel was used with -r, then both the home directory and user's mail spool have gone. If it wasn't used with -r, check for the user's mail spool, or perhaps a crontab if you're very lucky.
If there are no backups, and no obvious files ...
12
You are thinking that the !, * or x has a special meaning here, and are therefore worrying that there might be some distinction among them.
The fact is that these characters are chosen simply because they stand out, at least to the eyes of those who developed Unix and its descendants. To Western eyes, these characters all have a connotation of "missing" or ...
11
I wrote this little script a few years ago and have been using it ever since. If anything, it's an interesting abuse of printf and uses a lovely feature of BASH that I unfortunately rarely see in scripts: typeset.
#!/usr/bin/env bash
# Released into public domain
# Aaron Bockover, 2005
# http://abock.org
typeset -i length; length=$1
typeset -i rounds; ...
11
The correct way according to usermod(8) is:
usermod --lock --expiredate 1970-01-01 <username>
(Actually, the argument to --expiredate can be any date before the current date in the format YYYY-MM-DD.)
Explanation:
--lock locks the user's password. However, login by other methods (e.g. public key) is still possible.
--expiredate YYYY-MM-DD ...
11
Why do I need to use newgrp or su (or logout and login again) to have new group memberships applied?
When a child process is created, process user id and group ids are inherited from his parent process.
So when you change your user's groups (actually change config files somewhere on the disk) processes won't automatically notice it and change their group ids (non-root processes don't have rights for that anyway).
And when you start bash... well, you just ...
11
Usernames on Unix aren't significant. Only numeric user IDs are. The numeric ID of root is always 0. That is hard-coded all over the place (in the kernel, in utilities, etc.).
You can find your numeric user ID by running id.
Note that your numeric user ID is a property of the running process. When you login, the process you login through (login, sshd, ...
11
/etc/passwd is sometimes called the user database. That should give us a clue as to why it needs to be readable by everyone. Any utility that inspects file metadata needs to be able to read /etc/passwd (and /etc/group) in order to be able to resolve the numerical IDs used by the kernel and its subsystems to the human-friendly names that we rely on. Tools ...
10
Apart from the obvious point of security, it is clear you've never hosed your system by mistyping a command in the shell or a lapsus. If it happens, you'll understand why people freak out about it. And then you will cry in horror, and also realize that it was a highly educational experience, but you're not getting your system back anyway.
A thought: if ...
10
Personally I prefer not to use password generator as password generated are very hard to remember :-).
But one portable solution could be to use /dev/random
Creating random passwords which contains no special characters, is 10 characters long
cat /dev/urandom| tr -dc 'a-zA-Z0-9' | fold -w 10| head -n 1
dyxJRKldvp
Creating random passwords ...
10
In short, yes, this is possible. The relevant search string you are looking for is "Multi-seat X".
The Ubuntu wiki, Gentoo wiki, Debian wiki and Arch wiki all have articles related to multi-seat X. A number of other articles can be found on the Xorg wiki page on multiseat and even more can be found on google.
From what I can tell from these articles, ...
10
Use of passwd -d is plain wrong , at least on Fedora, on any linux distro based on shadow-utils. If you remove the password with passwd -d, it means anyone can login to that user (on console or graphical) providing no password.
In order to block logins with password authentication, run passwd -l username, which locks the account making it available to the ...
10
According to the FAQ:
In FreeBSD's case, the reason is that csh is the only shell "guaranteed" to be on the base filesystem (stuff from ports usually winds up in /usr/local/bin, which defaults to a different filesystem). This is important because you don't ever want there to be a situation where root can't log in because it's using a shell on a different ...
10
su (mostly) uses pam for authentication and pam has a module called pam_wheel which checks group membership of the authenticating user. In short, by adding
auth required pam_wheel.so group=becomeroot
to the file /etc/pam.d/su, only users who are members of the group becomeroot may become root using su. Now you make sure only your user EMERG is a ...
9
From https://github.com/zolrath/wemux:
wemux enhances tmux to make multi-user terminal multiplexing both
easier and more powerful. It allows users to host a wemux server and
have clients join in either:
Mirror Mode gives clients (another SSH user on your machine) read-only
access to the session, allowing them to see you work, or
Pair Mode ...
Only top voted, non community-wiki answers of a minimum length are eligible
