Red Hat Certified System Administration 8



Chapter 06: Users and Groups Management

Sommaire

  • Managing Users
  • Managing Passwords
  • Users Files and Directories
  • Groups
  • Gaining Privileges

Managing Users

Managing Users

Adding New User process

New User Adding process : exemple of Juan

1. A new line for juan is created in /etc/passwd: juan:x:1001:1001::/home/juan:/bin/bash
2. A new line for juan is created in /etc/shadow: juan:!!:14798:0:99999:7:::
3. A new line for a group named juan is created in /etc/group: juan:x:1001:
4. A new line for a group named juan is created in /etc/gshadow: juan:!::
5. A directory for user juan is created in the /home/directory
6. The files within the /etc/skel/ directory (which contain default user settings) are copied into the new /home/juan/ directory

Commands

adduser     |     openssl

Create a new user

[root@lab ~]# useradd user_name
or
[root@lab ~]# adduser user_name


[root@lab ~]# userdel user_name       Remove an user
[root@lab ~]# userdel -r user_name       Remove user_name from the system, along with his/her home directory and mail spool
[root@redhat ~]# id Display information about the current logged - in user
[root@redhat ~]# who Display connected users including used TTYs
[root@redhat ~]# w Know actives users
[root@redhat ~]# users Dispay Connected users


User Settings

UID (User Identifier) : New user created on RHEL 8 has a UID above 1000. UID 0 to 999 are reserved for System Users

Generate Encrypted Password

openssl command use DES Encryption

[root@redhat ~]# openssl passwd -crypt Standard Unix password algorithm (default)
[root@redhat ~]# openssl passwd -6 SHA512-based password algorithm

Application

pass=user

[root@redhat ~]# openssl passwd -crypt 
Password:
Verifying - Password:
uyOvQmy1a9v/.


[root@redhat ~]# adduser user6 -p uyOvQmy1a9v/.
[root@redhat ~]# cat /etc/shadow

[root@lab ~]# adduser user3 -c "Eninam BAGNABANA" -e 2023-07-01 -p uyOvQmy1a9v/. -s /bin/bash
[root@lab ~]# adduser user4 --comment "Eninam BAGNABANA" --expiredate 2024-07-01 --password uyOvQmy1a9v/. --shell /bin/sh


Files

/etc/default/useradd : adduser command default settings File



Managing Passwords

Managing Passwords

Commands
[root@lab ~]# passwd Change current user password
[root@lab ~]# passwd username Change an user password
[root@lab ~]# passwd –l username      lock an user password (he can’t login)
[root@lab ~]# passwd –u username unlock an user password
[root@lab ~]# passwd –S username password infos


Saving Passwords
we have two password saving modes
  • Standard
  • Shadow (default)
Dans le mode standard les comptes utilisateurs et les mots de passe sont stockés dans un seul fichier /etc/passwd.
Dans le mode shadow les comptes utilisateurs sont stockés dans le fichier /etc/passwd et les mots de passe dans le fichier /etc/shadow

In environments with multiple users, it is very important to use shadow passwords provided by the shadow-utils package to enhance the security of system authentication files.

For this reason, the installation program enables shadow passwords by default

[root@lab ~]# pwconv conversion of passwords to shadow passwords
[root@lab ~]# pwunconv conversion of shadow passwords to standard passwords.(/etc/shadow doesn’t exist)

Files

/etc/passwd Main users accounts Configuration file
/etc/shadow Main users accounts passwords Configuration file

Other Commands

[root@lab ~]# chage -l user Display a user Password Expiration infos
[root@lab ~]# usermod --expiredate=2018-12-25 user1 Set an expiration date to an user account

Users Files and Directories

Users Files and Directories


/etc/passwd Users main configuration File [+]

/etc/shadow Users Passwords Main Configuration File in Shadow Mode . Stores by default Passwords Hashes

/etc/login.defs new user defaults settings

/etc/skel/ Directory which stores list of files and directories to copy in new user home directory

/home/user/.bash_history Bash commands log

/home/user/.bashrc User specific environment and startup programs (Aliases and functions) relative on bash Start
Countains user bash profile like alias (default commands options or middle name of commands)

Le fichier …/.bashrc contenu dans le répertoire personnel de chaque user contient des settings qui sont charges à chaque fois que l’user se connecte.
Si on veut définir donc des paramètres pour un user on le note dans ce fichier

/home/user/.bash_profile User specific environment and startup programs relative on login

/etc/default/useradd : adduser command default settings File

Aliases

La création d'alias est une fonctionnalité disponible dans le bash. Les Alias sont configurés dans le fichier .bashrc de l'utilisateur pour personnaliser les commandes

Le fichier …/.bashrc contenu dans le répertoire personnel de chaque user contient des settings qui sont chargés à chaque fois que l’user se connecte.
Si on veut définir donc des paramètres pour un user on le note dans ce fichier

Example Of Alias
alias rm='rm –i' L'exécution de la commande "rm" donnera le meme outpout que "rm -i"
alias afficher='cat' L'exécution de la commande "afficher" donnera le meme outpout que "cat"

Groups

Groups

Files

/etc/group groups file

Commands

[root@lab ~]# groupadd groupname create a group
[root@lab ~]# groupdel groupname delete a group
[root@lab ~]# groupadd –p password groupname create a group with password


Managing Group Users

[root@lab ~]# usermod option groupname username
Options
–aG add an user in a group
-G change user group


[root@lab ~]# id username show user groups

[root@lab ~]# chgrp group file-name Change File group Ownership (New Group Owner)


[root@redhat ~]# gpasswd --delete username groupname remove an user from a group



Gaining Privileges

The su Command

Commands

[root@lab ~]# su use root privilege
[root@lab ~]# su user use an user privilege
[root@lab ~]# su – user change user
[user1@lab ~]# su –c command use a command like root (You must know root password)
[user1@lab ~]# su –c command user
use a command like another user (You must know user password)

su command users

Add users to the special administrative group called wheel
[root@lab ~]# usermod -G wheel username

NB: After you add the desired users to the wheel group, it is advisable to only allow these specific users to use the su command.
To do this, you will need to edit the PAM configuration file for su: /etc/pam.d/su

Open this file in a text editor and remove the comment (#) from the following line:
#auth required pam _wheel.so use_uid
This change means that only members of the administrative group wheel can switch to another user using the su command.

NB: The root user is part of the wheel group by default.

Files

/etc/pam.d/su su command principal Configuration File [+]



The sudo Command

The sudo command offers another approach to giving users administrative access. When trusted users precede an administrative command with sudo, they are prompted for their own password. Then, when they have been authenticated and assuming that the command is permitted, the administrative command is executed as if they were the root user. The basic format of the sudo command is as follows: sudo command

Only users listed in the /etc/sudoers configuration file are allowed to use the sudo command and the command is executed in the user's shell, not a root shell

Timeout

By default, sudo stores the sudoer's password for a five minute timeout period. Any subsequent uses of the command during this period will not prompt the user for a password. This could be exploited by an attacker if the user leaves his workstation unattended and unlocked while still being logged in. This behavior can be changed by adding the following line to the /etc/sudoers file:

Defaults timestamp_timeout=value
where value is the desired timeout length in minutes. Setting the value to 0 causes sudo to require a password every time

Concept

configure users to use privileged commands without root password

Files

sudo default Configuration file is /etc/sudoers [+]

Editing /etc/sudoers File

[root@redhat ~]# visudo

Editing Steps

  1. Host Aliases
  2. User Aliases
  3. Command Aliases
  4. Define which users can run what software on which machines
Host Aliases

Host_Alias host-alias-name = hostname-1 ... hostname-n

User Aliases

User_Alias user-alias-name = username-1 ... username-n

Command Aliases

Cmnd_Alias command-alias-name = command-1 ... command-n

Define which users can run what software on which machines

The sudoers file can be shared between multiple systems
Syntax: user MACHINE=COMMANDS

Commands

Switch to root user
[user@redhat ~]$ sudo -i

Check an user sudo configuration
[root@redhat ~]# sudo -l -U username

Eninam BAGNABANA     |         |     bagnadavid@outlook.fr     |