Tag Info

Hot answers tagged

21

First off, the respective man page snippets highlight the differences between the two commands and give some indication of what is going on. For adduser: adduser and addgroup add users and groups to the system according to command line options and configuration information in /etc/adduser.conf. They are friendlier front ends to the low level ...


16

Add the following in your ~/.ssh/config file: Host myserver.cz User tohecz Host anotherserver.cz User anotheruser You can specify a lot of default parameters for your hosts using this file. Just have a look at the manual for other possibilities.


16

There's no difference between an external drive and an internal drive in terms of the filesystem stored on it. The owner & group of the filesystem's root directory are stored in its root directory, the same way your root filesystem's owner & group are stored. A corollary of this is that because UIDs and GIDs are stored only numerically, if you ...


13

Use su: su - alice sudo vim /etc/hosts From man su: The su command is used to become another user during a login session. Invoked without a username, su defaults to becoming the superuser. The optional argument - may be used to provide an environment similar to what the user would expect had the user logged in directly. For more ...


11

This is done for 2 reasons. Security and auditing. From a security perspective each service is put into it's own "silo" so that it can be given access to only the resources it needs on the system. These resources can be diskspace, access to files, or allocations of RAM or CPU. Additionally each service can be walled off from every other service so that ...


11

You can try to find the relevant files with find: find /usr/something -maxdepth 1 -user antoine You can then use -exec to create a zip file from the results of find: find /usr/something -maxdepth 1 -user antoine -exec zip /tmp/file.zip {} + leave out the maxdepth if you want to recurse.


11

The major difference between sudo and su is the mechanism used to authenticate. With su the user must know the root password (which should be a closely guarded secret), while with sudo the user uses his/her own password. In order to stop all users causing mayhem, the priviliges discharged by the sudo command can, fortunately, be configured using the ...


10

You can't have several users with the same UID. If they have the same UID, then they're the same user. What you have is multiple entries in the user database for the same user. That's possible in all unix variants I've seen. The user name determines which entry is used and thus which password, home directory and shell applies at login time. The first entry ...


10

As your system has been compromised, no information you get from that system can be trusted. Only logs that are immediately shipped off to an external system can be trusted (such as real time remote syslog). Meaning if you've got some nightly log rotation to an NFS share, you cannot trust it. However it is possible the user did not bother covering his/her ...


9

In POSIX, every running process has three User IDs (UIDs) associated with it; the real UID, which identifies the user who launched the process, the effective UID, which is used to determine what resources the process can access, and the saved Set-User-ID (SUID), which is the effective UID the process had when it started (at the point of the last exec() ...


9

Add zsh to /etc/shells: command -v zsh | sudo tee -a /etc/shells You can now use chsh to set zsh as shell: sudo chsh -s "$(command -v zsh)" "${USER}" See this documentation: Changing your login shell


8

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == ...


8

You can read the source code; speaking of... I did it for you; it looks like it's from the ProcessInfo.cpp file. It's getting the usernames. Not only that /etc/passwd isn't a concern for you, anyone can read it. You might be worried though if it was trying to read /etc/shadow.


8

I'm not sure how standard it is, but at least in Ubuntu systems sudo sets the following environment variables (among others - see the ENVIRONMENT section of the sudo manpage): SUDO_UID Set to the user ID of the user who invoked sudo SUDO_USER Set to the login of the user who invoked sudo for example, steeldriver@lap-t61p:~$ sudo sh -c ...


8

In Linux/Unix the user with user id 0 is such a super administrator. The user is usually called "root", but the magic is really behind the id and not the name. That user is especially not bound to local file access permissions and can read and write any file. That user also has the ability to change to any other user without needing a password.


7

You should restart your machine and replace init with bash: Reboot the computer and hold Shift, so that the grub menu appears: Highlight the second entry and press e Use ↓ to go to the line stating with linux, then use → to go to ro and change it in rw, remove everything after that with init=/bin/bash Following the instructions at the ...


7

You basically have 2 options. Use the local authentication system of each machine, and push out credential changes to all of them. Use a centralized authentication server. 1. Synchronized local authentication There are multiple products which accomplish this easily. Puppet, Chef, Ansible, and Salt are a few of the more common ones. All these tools fall ...


6

The man page of passwd(1) says about passwd -l: Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account's expire date to Jan 2, 1970). So usermod --expiredate 1 [LOGIN] ...


6

Non-chroot access If you don't have a FTP server setup, and you trust the user that will be logging in, not to go poking around your server too much, I'd be inclined to give them an account to SFTP into the system instead. The CentOS wiki maintains a simple howto titled: Simple SFTP setup that makes this pretty pain free. I say it's pain free because you ...


6

Using strace you can see what konsole is up to. $ strace -s 2000 -o konsole.log ... ... open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=2655, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f316d8fc000 read(3, ...


6

Yes, it's normal. The root user can do anything (including, say, changing a user's password, logging in as them, and changing it back), so they aren't restricted by su (or sudo). That includes password prompts and any other restrictions. The PAM configuration can be set up to have su present certain prompts to the root user still, for example encryption ...


6

There are two commands related to root privileges, SUDO and SU. With SUDO, you don't become another user (including root). SUDO has a pre-defined list of approved commands that it executes on your behalf (this addresses what I asked in the comment about how you give selected users selective privileges). Since you are not becoming root or another user, you ...


6

Use the who comand. It lists all logged-in users. It's not just SSH users, it will also list users on the console and directly-connected terminals (if you have any). For SSH users, it will show where they're connected from.


5

With zsh: zip mine.zip ./*(.U) to zip my (regular) files. zip antoine.zip ./*(.u:antoine:) to zip antoine's


5

Using only features available on AIX or other POSIX-and-hardly-more systems: find /usr/something/* /usr/something/.[!.]* /usr/something/..?* \ -prune -type f -user antoine -exec zip -r /tmp/file.zip {} + find recurses into subdirectories. To avoid that, -prune tells it to not descend into the directories it encounters. That's no good if I run find ...


5

Put some text into the file ~/.plan and try finger again: $ finger yeti Login: yeti Name: yeti Directory: /arpa/tz/y/yeti Shell: /bin/ksh On since Wed Apr 2 15:24 (UTC) on pts/149 Mail last read Mon Mar 31 11:08 2014 (UTC) No Plan. $ echo Mwhuaaaaahahahahahahahahahaaaa... > ...


5

For the same reason ls -l reads /etc/passwd, it is the data that associates UIDs with names. When ls calls stat(2) on a file it gets a numeric UID for the owner of the file. In order to display that as a human readable name, it needs to look it up in the only place that has those associations, /etc/passwd. For example a typical first line in /etc/passwd is ...


5

If the server has getent, and allows users to view such information, you may be able to use getent group stat_bs. This will give you a list of users, separated by commas. If getent group is disallowed, you still might be able to read the passwd database with getent passwd. You can then correlate the GID (the fourth column) with the desired group.


5

Yes, by using ACL. (if not avail, install via yum install acl) Edit: Before you start setting ACL, you initially need to enable ACL support for filesystem, for doing it manually use: mount -o remount,acl $filesystem But you need to enter this command every time you boot the system. To avoid this, it can be enabled when the filesystem is mounted, ...


5

That's how sudo works. You trust the user and the user's actions are logged. If you want to enter the root password, then you want to use the su command as follows:- su -c yum install <package> Password: Once the command above finishes, you're returned to your normal user's prompt.



Only top voted, non community-wiki answers of a minimum length are eligible