1. Adding New Users
Chapter 6

2. Chapter 6 - Adding new users
Introduction
Adding and removing users is a routine chore.
These tasks are simple, but they are also boring.
Most administrators build tools to automate the process and then delegate the actual work to an assistant or operator.
Account hygiene is a key determinant of system security
Infrequently used accounts are prime targets for hackers,
as are accounts with easily guessed passwords
Chapter 6 - Adding new users

3. Chapter 6 - Adding new users
1. The /etc/passwd file
The /etc/passwd file is a list of users recognized by the system.
Each line in the file represents one user and contains several fields separated by colons:
Login name
Encrypted password (unless there is a shadow password)
UID number
Default GID number
GECOS information (full name, office, extension, phone)
Home directory
Login shell
The contents are often shared among systems via NIS or NIS+
Chapter 6 - Adding new users

4. Chapter 6 - Adding new users
1. The /etc/passwd file
Login name
Must be unique
On some OS’s (and with NIS/NIS+) they are limited to 8 characters
Case sensitive
(but most mail systems expect lower case)
Chapter 6 - Adding new users

5. Chapter 6 - Adding new users
1. The /etc/passwd file
Encrypted password
This is set by passwd (yppasswd if you use NIS)
Encryption Schemes
Most use DES encryption
input: first 8 characters are used
output: 13 characters are produced no matter what
Red Hat and FreeBSD include support for MD5
input: can be of any length
output: 31 characters (first 3 are $1$)
Chapter 6 - Adding new users

6. Chapter 6 - Adding new users
1. The /etc/passwd file
Shadow passwords: (Chapter 21)
places encrypted passwords in a separate file (not world readable)
Solaris requires shadow passwords
Notes:
A * in this field prevents someone from logging in.
Never leave this field empty.
Chapter 6 - Adding new users

7. Chapter 6 - Adding new users
1. The /etc/passwd file
UID number
Size:
On most modern systems UIDs are a 32 bit integer
On older systems the largest UID was 32,767
By definition, root has UID 0
HINTS:
avoid recycling UID’s (restoring files can be a problem)
Keep unique UID’s across your system
Chapter 6 - Adding new users

8. Chapter 6 - Adding new users
1. The /etc/passwd file
Default GID number
Group ID numbers
Size: 16 or 32 bit integer (signed or unsigned)
Defined in /etc/group
Reservations
GID 0 - reserved for the group “root” or “wheel”
GID 1 - reserved for the group “daemon”
Modern versions UNIX allow users to be in up to 16 groups.
Chapter 6 - Adding new users

9. Chapter 6 - Adding new users
1. The /etc/passwd file
File creation: BSD or Not?
Inherit the GID of the parent directory or the user?
If from the user, they may want to change which group they are in at the time with the command newgrp
Most OS’s do not follow the BSD semantics
But they allow it as a mount option (grpid)
Chapter 6 - Adding new users

10. Chapter 6 - Adding new users
1. The /etc/passwd file
GECOS field
no well defined syntax
records personal information
finger and sendmail use this info (but most others do not)
chfn lets users change their own GECOS information
this can be abused
Chapter 6 - Adding new users

11. Chapter 6 - Adding new users
1. The /etc/passwd file
Home directory
Users are placed in their home directory when they log in
If the home directory is missing:
All print an error message
Some allow the login to proceed (and put the user in /)
Some don’t allow the login to continue.
Beware: if home directories are mounted over NFS, they may be unavailable in the event of a server or network problem.
Chapter 6 - Adding new users

12. Chapter 6 - Adding new users
1. The /etc/passwd file
Login shell
Normally a command interpreter such as
/bin/sh, /bin/csh, /bin/ksh, /bin/tcsh, /bin/bash
sh is the default on most systems and is used if /etc/passwd does not specify a login shell
Users can change their shell with chsh
/etc/shells contains a list that chsh will allow.
Chapter 6 - Adding new users

13. 2. The FreeBSD /etc/master.passwd File
On FreeBSD, the “real” password file is /etc/master.passwd.
The /etc/passwd file exists for backward compatibility, but it is generated from master.passwd and is never edited directly.
This file also contains fields to implement password aging
The authors of our text are not very enthusiastic about password aging. See Chapter 21 for a discussion.
It also contains information for account expiration.
Chapter 6 - Adding new users

14. 3. The FreeBSD /etc/login.conf File
The login.conf entry can set
Resource limits (max process size, open files,…)
Session accounting limits (when logins are allowed, how long)
Default environment variables
Default paths (PATH, MANPATH, …)
Location of the message of the day
Host and TTY-based access control
Default umask
Account controls (min passwd length, password aging,…)
Chapter 6 - Adding new users

15. 4. The Solaris and Red Hat /etc/shadow File
The use of a shadow password file is mandatory under Solaris.
You can also use it under Red Hat Linux if you install the shadow package.
/etc/shadow is readable only by the superuser
keeps encrypted passwords safe from prying eyes.
Has fields for password expiration, and aging.
Chapter 6 - Adding new users

16. Chapter 6 - Adding new users
5. The /etc/group File
Contains the names of UNIX groups and a list of each group’s members
Each line contains
Group name
Encrypted password (vestigal and rarely used)
allows users to change to the group with the password even if not in the list of members.
GID number
List of members (comma separated)
Chapter 6 - Adding new users

17. Chapter 6 - Adding new users
6. Adding Users
Introduction
Before you create an account fo a new user, it’s very important that the user sign and date a copy of your local user agreement and policy statement.
See Chapter 27 for more info.
The process consists of:
Edit the passwd and shadow files to define the user’s account
Set an initial password
Create the user’s home directory
Chapter 6 - Adding new users

18. Chapter 6 - Adding new users
6. Adding Users
For the user
Copy default startup files
Set the user’s mail home and establish mail aliases
For you:
Add the user to the /etc/group file
Config the disk quotas
Verify the account has been set up.
Chapter 6 - Adding new users

19. Chapter 6 - Adding new users
6. Adding Users
Editing the passwd and shadow files
To safely edit the passwd file, run vipw to invoke a text editor on a copy of it.
vipw allows only one person to edit the passwd file at a time.
On Solaris, vipw asks if you want to edit the shadow file after you have edited the passwd file
On FreeBSD, vipw edits the master.passwd file (then runs pwd_mkdb to generate the derived passwd file)
Chapter 6 - Adding new users

20. Chapter 6 - Adding new users
6. Adding Users
Setting the initial password
Root can change any user’s password with the passwd command.
passwd user
Different implementations of passwd do/require different things
NEVER leave a new account - or any account that has access to a shell - without a password.
Chapter 6 - Adding new users

21. Chapter 6 - Adding new users
6. Adding Users
Creating the user’s home directory
Any directory you create is intially owned by root, so you must change its owner and group with the chown and chgrp commands
The following is an example of their usage:
mkdir /home/staff/tyler
chown tyler /home/staff/tyler
chgrp staff /home/staff/tyler
chmod 700 /home/staff/tyler
Chapter 6 - Adding new users

22. Chapter 6 - Adding new users
6. Adding Users
Copying the default startup files
You can customize commands and utilities by placing configuration files in a user’s home directory.
Startup files traditionally begin with a dot
ls ignores these files unless it is given a “-a” option
Some vendors supply a starting point set
/etc/skel or /usr/share/skel
Depending upon a user’s shell, /etc may contain system-wide startup files that are processed before the user’s own startup files
Chapter 6 - Adding new users

23. Chapter 6 - Adding new users
6. Adding Users
Setting the user’s mail home
It is convenient for each user to receive on only one machine.
This scheme is often implemented with an entry in the global aliases file /etc/mail/aliases or the sendmail userDB
See Chapter 19 for general information about
Chapter 6 - Adding new users

24. Chapter 6 - Adding new users
6. Adding Users
Editing the /etc/group file
When you added a new user (in /etc/passwd) you placed them in a group.
/etc/group should be updated to reflect this
and any other groups you wish to add them to.
Chapter 6 - Adding new users

25. Chapter 6 - Adding new users
6. Adding Users
Setting disk quotas
If your site uses disk quotas, you should set quota limits for each new account with the edquota command
edquota can be done interactively, or with a “-p” to make a user just like someone else.
edquota -p someone_else new_user
Chapter 6 - Adding new users

26. Chapter 6 - Adding new users
6. Adding Users
Verifying the new login
To verify that a new account has been properly configured, first log out, then log in as the new user and execute the following commands:
pwd
ls -la
If your site requires users to sign a written contract,
be sure this step has been completed before releasing the account
Be sure to remind new users to change their password immediately
Chapter 6 - Adding new users

27. Chapter 6 - Adding new users
7. Removing Users
When a user leaves your organization, that user’s login account must be removed from the system.
This procedure involves removing all references to the login name that were added by you or your adduser program:
Before you remove a user’s home directory, it’s always a good idea to make an extra backup of their directory (and mail spool) before deleting them
Chapter 6 - Adding new users

28. Chapter 6 - Adding new users
7. Removing Users
You may want to use the following checklist:
Set user’s disk quota to 0
Remove the user from any local user database
Remove the user from the aliases file
(or add a forwarding address)
Remove the user’s crontab file and pending at jobs
Kill any of the user’s processes that are still running.
Remove any temporary files owned by the user
Remove the user from the passwd and group files
Remove the user’s home directory
Remove the user’s mail spool
Chapter 6 - Adding new users

29. Chapter 6 - Adding new users
7. Removing Users
Once you have removed a user, be sure to verify that the user’s old UID owns no more files on the system.
A fast way to do this is with the quot command
Example: quot /home
quot does not require disk quotas to be active
quot only works on local disks (not over NFS mounts)
If there are, you can find their exact path with
find -x /home -nouser -print
Chapter 6 - Adding new users

30. Chapter 6 - Adding new users
8. Disabling Logins
On occasion, a user’s login must be temporarily disabled.
Some people just put a * in the password file for the encrypted password. However, some setups allow net logins without a password.
These days you should replace the user’s shell with a program that explains why the login has been disabled (and how to rectify the situation)
Chapter 6 - Adding new users

31. Chapter 6 - Adding new users
8. Disabling Logins
Be careful about this placing this pseudo-shell in the /etc/shells file
do you want them to have ftp access?
ftpd checks to see if the user’s login shell is in /etc/shells
Do you want them to continue to receive
sendmail does also….
Chapter 6 - Adding new users

32. 9. Vendor-Supplied Account Management Utilities
Solaris, HP-UX, and Red Hat provide a similar set of utilities to help automate the creation, deletion, and modification of users and groups
Users:
useradd adds users to the passwd file (and shadow)
usermod and userdel modify and delete users
Groups:
groupadd, groupmod, and groupdel operate on /etc/group
Chapter 6 - Adding new users

33. Chapter 6 - Adding new users