Chapter 11: Managing User Accounts

User accounts maintain the boundary between the people using the system and the processes running within it. Groups are a method for assigning system permissions to multiple users at once.

11.1 Creating User Accounts

Everyone using a Linux system should have a separate user account. Having an account provides a dedicated area for storing files and allows for personalizing the user interface (GUI, paths, environment variables, etc.) to suit individual habits.

You can use the Cockpit GUI to create accounts. If it’s not installed:

1
2

yum install cockpit -y
systemctl enable --now cockpit.socket

Then open localhost:9090 in your browser to manage it.

11.1.1 Adding Users with the useradd Command

In most cases, using a GUI is a hassle. You can use the useradd command instead (requires root). The only mandatory parameter is the login name. Useful options include:

Standard usage:

1
2
3

# As root
useradd yexca
passwd yexca

When creating the yexca account, useradd does the following:

1. Reads /etc/login.defs and /etc/default/useradd for default values.
2. Checks command-line arguments to see which defaults were overridden.
3. Creates new user entries in /etc/passwd and /etc/shadow.
4. Creates a new group entry in /etc/group.
5. Creates a home directory in /home based on the username.
6. Copies files from /etc/skel to the new home directory (usually login and app startup scripts).

A typical entry in /etc/passwd:

yexca:x:1001:1001::/home/yexca:/bin/bash

Fields are colon-separated: login name, password, UID, primary GID, comment, home directory, and default shell.

The x in the password field means the actual encrypted password is stored in /etc/shadow.

A typical entry in /etc/group:

yexca:x:1001:

Fields: group name, group password, GID, and a list of users in the group.

11.1.2 Setting User Defaults

useradd determines defaults by reading /etc/login.defs and /etc/default/useradd. You can modify these files to change default behavior.

In different Linux distros, login.defs varies. Here are some common ones:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

PASS_MAX_DAYS    99999
PASS_MIN_DAYS    0
PASS_MIN_LEN    5
PASS_WARN_AGE    7
UID_MIN    1000
UID_MAX    60000
SYS_UID_MIN    200
SYS_UID_MAX    999
GID_MIN    1000
GID_MAX    60000
SYS_GID_MIN    201
SYS_GID_MAX    999
CREATE_HOME    yes

To see other defaults, check /etc/default/useradd or run useradd -D.

You can use -D with other options to modify /etc/default/useradd:

• -b default_home — Set the base directory for home directories (usually /home).
• -e default_expire_date — Set the default account expiration date (YYYY-MM-DD).
• -f default_inactive — Set days after password expiry before an account is disabled.
• -g default_group — Set the default primary group. Usually, a new group with the same name/ID is created anyway.
• -s default_shell — Default shell.

11.1.3 Modifying Users with usermod

The usermod command is a straightforward way to change account parameters.

11.1.4 Deleting Users with userdel

The command userdel -r yexca deletes the user from /etc/passwd. The -r flag ensures the home directory /home/yexca is also removed.

Before deleting, it’s a good idea to find any orphaned files using find: find / -user yexca -ls or find / -uid 1001 -ls.

Files not assigned to a user can be a security risk. You should assign them to a real account. Use find / -nouser -ls to find files not associated with any existing user.

11.2 Understanding Group Accounts

Groups are useful for sharing a set of files among multiple users.

Use the chgrp grpName fileOrDir command to change the group ownership of a file or directory.

11.2.1 Using Group Accounts

Every user is assigned to a primary group, indicated by the fourth field in the /etc/passwd entry.

A user can belong to multiple supplementary groups or none at all. If user yexca is a member of groups yexca and hi, the entries in /etc/group look like this:

yexca:x:1001:yexca

hi:x:1002:yexca

Only root can change group memberships; regular users can’t change their own groups or add others to their groups.

If you want to create a file as a specific group, use the newgrp command to temporarily switch your effective group.

Users with root privileges can use gpasswd to set a password for a group.

11.2.2 Creating Group Accounts

Create: groupadd groupName

Assign GID: groupadd -g gid groupName

To modify a group, use the group name or GID:

groupmod -g gid userName

groupmod -n groupName userName

To change supplementary groups, use the usermod command mentioned earlier.

11.3 Managing Users in the Enterprise

ACL (Access Control Lists) technology allows you to assign specific permissions for files or directories to any user or group.

11.3.1 Setting Permissions with ACLs

Two main commands: setfacl to set and getfacl to view directory permissions.

When setting, use -m to modify or -x to remove permissions. For example:

setfacl -m u:userName:rwx filename

11.3.2 Adding Collaboration Directories for Users

When using chmod, there’s a special set of three permission bits often ignored. These set special permissions on commands and directories.

Example: chmod 775 /home/yexca/tmp.txt is actually 0775.

1. Creating a Group Collaboration Directory (Setting the GID bit)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Create a group for collaboration
groupadd -g 301 cooperation
# Add users
usermod -aG cooperation yexca
# Create the directory
mkdir /mnt/co-tmp
# Assign the group to the directory
chgrp cooperation /mnt/co-tmp
# Change directory permissions
chmod 2775 /mnt/co-tmp
# The permissions should now appear as rwxrwsr-x

Now, if user yexca creates a file in /mnt/co-tmp, the file’s group will be cooperation instead of yexca.

2. Creating a Restricted Deletion Directory (Sticky Bit)

Command: chmod 1775 /mnt/tmp

In a restricted deletion directory, only the root user or the file owner can delete a file, even if others have write permissions.

The /tmp directory is a classic example of this (permissions are rwxrwxrwt).

Set UID (SUID)

An executable with the SUID bit set (rwsr-xr-x) means that when others execute it, the process runs with the permissions of the file’s owner.

Example: The su command. All users can run it, but the resulting process belongs to root.

11.4 Centralized User Accounts

By default, Linux authenticates users against /etc/passwd and /etc/shadow. However, you can use other methods.

Examples include LDAP (Lightweight Directory Access Protocol), NIS (Network Information Service), Winbind, and more.