Hot answers tagged

122

Some commands (eg chown) can accept either a username or a numeric user ID, so allowing all-numeric usernames would break that. A rule to allow names that start with a number and contain some alpha was probably considered not worth the effort; instead there is just a requirement to start with an alpha character. Edit: It appears from the other responses ...


74

here is a test on ubuntu 14.04 using numbers: root@ubuntu:~# useradd 232 root@ubuntu:~# mkdir /home/232 root@ubuntu:~# chown 232.232 /home/232 root@ubuntu:~# passwd 232 Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully root@ubuntu:~# login c2 login: 232 Password: Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 4.4.0-22-...


31

There is a utility which will lookup user information regardless of whether that information is stored in local files such as /etc/passwd or in LDAP or some other method. It's called getent. In order to get user information out of it, you run getent passwd $USER. You'll get a line back that looks like: [jenny@sameen ~]$ getent passwd jenny jenny:*:1001:...


19

You have to check man passwd: If the encrypted password is set to an asterisk (*), the user will be unable to login using login(1), but may still login using rlogin(1), run existing processes and initiate new ones through rsh(1), cron(8), at(1), or mail filters, etc. Trying to lock an account by simply changing the ...


19

This is a security risk because file ownership in the FS is stored not by symbolic name, but by UID and GID. If a user is removed and files remain owned by that user, they become inaccessible under owner permission. However, if a different user is later created that is allocated the same UID, that user will gain ownership of the files. This is potentially a ...


13

The accounts with passwords are the accounts with a glob of base64 gibberish in the second field: root:8sh9JBUR0VYeQ:0:0:Super-User,,,,,,,:/:/bin/ksh lp:VvHUV8idZH1uM:9:9:Print Spooler Owner:/var/spool/lp:/bin/sh This computer appears to be using the traditional, DES-based crypt(3) password hash. This hash is quite weak by modern standards; if you can't ...


13

The following should work: sudo useradd -m -k /home/user1/ user2 where -m says create the home dir, and -k provides the skeleton directory to use.


9

A *Nix username is generally a 32 character long string created by the utility useradd. This is, as you said, a direct result of early Unix (BSD technically) standards. According to the FreeBSD Man Page passwd(5): The login name must not begin with a hyphen (`-'), and cannot contain 8-bit characters, tabs or spaces, or any of these symbols: ...


8

This means that it is disabled for direct login. It is a user that is used for running services or to be used for rlogin. Check https://en.wikipedia.org/wiki/Passwd#Password_file


7

Yes. The normal/unprivileged user can write to /tmp and /var/tmp, for legitimate reasons. Also, if the user or group permissions of a given file/directory includes those of the user, he or she can write to those files or directories as well. Having said that, providing write capability to operating system files and directories to a normal user, is shooting ...


6

You can use eval to get someone's home directory. eval echo "~$USER" At least for local users this works for sure. I don't know if remote users like LDAP are handled with eval.


6

Archive::Tar or similar software would be one method. % touch foo % tar cvf x foo foo % tar tvf x -rw-rw-r-- 1 jdoe12 jdoe12 0 May 6 20:36 foo % perl -MArchive::Tar -e '$t=Archive::Tar->new;$t->read("x");$t->chown("foo","root");$t->write("y")' % tar tvf y -rw-rw-r-- 1 root jdoe12 0 May 6 20:36 foo %


6

As @schily says, in the ping utilility (and others), the root permissions are dropped after they are no longer necessary. This is done for security reasons. From ping.c - main() - the user is dropped with the getuid and setuid call. getuid() gets the current user, and root doing a setuid() will change the uid of the process. /* * Pull this stuff up front ...


5

The really right way? Say you want to change user 'peter' to 'paul'. groupadd paul usermod -d /home/paul -m -g paul -l paul peter This changes the name, the group, the home directory and ownership and group of of that directory to the new ones, along with all the files. You end up with a user indistinguishable from having been originally created as 'paul'....


5

An email thread: http://www.sudo.ws/pipermail/sudo-users/2002-September/001225.html http://www.sudo.ws/pipermail/sudo-users/2002-September/001226.html .. points out that sudo -u nobody [cmd ...] can be used: (Combined with the trick of How to append to a file as sudo) echo "Hello World" | sudo -u nobody tee -a /tmp/logfile.log


5

/tmp and possibly /var/tmp are writtable to any users.


4

chage -l <username> Example Output: Last password change : Dec 17, 2015 Password expires : Mar 16, 2016 Password inactive : never Account expires : never Minimum number of days between password ...


4

Using last you can find this information. The following may be useful: last <username> | less It will return something like this: benlavery@Talantinc:bin $>last benlavery | less benlavery ttys005 Mon Aug 31 09:58 still logged in benlavery ttys005 fe80::105e:6b27:29ff:d967%en0 Mon Aug 31 09:14 - 09:36 (00:22) benlavery ...


4

usermod is a tool for modifying the local /etc/passwd database. It cannot be used to modify accounts delivered through Active Directory. id on the other hand looks up any user account regardless of its source. (Actually this is controlled with the passwd setting in nsswitch.conf but if you have integrated AD you'll be using multiple sources.) As mentioned ...


4

Easier to do groups [username] If you want to list all local users and their local groups you can do cat /etc/passwd | awk -F':' '{ print $1}' | xargs -n1 groups If you get "groups: command not found", it is likely you've edited your environmental path for the worse, to reset your path do PATH=$(getconf PATH)


4

You're editing the wrong file, and you're not actually modifying the system accounts database, which is why you aren't seeing any modifications. This is not Linux. The master source file for the accounts database is /etc/master.passwd. /etc/passwd is a Version 7 Unix compatibility file, a subordinate file generated from the source. The actual system ...


4

I figured I can use the following. id -g


4

When extracting files as root, tar will use the original ownership. You can override that using the --no-same-owner option (alternatively, -o). Your tar file referred to user/group which do not exist on the system where you extracted it. If you extract files as yourself (a non-privileged user), you can only create files owned by yourself. The GNU tar ...


3

The account will be setup without login possibilities as there is no valid password assigned to the account, and that is different from no password. You can check this by doing sudo grep -f system-user /etc/shadow. The second field (between the first and second colon (:)) will be a '*' and no hash of any password you can provide will match against that. ...


3

Don't try making the login name longer, you'll probably find loads of places it breaks. Note that you don't have a problem with the number of possible login names (you only get UID_MAX-UID_MIN uids anyway, which is 59,000 on my system). The problem is just with how descriptive they are, but fortunately there's another field intended to be descriptive: the ...


3

Just call useradd and pass it the arguments you want. To create a system user, passs the -r option. If you don't want a home directory, pick something like /none and pass the -M option. If you want to be able to use su to run commands as that user, the user needs to have a valid shell. useradd -r -d /none -M -U -s /bin/sh I don't recommend modifying the ...


3

Most modern Unix systems use PAM to handle authentication. The pam_unix module is the one that does password authentication against /etc/password and /etc/shadow. However, you shouldn't reinvent the wheel. Asking for the user's password and running as root is a basic configuration of sudo, the de facto standard way to elevate privileges. Note that properly ...


3

About your actual question, see taliezin's answer (and accept that one ;) About your other problem: Search for the string 8sh9JBUR0VYeQ on the disk to figure out the disk block(s) it resides in. Then dd that disk block(s) into a file, replace that string with a known password hash (the old crypt() one - same length) and write the disk block(s) back to the ...


3

Reset the user by moving everything in /home/faultyuser to a backup directory like this: mkdir /home/faultyuser/BACKUP mv /home/faultyuser/* /home/faultyuser/BACKUP mv /home/faultyuser/.* /home/faultyuser/BACKUP cp -v /etc/skel/.[a-z]* /home/faultyuser/ chown faultyuser:faultyuser /home/faultyuser/.* and try to login. When this works, move all you need ...


3

Reading between the lines, what you want to configure is two-factor authentication. This will require an additional "piece of information" in addition to the password for the user to log in. There are a multitude of ways of implementing it, but a few popular options are: The open source Google Authenticator. Using a third party product like YubiKey - see ...



Only top voted, non community-wiki answers of a minimum length are eligible