A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.
29

useradd You can control how long a user's account is valid through the use of the --expiredate option to useradd. excerpt from useradd man page -e, --expiredate EXPIRE_DATE The date on which the user account will be disabled. The date is specified in the format YYYY-MM-DD. If not specified, useradd will use the default expiry date ...


26

You may put default configurations in /etc/skel so that useradd(8) can copy files in /etc/skel whenever it creates new user's directory by '-m' option. Note that this is used only for the new-user. Existing user accounts are not affected.


23

User accounts are used not only for actual, human users, but also to run system services and sometimes as owners of system files. This is done because the separation between human users' resources (processes, files, etc.) and the separation between system services' resources requires the same mechanisms under the hood. The programs that you run normally run ...


18

User accounts are used by real users, service accounts are used by system services such as web servers, mail transport agents, databases etc. By convention, and only by convention, service accounts have user IDs in the low range, e.g. < 1000 or so. Except for UID 0, service accounts don't have any special privileges. Service accounts may - and typically ...


14

Check out Why does the 'bin' user need a login shell? It says this pattern for system users is Common in Debian, and not so much in other distributions. Considered a bug / genuine security issue by several people. Required in order to run cron jobs as that user, and perhaps also by some scripts if they use su -c to run as this user. It should be ...


13

This is done for 2 reasons. Security and auditing. From a security perspective each service is put into it's own "silo" so that it can be given access to only the resources it needs on the system. These resources can be diskspace, access to files, or allocations of RAM or CPU. Additionally each service can be walled off from every other service so that ...


13

Per-user groups I too don't see a lot of utility in per-user groups. The main use case is if a user wanted to allow "friends" access to their files, they can have the friend user added to their group. Few systems I've encountered actually use it this way. When USERGROUPS_ENAB in /etc/login.defs is set to "no", useradd adds all the created users to the ...


13

When you create the account, create a file named ~/.not_logged_in_yet. It doesn't have to have any contents, the file just needs to exist: touch ~user/.not_logged_in_yet # create the file chown user ~user/.not_logged_in_yet # should be owned by the user chmod u+rw ~user/.not_logged_in_yet # user must be able to delete it Then, create a script ...


11

Yes. /root has 700 permission (rwx------) whereas / has 555 (r-xr-xr-x) permissions for all users. Now if you use various common utilities you would have /root/.config with rwxr-xr-x permissions. If you were in /, that directory becomes accessible to anyone on the server, whereas if it was in /root it would not be. Having root's data accessible to any user ...


10

The kernel doesn't know anything about users other than their numerical ID as a tag on certain things (processes, files). It doesn't have a notion of “log in”, that happens in user land. The program that handles the login process (login on a text mode console, a display manager on a graphical console, a daemon such as sshd or telnetd for remote logins, etc.)...


9

It turns out it's quite simple with GDM. I assume you're using GDM since you're also using Gnome. First, create the guest user account with a blank password: sudo useradd -d /tmp/guest -p $(openssl passwd "") guest The openssl passwd "" will return the hash of the empty string, thereby setting the password to blank. Now, all you need are these two ...


8

First of all, valid shells are listed in /etc/shells. Any user can change their default shell by using chsh as long as it's in the /etc/shells file. Second, if you want to add a shell to /etc/shells you can, if you remove an entry from there, especially /bin/sh you are probably going to screw up the system, because /bin/login will NOT normally launch off ...


8

First grep all the 'test' user's process and kill -9 all pid's then delete the user. pgrep -u test ps -fp $(pgrep -u test) killall -KILL -u test userdel -r test


8

If you need information of 20 last logged-in users you can use: last -20 -w to display full hosts, or last -20 -i to display IP numbers.


8

It's best to first look in /etc/sudoers for lines that look like: ## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL ## Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL It's the "wheel" group on CentOS and "admin" on Ubuntu. If you are OK with giving this user all root powers, just make them a ...


7

I presume you're finding this list of users by checking /etc/passwd? This is totally normal - 'users' serve to carry a set of permissions, useful for locking down not just 'actual users' but also programs to certain areas of your system and tracking what they changed (same concept with groups). I've inserted one of my Raspberry Pi /etc/passwd files below ...


7

You submit a support call to IBM who then give you the hscpe user password, which is good for one day. That user ID and password allows you to gain access to root (assuming you recorded the root password when you installed the HMC). Then you can cat /etc/shadow. You can't do it without root access (by design), and you can't simply switch to root either (...


6

If you are on Debian/Ubuntu you should use adduser and usermod. On Debian based systems useradd is considered low level and (according to the man pages): administrators should usually use adduser(8) instead adduser has a no expiration option, so you just use it to create the account. usermod has the -e / --expiredate option to set the expiration date. You ...


6

If I'm not wrong, there are some slight differences between su and sudo: su only allows changing the user id (to become superuser for example). su allows any user that knows the password of another user to become that user, and there is no way to control this. sudo allows running a command as another user (including root). sudo is controlled by the /etc/...


6

When you add keys to an authorized_keys file you have several options to restrict what that key can do. In this situation, you can disallow running any commands. Simply prefix it with command="". For example: command="" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDc7nKsHpuC6W/U131p0yDh455sLE9pWmFxdK... When the user wants to connect, they have to pass -N to ssh....


6

Sudo should provide you with the most common way to do this. Any member of the wheel group will have sudo rights by default. Putting it together you will want to add any user you want to have root privileges to the wheel group. They will then preface any command with sudo to run a command (and only that command) as root. At the end of the command they will ...


6

On Solaris, password constraints can be configured by editing the /etc/default/password file , eg: $ pfedit /etc/default/password ... MINDIGIT=0 ...


6

Usually just the name of the package or program, so hadoop in this case. Daemons are usually added as a system account using useradd -r, which gives them a userid lower than human users (on my system, system accounts start at 100, human users start at 1000). Looking at the user names for system accounts in /etc/passwd seems to confirm the lack of any ...


6

The best practice for managing shared accounts is to lock the shared account. Rather than managing access to a shared account - which is bad for many reasons, you should add all of your developers to a group (ie. app_development), testers to another group (ie. app_testing), etc. Once you have users (each of which is only used by a single person) placed in ...


5

You need to tell useradd to create your home directory: useradd -m fox You might also want to add options for group(s) -g -G, login-shell -s etc. But don't worry - you can create your homedir now (as root using sudo or su): # mkdir /home/fox # chown fox:fox /home/fox See Arch Linux Documentation - User Management


5

Background The primary reason this advice is given when dealing with security is that one of the key pillars in making something more secure is by reducing the "attack surface". That is if you remove paths into your system you're reducing your system's overall potential. An analogy When I try to explain why this is so crucial with respect to security I ...


5

It means that the password is locked. Tools, such as usermod -L add a ! to the password to invalidate it. usermod -U removes the !. From man 5 shadow If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by ...


5

The "traditional" way was (is) to have a user account information locally, i.e in /etc/password, /etc/group etc. But that is not easy to manage when users freely access other computers on the network and/or have their home-directory on some networked drive. For the latter setup it is more easy to have user account information (incl password) in an LDAP ...


5

Ultimately, Debian's (and therefore Ubuntu's) adduser calls gpasswd: my $gpasswd = &which('gpasswd'); &systemcall($gpasswd, '-a',$existing_user,$existing_group); Debian's adduser was written with the purpose of being a convenient frontend to a range of utilities (it makes use of, at one step or another, useradd, gpasswd, ...


5

There's no standard command to enumerate all existing user accounts. On most Unix variants, /etc/passwd contains the list of local accounts, always with the same traditional format (colon-separated columns). On Linux with Glibc (i.e. any non-embedded Linux), you can use the getent command: getent passwd is similar to cat /etc/passwd, but also includes remote ...


Only top voted, non community-wiki answers of a minimum length are eligible