Tag Info

Hot answers tagged

40

The devil is in the details, in the useradd man page (you can see that by issuing man 8 useradd): -u, --uid UID The numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be non-negative. The default is to use the smallest ID value greater than or equal to UID_MIN and greater ...


17

First off, the respective man page snippets highlight the differences between the two commands and give some indication of what is going on. For adduser: adduser and addgroup add users and groups to the system according to command line options and configuration information in /etc/adduser.conf. They are friendlier front ends to the low level ...


15

Add the following in your ~/.ssh/config file: Host myserver.cz User tohecz Host anotherserver.cz User anotheruser You can specify a lot of default parameters for your hosts using this file. Just have a look at the manual for other possibilities.


13

Use su: su - alice sudo vim /etc/hosts From man su: The su command is used to become another user during a login session. Invoked without a username, su defaults to becoming the superuser. The optional argument - may be used to provide an environment similar to what the user would expect had the user logged in directly. For more ...


11

This is done for 2 reasons. Security and auditing. From a security perspective each service is put into it's own "silo" so that it can be given access to only the resources it needs on the system. These resources can be diskspace, access to files, or allocations of RAM or CPU. Additionally each service can be walled off from every other service so that ...


11

You can try to find the relevant files with find: find /usr/something -maxdepth 1 -user antoine You can then use -exec to create a zip file from the results of find: find /usr/something -maxdepth 1 -user antoine -exec zip /tmp/file.zip {} + leave out the maxdepth if you want to recurse.


10

useradd You can control how long a user's account is valid through the use of the --expiredate option to useradd. excerpt from useradd man page -e, --expiredate EXPIRE_DATE The date on which the user account will be disabled. The date is specified in the format YYYY-MM-DD. If not specified, useradd will use the default expiry date ...


10

You can't have several users with the same UID. If they have the same UID, then they're the same user. What you have is multiple entries in the user database for the same user. That's possible in all unix variants I've seen. The user name determines which entry is used and thus which password, home directory and shell applies at login time. The first entry ...


9

Pass the user name through the -o User option, or through the equivalent User directive in the client configuration file (~/.ssh/config). sftp -o Port:8777 -o User=user@domain.com domain.com This applies to ssh, scp and sshfs as well. Using the configuration file instead of -o options has the advantage of also working with tools that call ssh and don't ...


9

I don't believe there is any inherent risk, this is something that is done simply to create separation between what are considered system accounts and user accounts. The practice of using numbers below 500, from my experience is a Redhat-ism, and really nothing more than that. On Solaris I'd seen users being assigned numbers starting at 100 as well, only to ...


9

In POSIX, every running process has three User IDs (UIDs) associated with it; the real UID, which identifies the user who launched the process, the effective UID, which is used to determine what resources the process can access, and the saved Set-User-ID (SUID), which is the effective UID the process had when it started (at the point of the last exec() ...


8

I always run services with a dedicated user. So I would create these users: nginx mongo apache mysql redis You should never run the actual services as root! Often when installing these applications using your distributions package manager, as part of the installation, a user will be automatically created for each of these services. I typically use ...


8

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == ...


8

You can read the source code; speaking of... I did it for you; it looks like it's from the ProcessInfo.cpp file. It's getting the usernames. Not only that /etc/passwd isn't a concern for you, anyone can read it. You might be worried though if it was trying to read /etc/shadow.


7

That is not a technical difference but an organizational decision. E.g. it makes sense to show normal users in a login dialog (so that you can click them instead of having to type the user name) but it wouldn't to show system accounts (the UIDs under which daemons and other automatic processes run) there. Thus a border is defined or rather two ranges for ...


7

The following will work with GNU find and awk: find /path -type f -printf '%u %k\n' | awk '{ arr[$1] += $2 } END { for ( i in arr ) { print i": "arr[i]"K" ...


7

You can add a file to the system's /etc/profiile.d directory that includes a if/then statement for each of the users that you want to run the virtualenv for. Example Say I create a file like this, /etc/profile.d/me.sh. if [ "$USER" == "saml" ]; then touch /tmp/samsfile fi Make it executable: $ chmod +x /etc/profile.d/me.sh And then login as saml, ...


7

Add zsh to /etc/shells: command -v zsh | sudo tee -a /etc/shells You can now use chsh to set zsh as shell: sudo chsh -s "$(command -v zsh)" "${USER}" See this documentation: Changing your login shell


7

You should restart your machine and replace init with bash: Reboot the computer and hold Shift, so that the grub menu appears: Highlight the second entry and press e Use ↓ to go to the line stating with linux, then use → to go to ro and change it in rw, remove everything after that with init=/bin/bash Following the instructions at the ...


6

The presence of system account such as root, sys, nobody, bin, daemon, etc. has been the topic of many security audits that I've been through over the years and it really comes down to a few things. Yes these types of accounts can be security holes, especially if they have a shell enabled: Bad bin:x:1:1:bin:/bin:/bin/sh Good ...


6

I had a look at the POSIX documentation expecting to find a list of reserved usernames and was surprised that no such list exists in the standard (not even root!). However, in my opinion you should regard all the usernames on your system with UIDs less than 1000 to be reserved names. This is the kind of change that, while possible, could cause problems ...


6

Terminal details It lists a user for each physical and virtual terminal that they have. virtual, aka. pseudo terminals (pts#) physical, (:0 and/or tty#) NOTE: The # above is an actual number like 1,2,3,etc. Every time you open a tab in gnome-terminal counts as a virtual terminal. Logged into your system using tty terminals. These are accessible using ...


6

Using strace you can see what konsole is up to. $ strace -s 2000 -o konsole.log ... ... open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=2655, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f316d8fc000 read(3, ...


5

While it's technically possible, it is probably not a good idea. You would have to audit all the code on your system to check if any of it has the root user name hard-coded. While the recommended practice for e.g. shell scripts is to check the user ID (if it's zero, you are root) or check for the actual privilege you require (if you can write a file where ...


5

It may be the case that your colleague, while creating the account, created the home directory "by hand" which resulted in it being owned by root. Try running the following as root: chown -R username ~username chgrp -R $(id -gn username) ~username Where username is the name of the problematic account. Edit If this turns out to be your problem, to avoid ...


5

Put some text into the file ~/.plan and try finger again: $ finger yeti Login: yeti Name: yeti Directory: /arpa/tz/y/yeti Shell: /bin/ksh On since Wed Apr 2 15:24 (UTC) on pts/149 Mail last read Mon Mar 31 11:08 2014 (UTC) No Plan. $ echo Mwhuaaaaahahahahahahahahahaaaa... > ...


4

Folder b and c are owned by user b and c. A file created by a user will belong to that user. You can use the user permission for b and c, and the group permissions for a. If you set the SGID bit (g+s) on a folder, created files will get the group permission of that folder. mkdir a chown a:a a chmod g+s a mkdir b chown b:a b mkdir c chown c:a c ...


4

The main difference is the purpose of the account, so it's primarily a useful distinction for administrators and auditors. There are a few technical differences — from the adduser documentation: System users will be created with no aging information in /etc/shadow, and their numeric identifiers are chosen in the SYS_UID_MIN–SYS_UID_MAX range, defined in ...


4

The problem is that the default shell for a new user on Debian is /bin/sh so most of the features you're used to from bash aren't there. Try adding -s /bin/bash to your useradd command. You can also change the default shell permanently by editing /etc/default/useradd. Edit: The solution to automatically modify the password (as found by MountainX) is here


4

Apparently, you can. I never tried it myself, but jailkit seems to fit the bill. It doesn't seem to have been pre-packaged for Debian, so your only option is to build from source if you're on Debian or any of its children. Thanks to @terdon's comment, we know it's been packaged as RPM and as a source package for Arch. @terdon's links: RPM package Arch ...



Only top voted, non community-wiki answers of a minimum length are eligible