Beginners Guide to User and Group Administration in Linux

Each user in Linux has a unique user ID (UID), which is an ordinary integer number, and an associated username. Users log in by using their usernames, but the system uses the associated UIDs. Each user account also has a home directory and a login shell. When users log in, they are placed in their home directory and their login shell executes. All of this user account information is stored in the /etc/passwd file.

Each user also belongs to one or more groups. Different users can be assigned to the same group. Access can be given to a group and all members of the group are granted the same access privileges. Each group account in Linux has a unique group ID (GID) and an associated group name. Group information is stored in the /etc/group file.

RedHat Linux uses a user private group (UPG) scheme. When a new user account is added, a new user private group is also created. The user private group has the same name as the user, and the new user is the only member of this group.

Both users and groups use shadow passwords. Passwords are hashed and stored in different files, /etc/shadow for users and /etc/gshadow for groups. Security improves by storing hashed passwords in “shadow” files, because these files are readable only by the root user. The use of shadow passwords also provides password aging parameters and allows security policies to be enforced, using the /etc/login.defs file. Only the root user can add, modify, or delete user and group accounts.

User and Group Configuration Files

/etc/passwd

When a new user is added, the information is stored as a single, colon-separated line in /etc/passwd. Here is an example of an entry in this file:

# tail -1 /etc/passwd
test:x:1001:1001:test user:/home/test:/bin/bash

The following describes this entry:

/etc/shadow

With shadow passwords, a new entry is automatically added to /etc/shadow when a new user is created. This file can be viewed only by root. Here is an example of an entry in this file:

# tail -1 /etc/shadow
test:$6$XBCDBQ...:17610:0:99999:7:::

The following describes this entry:

The next field is empty but is used to store the last date when the account is locked (counted in days since Jan 1, 1970). The last field is also empty but is not used.

/etc/group

Because Oracle Linux uses a UPG scheme, a new entry is automatically created in /etc/group when a new user is added. The group name is the same as the username. Here is an example of an entry in this file:

# tail -1 /etc/group
test:x:1000:test

The following describes this entry:

Each group can have multiple users. Users can also belong to more than one group. The GID stored in the user’s entry in /etc/passwd is the user’s primary group.

/etc/gshadow

Hashed group passwords are stored in this file. However, group passwords are rarely used. Here is an example of an entry in this file:

# tail -1 /etc/gshadow 
test:!!::test

The following describes this entry:

The last two fields are used to designate administrators and members.

Adding a User Account

useradd

Use the useradd command to add a user account. The syntax is:

# useradd [options] user_name

When creating a new user without any options, the default settings are applied. Example:

# useradd john
# tail -1 /etc/passwd
john:x:501:501::/home/john:/bin/bash

Also by default, useradd creates a locked user account. To unlock the account and assign a password, run the passwd user_name command as root. Example:

# passwd john

The passwd user_name command prompts you for a new password. Depending on the complexity of the password, you may be notified the password is bad (too short or too simple). Re-enter the same password to continue and unlock the user account. The same passwd command is used to change a password. The root user can always change a user’s password. Users are prompted to enter the current password first.

Default Settings

The default settings for a new user can be viewed and modified by using the -D option. Example:

# useradd -D
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes

The INACTIVE directive sets the number of days after a password expires until the account is locked. A value of 0 locks the account as soon as the password expires. A value of -1 disables the feature. Contents of the SKEL (/etc/skel by default) are copied to a new user’s home directory when the user account is created. Default settings are stored in /etc/default/useradd. The following options, used with –D, change the useradd command defaults:

• -b default_home: The initial path prefix for a new user’s home directory
• -e default_expire_date: The date on which the user account is disabled
• -f default_inactive: The number of days after a password has expired before the account is locked
• -g default_group: The group name or ID for a new user’s initial group
• -s default_shell: The new user’s login shell

For example, to change a new user’s login shell to the Bourne shell, enter the following:

# useradd –D –s /bin/sh user_name

useradd Options

Several options are available to the useradd command to override default settings. The following are some of the more commonly used options:

• -c comment: The new user’s GECOS information, such as full name
• -d home_dir: The initial path prefix for a new user’s home directory
• -e expire_date: The date (format YYYY-MM-DD) when the user account is disabled
• -g initial_group: The group name or number of the user’s initial login group. The group name must exist. A group number must refer to an already existing group.
• -G group: A list of secondary groups that the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace.
• -p passwd: Set the new user’s password.
• -s shell: The name of the user’s login shell

For example, to create a new username of “john”, and include the user’s name, and change the login shell to the C shell, enter the following:

# useradd –c "John Smith" –s /bin/csh john

nologin Shell

When you add a new user account, the user is granted shell access by default. You can create a user account with nologin shell for purposes of running a service such as SMTP, FTP, or running a web server, for example. A user without a login shell cannot log in to a system and, therefore, cannot run any commands interactively on the system. Processes can run as that user, however.

Logging in as a user with a nologin shell is politely refused and a message is displayed that the account is not available. If the file /etc/nologin.txt exists, nologin displays the file’s contents rather than the default message. To create a nologin user, first ensure that nologin exists in the /etc/shells file:

# cat /etc/shells
/bin/sh
/bin/bash
/sbin/nologin
/bin/dash

To add a new user called test with no shell access:

# useradd -s /sbin/nologin test

Attempting to log in as user test displays:

# su – test
This account is currently not available.

Modifying or Deleting User Accounts

usermod

Use the usermod command to modify an existing user account. The syntax is:

# usermod [options] user_name

One of the most common uses of the usermod command is to add a user to another (secondary) group. Use the –a and –G options followed by a comma-separated list of the secondary groups to add the user to. The following example lists the contents of /etc/group before and after modifying a user and adding them to a secondary group:

# grep 1017 /etc/group 
students:x:1017:

# usermod –aG 1017 mary 
# grep 1017 /etc/group students:x:1017:mary

userdel

Use the userdel command to delete a user account. Example:

# userdel john

Group Account Administration

groupadd

Use the groupadd command to add a group account. The syntax is:

# groupadd [options] group_name

groupmod

Use the groupmod command to modify a group account. The syntax is:

# groupmod [options] group_name

groupdel

Use the groupdel command to delete a group account. The syntax is:

# groupdel group_name

You can remove groups even if there are members in the group. You cannot remove the primary group of any existing user. You must remove the user before removing the group.

gpasswd

Use the gpasswd command to administer /etc/group and /etc/gshadow. Every group can have administrators, members, and a password. The syntax is:

# gpasswd [options] group_name

groups

The groups command displays the groups that a user belongs to. The following example illustrates that user oracle belongs to two groups, oracle (primary group) and students (secondary group):

$ grep oracle /etc/passwd
oracle:x:1000:1000:Oracle Student:/home/oracle/bin/bash

$ grep oracle /etc/group
oracle:x:1000: students:x:1056:student1,student2,oracle

The groups command (logged on as oracle) verifies these group memberships.

$ whoami
oracle
$ groups 
oracle students

newgrp

The newgrp command executes a new shell and changes a user’s real group identification. The following example illustrates the group ID before and after running the command. It also illustrates that a new shell is executed.

$ id
uid=1000(oracle) gid=1000(oracle)
groups=1000(oracle),1066(students)... 

Note that the gid equals 1000(oracle).

$ ps
PID TTY TIME CMD
20279 pts/0 00:00:00 bash 
20411 pts/0 00:00:00 ps

$ newgrp students

$ id
uid=1000(oracle) gid=1066(students)
groups=1000(oracle),1066(students)...

Note that the gid now equals 1066(students). Also note that a new shell was executed:

$ ps
PID TTY TIME CMD
20279 pts/0 00:00:00 bash
20464 pts/0 00:00:00 bash
20486 pts/0 00:00:00 ps

The newgrp command does not recognize group ID numbers and you can only change your real group name to a group that you are a member of. Running the command without an argument sets the real group identification to the user’s primary group.

Password Configuration

Password aging requires users to change their password periodically. Use the chage command to configure password expiration. The syntax is:

# chage [options] user_name

Enter the chage command, followed by a username, to display existing password aging values and make modifications. For example, to display and change values for user john, type (as user root):

# chage john
Changing the aging information for john
Enter the new value, or press ENTER for the default

	Minimum Password Age [0]: 
	Maximum Password Age [99999]: 
	Last Password Change (YYYY-MM-DD) [2018-03-24]: 
	Password Expiration Warning [7]: 
	Password Inactive [-1]: 
	Account Expiration Date (YYYY-MM-DD) [-1]: 

Password aging information is stored in the /etc/shadow file. To view the user john’s entry before making any changes:

# grep john /etc/shadow
john:$6$fJB4dWkt$...:17614:0:99999:7:::

Changing the minimum password age value to 14 and maximum password age value to 30 means that in 14 days the user has 30 days to change their password. The new entry appears as:

# grep john /etc/shadow
john:$6$fJB4dWkt$...:17614:14:30:7:::

Based on this information, the user is warned to change his password seven days before the date the password expires. The INACTIVE directive is used to set the number of days of inactivity after a password has expired before the user account is locked. Setting INACTIVE to -1 disables this feature.

chage Options

A number of options are available for the chage command. To list aging information:

# chage -l john
Last password change					: Mar 24, 2018
Password expires					: never
Password inactive					: never
Account expires						: never
Minimum number of days between password change		: 0
Maximum number of days between password change		: 99999
Number of days of warning before password expires	: 7

To force a user to set a new password immediately (force immediate expiration), set the last password change value to 0. Example:

# chage –d 0 john

After login, the user is prompted to change his password.

authconfig

The Linux user password hashing algorithm is also configurable. Use the authconfig command to determine the current algorithm being used, or to set it to something different. To determine the current algorithm:

# authconfig --test | grep hashing
    password hashing algorithm is sha512

To change the algorithm, use the –passalgo option with one of the following as a parameter: descrypt, bigcrypt, md5, sha256, or sha512, followed by the –update option. For example, to change the algorithm to MD5:

# authconfig --passalgo=md5 --update