30 - User Accounts

Question 1

User Account Management

By the end of this chapter, you should be able to:

Answer 1

1) Explain the purpose of individual user accounts and list their main attributes.
2) Create new user accounts and modify existing account properties, as well as remove or lock accounts.
3) Understand how user passwords are set, encrypted and stored, and how to require changes in passwords over time for security purposes.
4) Explain how restricted shells and restricted accounts work.
5) Understand the role of the root account and when to use it.
6) Use Secure Shell (ssh) and remove logins and commands.

Question 2

User Accounts:

Linux systems provide a multi-user environment which permits?

Answer 2

People & processes to have separate simultaneous working environments

Question 3

User Accounts:

What is the purposes of having individual user accounts include?

Answer 3

1) Providing each user with their own individualized private space
2) Creating particular user accounts for specific dedicated purposes
3) Distinguishing privileges among users.

Question 4

User Accounts:

What special user account allow the user to do anything on the system?

Answer 4

root account

Question 5

User Accounts:

To avoid making costly mistakes, and for security reasons, the root account should only be used when?

Answer 5

absolutely necessary

Question 6

User Accounts:

Normal user accounts are for?

Answer 6

regular people who will work on the system

Question 7

User Accounts:

Some user accounts (like the daemon account) exist for?

Answer 7

the purpose of allowing processes to run as a user other than root.

Question 8

User Accounts:

What is group management for? (discussed more in future chapter)

Answer 8

where subsets of the users on the system can share files, privileges, etc., according to common interests.

Question 9

Attributes of a User Account:

Each user on the system has a corresponding line in the ____ file that describes their basic account attributes. (We will talk about passwords, as well as this file, later). For example:

Answer 9

/etc/passwd

….

beav:x:1000:1000:Theodore Cleaver:/home/beav:/bin/bash warden:x:1001:1001:Ward Cleaver:/home/warden:/bin/bash dobie:x:1002:1002:Dobie Gillis:/home/dobie:/bin/bash

….

Question 10

Attributes of a User Account:

What are the 7 attributes of a User Account?

Answer 10

1. User name
2. User password
3. User Identification Number (UID)
4. Group Identification Number (GID)
5. Comment or GECOS Information
6. Home Directory
7. Login Shell

Question 11

Attributes of a User Account:

What is the User name attribute?

Answer 11

The unique name assigned to each user.

Question 12

Attributes of a User Account:

What is the User Identification Number (UID)​ attribute?

Answer 12

A unique number assigned to the user account. The UID is used by the system for a variety of purposes, including a determination of user privileges and activity tracking.

Question 13

Attributes of a User Account:

What is the User password attribute?

Answer 13

The password assigned to each user.

Question 14

Attributes of a User Account:

What is the Group Identification Number (GID) attribute?

Answer 14

Indicates the primary, principal, or default group of the user.

Question 15

Attributes of a User Account:

What is the Comment or GECOS Information attribute?

Answer 15

A defined method to use the comment field for contact information (full name, email, office, contact number). (Don’t worry about what GECOS means, it is a very old term.)

Question 16

Attributes of a User Account:

What is the Login Shell attribute?

Answer 16

Normally, this is a shell program such as /bin/bash or /bin/csh. Sometimes, however, an alternative program is referenced here for special cases. In general, this field will accept any executable.

Question 17

Attributes of a User Account:

What is the Home Directory attribute?

Answer 17

For most users, this is a unique directory that offers a working area for the user. Normally, this directory is owned by the user, and except for root will be found on the system somewhere under /home.

Question 18

Creating User Accounts

What command is used to create user accounts?

Answer 18

useradd

Question 19

Creating User Accounts

What is the location of the file that is used to configure useradd default settings?

Answer 19

/etc/default/useradd

Question 20

Creating User Accounts

Where is the defaults file that is used by a lot of the user management commands?

Answer 20

/etc/login.defs

The /etc/login.defs file provides default configuration information for several user account parameters. The useradd, usermod, userdel, and groupadd commands, and other user and group utilities take default values from this file. Each line consists of a directive name and associated value.

Question 21

Creating User Accounts

The default algorithm for creating a user accounts will auto assign the new users ___ and ___, ___ , and ___.

Answer 21

• UID
• GID
• home directory
• shell choice

Question 22

Creating User Accounts

What steps occur when creating this new user account?

$ sudo useradd dexter

Answer 22

1. The next available UID greater than UID_MIN (specified in /etc/login.defs) by default is assigned as dexter’s UID.
2. A group called dexter with a GID=UID is also created and assigned as dexter’s primary group.
3. A home directory /home/dexter is created and owned by dexter.
4. dexter’s login shell will be /bin/bash.
5. The contents of /etc/skel is copied to /home/dexter. By default, /etc/skel includes startup files for bash and for the X Window system.
6. An entry of either !! or ! is placed in the password field of the /etc/shadow file for dexter’s entry, thus requiring the administrator to assign a password for the account to be usable.

Question 23

Deleting User Accounts

What is the command used to delete a user?

Answer 23

userdel

Question 24

Deleting User Accounts

Only the ___ user can delete users

Answer 24

root

Question 25

# Deleting User Accounts When deleting a user as in: **$ sudo userdel morgan** What gets erased by default and what doesn't?

Answer 25

Removes the user's record in these files by default: * **/etc/passwd** * **/etc/shadow** * **/etc/group** Not Erased: * the users home directory **/home/morgan** * unless **-r** option is used,

Question 26

# Modifying User Accounts What command is used to change characteristics of a user account, such as group memberships, home directory, login name, password, default shell, user id, etc. It modifies the respective **/etc** files.

Answer 26

**usermod**

Question 27

# Modifying User Accounts What command is used to lock a user named "dexter" out of his account? (Making it so "dexter" cannot login anymore)

Answer 27

**sudo usermod -L dexter**

Question 28

# Locked Accounts What does a "locked" account mean?

Answer 28

A Locked account can run programs, but can never login to the system and have no valid password associated with them. For example, **/etc/passwd** has entries like: * *bin:x:1:1:bin:/bin:/sbin/nologin daemon: x:2:2:daemon:/sbin:/sbin/nologin** The nologin shell returns the following if a locked user tries to login to the system: **This account is currently not available.** or whatever message may be stored in **/etc/nologin.txt**.

Question 29

# Locked Accounts What are some of the locked user accounts that Linux ships with?

Answer 29

* bin * daemon or sys

Question 30

# Locked Accounts What are the commands to lock and unlock an account?

Answer 30

* $ sudo usermod -L dexter * $ sudo usermod -U dexter

Question 31

# Locked Accounts What is another way to lock an account other than using the **usermod -L** command?

Answer 31

$ sudo chage -E 2014-09-11 morgan Another way to lock an account is to use **chage** to change the expiration date of an account to a date in the past

Question 32

# User IDs and /etc/passwd Describe the record information for this user in the **/etc/passwd** file: **beav:x:1000:1000:Theodore Cleaver:/home/beav:/bin/bash**

Answer 32

* **username** - the user's unique name * **password** - either the hashed password (if **/etc/shadow** is not used) or a placeholder ("x" when **/etc/shadow** is used) * **UID** - user identification number * **GID** - primary group identification number for the user * **comment** - comment area, usually the user's real name * **home** - directory pathname for the user's home directory * **shell** - absolutely qualified name of the shell to invoke at login.

Question 33

# User IDs and /etc/passwd The convention most Linux distributions have used is that any account with a user ID less than ___ is considered special and belongs to the system; normal user accounts start at \_\_\_. The actual value is defined as ___ and is defined in \_\_\_.

Answer 33

* 1000 * 1000 * UID\_MIN * /etc/login.defs Historically, Red Hat-derived distributions used UID\_MIN=500, not 1000, but beginning with RHEL 7 the more common value of 1000 was adopted.

Question 34

# User IDs and /etc/passwd If a User ID is not specified when using **useradd**, the system will incrementally assign **UIDs** starting at the ___ environment variable.

Answer 34

* UID\_MIN

Question 35

# User IDs and /etc/passwd It is bad practice to edit **/etc/passwd**, **/etc/group** or **/etc/shadow** directly; use appropriate utilities such as \_\_\_.

Answer 35

* usermod

Question 36

# Why Use /etc/shadow? Why use **/etc/shadow** for storing user passwords vs storing it in the **/etc/passwd**?

Answer 36

Use of **/etc/shadow** enables password aging on a per user basis. At the same time, it also allows for maintaining greater security of hashed passwords.

Question 37

# Why Use /etc/shadow? Why is using **/etc/passwd** bad for storing user hashed passwords vs storing it in **/etc/shadow**?

Answer 37

The default permissions of **/etc/passwd** are **644 (-rw-r--r--)**; anyone can read the file. This is unfortunately necessary because system programs and user applications need to read the information contained in the file. These system programs do not run as the user root and, in any event, only root may change the file. Of particular concern are the hashed passwords themselves. If they appear in /etc/passwd, anyone may make a copy of the hashed passwords and then make use of utilities such as Crack and John the Ripper to guess the original cleartext passwords given the hashed password. This is a security risk! **/etc/shadow** has permission settings of **400 (-r--------)**, which means that only root can access this file. This makes it more difficult for someone to collect the hashed passwords. Unless there is a compelling good reason not to, you should use the /etc/shadow file.

Question 38

# Password Management Explain the pieces of this user's password record in the /ect/shadow file. daemon:\*:16141:0:99999:7::: ..... **beav:$6$iCZyCnBJH9rmq7P.$RYNm10Jg3wrhAtUnahBZ/mTMg.RzQE6iBXyqaXHvxxbKTYqj.d 9wpoQFuRp7fPEE3hMK3W2gcIYhiXa9MIA9w1:16316:0:99999:7:::**

Answer 38

The colon-separated fields are: 1. **username**: unique user name 2. **password**: the hashed (sha512) value of the password 3. **lastchange**: days since Jan 1,1970 that password was last changed 4. **mindays**: minimum days before password can be changed 5. **maxdays**: maximum days after which password must be changed 6. **warn**: days before password expires that the user is warned 7. **grace**: days after password expires that account is disabled 8. **expire**: date that account is/will be disabled 9. **reserved**: reserved field. The **username** in each record must match exactly that found in **/etc/passwd**, and also must appear in the **identical order**. All dates are stored as the number of days since Jan. 1, 1970 (the epoch date). The password hash is the string **"$6$"** followed by an eight character salt value, which is then followed by a **$** and an **88** character (sha512) password hash.

Question 39

# Password Management What command is used to change a user's password?

Answer 39

**passwd** By default, the password choice is examined by **pam\_cracklib.so**, which furthers making good password choices.

Question 40

# Password Management What's the difference between powers that a regular user has vs the root user has when changing password?

Answer 40

A regular user can only change their password. While the root user can change anyones passwords.

Question 41

# Password Management When using **passwd** to change a user's password what program under the hood by default is used to check if the password meets security requirements?

Answer 41

**pam\_cracklib.so**

Question 42

Normal users will not be allowed to set bad passwords, such as ones that are too short, or based on dictionary words. However, ___ is allowed to do so.

Answer 42

root user

Question 43

# Password Aging What utility is used to manage password aging?

Answer 43

**chage** ## Footnote chage [-m mindays] [-M maxdays] [-d lastday] [-I inactive] [-E expiredate] [-W warndays] user Examples: **$ sudo chage -l dexter $ sudo chage -m 14 -M 30 kevlin $ sudo chage -E 2012-4-1 morgan $ sudo chage -d 0 clyde** Only the root user can use **chage**. The one exception to this is that any user can run chage **-l** to see their aging, as in the screenshot on this page. To force a user to change their password at their next login, do: **$ sudo chage -d 0 USERNAME**

Question 44

# Restricted Shell What utility is used to use a restricted shell?

Answer 44

$ bash -r * A restricted shell functions in a more tightly controlled environment than a standard shell, but otherwise functions normally. In particular, it: * Prevents the user from using cd to change directories. * Prevents the user from redefining the following environment variables: SHELL, ENV, and PATH. * Does not permit the user to specify the absolute path or executable command names starting from /. * Prevents the user from redirecting input and/or output. There are other restrictions; the best way to see them all is to do man bash and search for RESTRICTED SHELL. Restricted accounts can also be enabled by creating a symlink to **/bin/bash**, named **/bin/rbash**, and using in **/etc/passwd**, as we will discuss next. **rbash** is not secure! It is actually very easy to avoid the restrictions and modern techniques such as the use of SELinux are much more robust. We discuss only if you encounter the methods described here. Restricted Accounts: There are times when granting access to a user is necessary, but should be limited in scope. Setting up a restricted user account can be useful in this context. A restricted account: * Uses the restricted shell * Limits available system programs and user applications * Limits system resources * Limits access times * Limits access locations. From the command line, or from a script, a restricted shell may be invoked with **/bin/bash -r**. However, flags may not be specified in the **/etc/passwd** file. A simple way to get around this restriction would be to do one of the following: **$ cd /bin ; sudo ln -s bash rbash $ cd /bin ; sudo ln bash rbash $ cd /bin ; sudo cp bash rbash** and then, use **/bin/rbash** as the shell in **/etc/passwd**. When setting up such an account, one should avoid inadvertently adding system directories to the PATH environment variable; this would grant the restricted user the ability to execute other system programs, such as an unrestricted shell. Restricted accounts are also sometimes referred to as limited accounts.

Question 45

# The Root Account The ___ account should only be used for administrative purposes when absolutely necessary and never used as a regular account. Mistakes can be very costly, both for integrity and stability, and system security.

Answer 45

root

Question 46

# The Root Account By default, ___ logins through the network are generally prohibited for security reasons. You can permit Secure Shell logins using ssh, which is configured with the file \_\_\_, and PAM (Pluggable Authentication Modules), which we will discuss later, through the pam\_securetty.so module and the associated ___ file. Root login is permitted only from the devices listed in \_\_\_.

Answer 46

* root * /etc/ssh/sshd\_config * /etc/securetty * /etc/securetty

Question 47

# The Root Account It is generally recommended that all ___ access be through **su**, or **sudo** (causing an audit trail of all root access through sudo). Note that some distributions (such as Ubuntu), by default actually prohibit logging in directly to the ___ account.

Answer 47

* root * root

Question 48

# The Root Account \_\_\_ can also be used to restrict which users are allowed to su to root. It might also be worth it to configure ___ to log all commands executed as root.

Answer 48

* PAM * auditd

Question 49

# SSH What command do you use to login to a remote system?

Answer 49

ssh

Question 50

# SSH How do you copy files and folders from one system to another via ssh?

Answer 50

To copy files from one system to another: ## Footnote **$ scp file.txt farflung.com:/tmp $ scp file.tex student@farflung.com/home/student $ scp -r some\_dir farflung.com:/tmp/some\_dir**

Question 51

# SSH What is the bash script to run **ssh** on multiple system?

Answer 51

To run a command on multiple machines simultaneously: $for machines in node1 node2 node3 do (ssh $machines some\_command &) done

Question 52

# SSH Configuration Files Where is the ssh configuration file location?

Answer 52

Every user had a **.ssh** config directory with config files in thier home directory. You can configure SSH further to expedite its use, in particular to permit logging in without a password. User-specific configuration files are created under every user's home directory in the hidden .ssh directory:

Question 53

# SSH What config files are location in the .ssh folder? And what are they for?

Answer 53

**id\_rsa**: the user's private encryption key **id\_rsa.pub**: the user's public encryption key **authorized\_keys**: A list of public keys that are permitted to login **known\_hosts**: A list of hosts from which logins have been allowed in the past **config**: A configuration file for specifying various options.

Question 54

# SSH What are the steps to setup ssh connection to a server?

Answer 54

1. First, a user has to generate their **private** and **public** encryption keys with ssh-keygen: 1. $ ssh-keygen 1. ​.ssh/**id\_rsa** (private key generated) 2. .ssh/**id\_rsa.pub** (public key generated) ​​​The public key can be given to any machine with which you want to permit password-less access. It should also be added to your **authorized\_keys** file, together with all the public keys from other users who have accounts on your machine and you want to permit password-less access to their accounts. The **.ssh**/**known\_hosts** file is gradually built up as ssh accesses occur. If the system detects changes in the users who are trying to log in through ssh, it will warn you of them and afford the opportunity to deny access. Note that the **authorized\_keys** file contains information about users and machines: $ cat **authorized\_keys** ssh-rsa AAAAB3NzaC1yc2EAAAADAQ ...0000aSd...hilda@sbc while the **known\_hosts** only contains information about computer nodes: $ cat **known\_hosts** 192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSw ....BK6Tb...==

Question 55

# SSH What is the .ssh/known\_hosts config file contain?

Answer 55

The **known\_hosts** file is gradually built up as ssh accesses occur. If the system detects changes in the users who are trying to log in through ssh, it will warn you of them and afford the opportunity to deny access. Note that the **authorized\_keys** file contains information about users and machines: $ cat **authorized\_keys** ssh-rsa AAAAB3NzaC1yc2EAAAADAQ ...0000aSd...hilda@sbc while the **known\_hosts** only contains information about computer nodes: $ cat **known\_hosts** 192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSw ....BK6Tb...== You can examine the **man ssh\_config** page to see what kinds of options can go into the ssh configuration files.

Question 56

# SSH What command give you information about what options can go into the ssh configuation files?

Answer 56

**man ssh\_config**

Question 57

# Remote Graphical Login What is a common program you can use to graphically connect to a remote machine?

Answer 57

**tigervnc**

Question 58

# Remote Graphical Login What does VNC stand for?

Answer 58

Virtual Network Computing

Question 59

# Remote Graphical Login Which vnc packages do you need installed for vnc to work? How can you check if these packages are installed? How can you install these packages if you don't have them?

Answer 59

* vncserver * vncviewer **which vncserver vncviewer** ``` */usr/bin/vncserver /usr/bin/vncviewer* ``` **$ sudo [dnf|yum|zypper|apt-get] install tigervnc\***

Question 60

# Remote Graphical Login How do you use tigervnc?

Answer 60

1. Start the with 1. **$ vncserver** 2. Test the vnc server locally 1. **$ vncviewer localhost:2** 2. You may have to play with numbers other than 2, such as 1, 3, 4..., depending on what you are running at the moment, and how your machine is configured. 3. View the vnc server remotely 1. vncviewer -via username@host\_machine localhost:2 If you get a rather strange message about having to authenticate because of 'color profile', and no passwords work, you have to kill the colord daemon on the server machine, as in: **$ sudo systemctl stop colord** This is a bug (not a feature), and it will only appear in some distributions and some systems for unclear reasons.​