Facultat d'Informtica de Barcelona Univ. Politcnica de Catalunya - - PowerPoint PPT Presentation
Facultat d'Informtica de Barcelona Univ. Politcnica de Catalunya Administraci de Sistemes Operatius Users management
!
Knowledge
System data bases (users, passwords...) Permissions and protections
Files and directories SETUID/SETGID bits
Abilities
Users maintenance
Creating user accounts Groups and group membership Account disabling and deletion
Commands and files
chmod, chown, id, useradd, userdel, umask /etc/passwd, /etc/group, /etc/shadow
/etc/passwd /etc/group /etc/shadow /etc/aliases
N:M 1:1 N:M
Read-only for all users
username:passwd:uid:gid:real-name:homedir:shell
Several users can belong to the same group
Each user has a main group (/etc/passwd) Each group has a list of members
groupname:passwd:gid:username,username...
Only root can read and write /etc/shadow
Encripted passwords Passwords expiration policy username:passwd:expiration policy
passwd allows to change password chage allows to change the expiration policy
minimum/maximum amount of time between changes Account expiration date
Data base containing e-mail aliases
Allows to redirect e-mail to other addresses
From pseudo-users
To the administrator
to programs To users in another machine
# Basic system aliases -- these MUST be present. mailer-daemon: postmaster postmaster: root # General redirections for pseudo accounts. bin: root webmaster: root support: postmaster # Person who should get root's mail root: aduran, xavim@ac.upc.edu
Individually
Write down the process of giving a user a new account
Changes in the data bases Creation of directories Default files ...
In group
Discussion
Program the useradd command (pseudocode)
useradd adduser
userdel
usermod
Allows to modify all values except the username
passwd [ -g ]
newusers vipw vigr newgrp, sg
Temporarily disable a user account
The user will not be able to access the system Invalidate password
Add an illegal character into the encription (*) Allows to recover the old password, if necessary
Invalidate its shell
Change it by another binary (/bin/false, /bin/nologin)
Informs the user that his/her account has been disabled Informs the administrator when the user attempts to access the
system
When a user does not need his/her account...
Disable account (using an invalid encription for the
Check whether it is currently working in the machine Generate a backup with all his/her data Delete all data Eliminate the user from the system data bases
/etc/shadow /etc/passwd /etc/group
Redirect his/her e-mail
/etc/aliases
uid, gid Additional groups
(-,d) rwx rwx rwx owner group
3 types of permissions
Read, write, and execute (rwx)
Applied to regular files... Applied to directories... 3 application areas
Owner, group, other (ugo)
Related commands:
chown: changes the owner of files/directories chgrp : changes the group of files/directories chmod : changes permissions to files/directories
Set-UID/Set-GID bit (s)
Applied to files Applied to directories
Sticky bit (t) applied to directories
"
In groups
Assign the appropriate permissions to directories and files,
Only the owner can modify the contents All members of the group can read it Only the owner can delete it Only the owner can list the contents of the directory
When creating a file/directory...
The current user determines the actual owner and group
id reports the current owner/group newgrp changes the current user group
Permissions are determined by the umask system variable:
It indicates which permissions are not set by default to new
022: rwx r-x r-x 027: rwx r-x ---
root
UID 0 (the username does not mind)
ftp
Anonymous ftp (with no password)
nobody
Special user for NFS o WWW
wheel
User group with administration privileges
Work as administrator (root) is dangerous
Better to have an administrator user (admin), and obtain
su [user] [-c command]
It allows to change user (defaults to root)
sudo [command]
It allows to execute a command as a different user The administrator can restrict which commands can
Assigning new UID's
Do not reuse UID's
Assigning usernames Keep office and phone number to easily contact users /home organization
Flat
All users (/home/...)
Hierarchical, creating different levels of directories
Departments... office levels, rooms... (/home/ac/user)
... in different disks
Different ways to install applications Ways of distribute software, and formats
tar, gz, bz2, rpm, deb, zip...