User Administration

In Linux there are three type of users.

1. Super user or root user
Super user or the root user is the most powerful user. He is the administrator user.

2. System users
System users are the users created by the softwares or applications. For example if we install Apache it will create a user apache. This kind of users are known as system users.

3. Normal users
Normal users are the users created by root user. They are normal users like John, Ramu etc. Only the root user has the permission to create or remove a user.

In linux systems every user will have a unique user ID. It is known as UID. The Range of UIDs will be as follows:

1. Root user          UID will be "0"

2. Systems users      UID will be "1 - 499"

3. Normal users       UID will be "500 - 60000"
The range of MIN_GID and MAX_GID is specified in the file  "/etc/login.defs".

#########
There are three important files a user administrator should be aware of.

1. "/etc/passwd"
2. "/etc/shadow"
3. "/etc/group"

Each of the above mentioned files have specific formats.

1. "/etc/passwd"

The first line will be like this.
root:x:0:0:root:/root:/bin/bash

There are seven fields in it with each separated by ":"
Fields are as follows,

username:password:userID:groupID:realname:homedirectory:shell

                                              or  User_name:Pointer_to_Shadow_file:UID:Comment:GID:Home_Directory:Login_shell

1. User_name is the name of the user.
2. Pointer to shadow file is the pointer to the "/etc/shadow" where the encrypted password for that user is stored.
3. UID is the user ID.
4. GID is the goup ID for the user.
5. Comment is a field where we can add some info about that user. Suppose if the user is a group leader, we can specify it there.
6. Home_dir denotes the path of users home directory. By default for root user it'll be "/root" and for normal user it'll be "/home/user_name".
7. Default login shell will be "/bin/bash". If we want to change it to korn shell edit it to "/bin/ksh". If no login shell is required for that user then give
"/sbin/nologin"

2. "/etc/shadow"

Shadow file contains the user's encrypted password and password aging options.

The first line will be like this
root:$1fdsfsgsdfsdkffefje:14757:0:99999:7:::

The fields are as  follows,

1. User_name
2. Encrypted password
3. Days since that password was last changed.
4. Days after which password must be changed.
5. Days before password is to expire that user is warned.
6. Days after the password is expires that the user is disabled.
7. Days since the account is disabled.
8. A reserved field.

3. "/etc/group"

Contains information about groups in the system.

The first line will be like this
root:x:0:root

The fields are as follows.

1. Group_name, the name of the group
2. The encrypted group password
3. GID, Group ID
4. User_list, all the group member's user names. Separated by commas.

How to create a user?

In linux a user can be created with specific UID, GID, comment, Home directory and login shell. The options are as follows.

The command to add a user is #adduser or #useradd. Actually useradd is the real command and adduser is a soft link to the useradd command. But the usage of
both are same.

A command to add a user with all the fields we mentioned before is as follows.
#useradd -u UID  -g GID/Group_name -c COMMENT -d Home_dir  -s LOGIN SHELL  User_name

An example:

#useradd -u 555 -g linux  -c Teamlead -d /teamleads/john -s /bin/ksh john
Prior to the executing of the above command you should create the group 'linux'.

You can also add -p for password and -G for secondary groups which we will see later.
If u want to add the password, u 've to give the password in encrypted form.

For example,
#useradd -p encrypted_password Joseph

Method 1: Linux useradd Command — Create User With Default Configurations

This is a fundamental low level tool for user creation. To create user with default configurations use useradd as shown below.

Syntax: # useradd LOGIN-NAME

 
While creating users as mentioned above, all the default options will be taken except group id. To view the default options give the following command with the option -D.

$ useradd -D
GROUP=1001
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/sh
SKEL=/etc/skel
CREATE_MAIL_SPOOL=no

• GROUP: This is the only option which will not be taken as default. Because if you don’t specify -n option a group with same name as the user will be created and the user will be added to that group. To avoid that and to make the user as the member of the default group you need to give the option -n.
• HOME: This is the default path prefix for the home directory. Now the home directory will be created as /home/USERNAME.
• INACTIVE: -1 by default disables the feature of disabling the account once the user password has expired. To change this behavior you need to give a positive number which means if the password gets expired after the given number of days the user account will be disabled.
• EXPIRE: The date on which the user account will be disabled.
• SHELL: Users login shell.
• SKEL: Contents of the skel directory will be copied to the users home directory.
• CREATE_MAIL_SPOOL: According to the value creates or does not create the mail spool.

Example 1: Creating user with all the default options, and with his own group.

Following example creates user ramesh with group ramesh. Use Linux passwd command to change the password for the user immediately after user creation.

# useradd ramesh

# passwd ramesh
Changing password for user ramesh.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.

# grep ramesh /etc/passwd
ramesh:x:500:500::/home/ramesh:/bin/bash

# grep ramesh /etc/group
ramesh:x:500:
[Note: default useradd command created ramesh as username and group]

Example 2: Creating an user with all the default options, and with the default group.

# useradd -n sathiya

# grep sathiya /etc/passwd
sathiya:x:511:100::/home/sathiya:/bin/bash

# grep sathiya /etc/group
[Note: No rows returned, as group sathiya was not created]

# grep 100 /etc/group
users:x:100:
[Note: useradd -n command created user sathiya with default group id 100]

# passwd sathiya
Changing password for user sathiya.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[Note: Always set the password immediately after user creation]

Example 3: Editing the default options used by useradd.

The following example shows how to change the default shell from /bin/bash to /bin/ksh during user creation.

Syntax: # useradd -D --shell=<SHELLNAME>

# useradd -D
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
[Note: The default shell is /bin/bash]

# useradd -D -s /bin/ksh

# useradd -D
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/ksh
SKEL=/etc/skel
[Note: Now the default shell changed to /bin/ksh]

# adduser priya

# grep priya /etc/passwd
priya:x:512:512::/home/priya:/bin/ksh
[Note: New users are getting created with /bin/ksh]

# useradd -D -s /bin/bash
[Note: Set it back to /bin/bash, as the above is only for testing purpose]

Method 2: Linux useradd Command — Create Users With Custom Configurations

Instead of accepting the default values (for example, group, shell etc.) that is given by the useradd command as shown in the above method, you can specify custom values in the command line as parameters to the useradd command.

Syntax: # useradd -s <SHELL> -m -d <HomeDir> -g <Group> UserName

• -s SHELL : Login shell for the user.
• -m : Create user’s home directory if it does not exist.
• -d HomeDir : Home directory of the user.
• -g Group : Group name or number of the user.
• UserName : Login id of the user.

Example 4: Crate Linux User with Custom Configurations Using useradd Command

The following example creates an account (lebron) with home directory /home/king, default shell as /bin/csh and with comment “LeBron James”.

# useradd -s /bin/csh -m -d /home/king -c "LeBron James" -g root lebron 

# grep lebron /etc/passwd
lebron:x:513:0:LeBron James:/home/king:/bin/csh

Note: You can give the password using -p option, which should be encrypted password. Or you can use the passwd command to change the password of the user.

Method 3: Linux adduser Command – Create Users Interactively

These are the friendlier tools to the low level useradd. By default it chooses the Debian policy format for UID and GID. A very simple way of creating user in the command line interactively is using adduser command.

Syntax: # adduser USERNAME

Example 5: Creating an User Interactively With adduser Command

# adduser spidey

Adding user `spidey' ...
Adding new group `spidey' (1007) ...
Adding new user `spidey' (1007) with group `spidey' ...
Creating home directory `/home/spidey' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for spidey
Enter the new value, or press ENTER for the default
 Full Name []: Peter Parker
 Room Number []:
 Work Phone []:
 Home Phone []:
 Other []:
 Is the information correct? [y/N] y

Method 4: Linux newusers Command — Creating bulk users

Sometimes you may want to to create multiple users at the same time. Using any one of the above 3 methods for bulk user creation can be very tedious and time consuming. Fortunately, Linux offers a way to upload users using newusers command. This can also be executed in batch mode as it cannot ask any input. Newsusers update and create new users in batch.

# newusers FILENAME

This file format is same as the password file.

loginname:password:uid:gid:comment:home_dir:shell

Example 6: Creating Large Number of Users Using newusers Command

If Simpson family decides to join your organization and need access to your Linux server, you can create account for all of them together using newusers command as shown below.

# cat homer-family.txt
homer:HcZ600a9:1008:1000:Homer Simpson:/home/homer:/bin/bash
marge:1enz733N:1009:1000:Marge Simpson:/home/marge:/bin/csh
bart:1y5eJr8K:1010:1000:Bart Simpson:/home/bart:/bin/ksh
lisa:VGz638i9:1011:1000:Lisa Simpson:/home/lisa:/bin/sh
maggie:5lj3YGQo:1012:1000:Maggie Simpson:/home/maggie:/bin/bash

Now create accounts for Simpsons family together using the newusers command as shown below.

# newusers homer-family.txt

NOTE:  By default user is added to /home directory. I'd like to add user to /iscsi/home/${user} directory instead of default /home. How do I force useradd to add user to /iscsi/home under CentOS / RHEL / Fedora Linux?

A. Default values for account creation defined in /etc/default/useradd file under CentOS / RHEL / Fedora / Debian / Ubuntu and other Linux distros. Simply open this file using a text editor:
# vi /etc/default/useradd
The default home directory defined by HOME variable, find line that read as follows:
HOME=/home
Replace with:
HOME=/iscsi/user
Save and close the file. Now you can add user using regular useradd command:
# useradd ashish
# passwd ashish
Verify user information:
# finger ashish
Output:

Login: ashish                            Name: ashish
Directory: /iscsi/user/ashish                Shell: /bin/bash
Last login Thu Sep 13 07:58 2007 (IST) on pts/1 from 10.16.15.2
No mail.
No Plan.

#########
How to create a group?

There are two kinds of users in linux. They are,

1. Primary group
2. Secondary group

When we create a user a group also will be created in the same name of the user. Suppose we creating a user abc with uid 540, then a group abc will be created
with same gid. And if the user abc creates a file xyz, it's owner will be user abc and group will be group abc. That is abc is its primary group. Thats normally
all the files and directories created by a user belongs to its primary group.

But what if the user needs access to the directories created by other groups? or a user has to supervise a number of groups? then comes the secondary group concept.
All the other groups are added as the secondary groups of that user.

The command to add a group is #groupadd

eg:

#groupadd group_name
#groupadd -g 540 linux

Suppose we want to create a user rahul with linux, java, hp, ibm as  secondary groups, it can be done as follows

#useradd  -G linux,java,hp,ibm  rahul
You have to specify all the secondary groups in single command, not one after one in different commands.

But you can appended the secondary groups to a user using the  -a option with usermod command.

For example,
A user john is a member of groups linux and java. We can append the group ibm to him as follows.

#usermod -a -G ibm john

Checking the groups of a user

#groups username
Will list all groups that the user belongs to.

How to set a password for a group?

#groupadd  linux
#gpasswd linux

the password will be saved in "/etc/gshadow".

To change the name of a group
#groupmod -n newname oldname

#########
Switching users

sometimes we may need to switch between users.
The command for switching is #su

1. #su
Switches to root user. But only gets privileges.

2. #su -
Switches to root user. Gets privileges and home directory access.

1. su raju
Switches to user raju

2. su - raju
gets also home dir access of raju.

If you are logined as root user and switching to normal user, you wont be prompted for the password. But you'll be prompted for password if otherwise.


Creating more users and setting passwords using a for loop.

Suppose we have to create 5 users linux1 to linux5 whose primary group is linux. And password same as their username.

First you have to create a group linux.
#groupadd linux

then

for i in 1 2 3 4 5
do
useradd - g linux  linux$i
echo linux$i | passwd --stdin linux$i
done

 
Creating more than 10 users
Suppose we have to create 50 users linux1 to linux50 whose primary group is linux. And password same as their username.

First you have to create a group linux.
#groupadd linux

then

for i in $(seq 1  50)
do
useradd - g linux  linux$i
echo linux$i | passwd --stdin linux$i
done



















 SOL/// following is the script

####### file name : test.sh ##########
uid="user"
i=1
#modify 50 to user required number and "student" to your choice group
number_of_users=50
mygroup="student"
groupadd $mygroup
while [ $i -le $number_of_users ]
do
useradd -g $mygroup $uid$i
sh pwd $uid$i
i=`expr $i + 1`
done
###### end of test.sh ########
#create one more file with the name pwd and give execute permissions

####### file name : pwd ##########
passwd --stdin $1 <<end
$1123
$1123
end
##########end of pwd ############


 GROUP=INSERT_GROUP_NAME_HERE
 
SOL///
while read userid
do
useradd -g $GROUP $userid
passwd --stdin $userid <<EOF
$userid
$userid
EOF
done < INPUT_FILE_CONTAINS_50_USERID

NOTE: passwd and userid are the same


SOL/// create file user name like touch userlist
open file userlist
vim userlist
how much user create write user in userlist file
then make script

for i in $(cat userlist)
do useradd $i
echo redhat | passwd --stdin $i
done


SOL///
1.create file user name like touch userlist and add user names

2. vim userlist

3. create script touch quickuseradd

#/bin/bash

for i in $(cat userlist)
do useradd $i

echo $i | passwd --stdin $i
done

4. give permission
chmod 755 quickuseradd

5 run the script
./quickuseradd

password is same as username


SOL///########## useradd.sh################

for i in 1,2,3,4,5,6,7
do
useradd linux$i
done


Modifying existing users

We can also modify the existing user with #usermod command.
for example,

#usermod -u 555 -g linux  -c Teamlead -d /teamleads/john -s /bin/ksh john

We can change the login name of a user using the option  -l
Syntax is as follows

#usermod -l new_name  old_name

Locking and unlocking the users

#usermod -L username
Executing the above command will lock the user with username.

#usermod -U username
Executing the above command will unlock the user with username.

#########
Removing a user
we can remove a user using #userdel command

For example,

#userdel user_name
the above command will remove the user but not his home directory. This is for taking back up of the files from it in case needed.

#userdel -r user_name
the above commad will remove the user as well as user's home directory.

Ifyou choose to remove an existing account without deleting the home
directory, then the home directory and any files underneath will be owned by the user that assumes the previous user’s ID or just the user ID number. For example,


consider the account name of billc with the user ID of 20002. Before the account is removed, the directory and associated files might look like this:
# ls -al /homes/billc
total 1370
drwxr-xr-x 2 billc exec 512 Oct 22 15:30 .
drwxr-xr-x 4 root other 512 Oct 22 15:29 ..
-rw-r--r-- 1 billc exec 338 Oct 22 15:30 .login
-rw-r--r-- 1 billc exec 582 Oct 22 15:29 .profile
-rw-r--r-- 1 billc exec 192411 Oct 22 15:29 figure3_1
-rw-r--r-- 1 billc exec 230477 Oct 22 15:29 figure3_2
-rw-r--r-- 1 billc exec 230477 Oct 22 15:29 figure3_3
-rw-r--r-- 1 billc exec 338 Oct 22 15:29 sig
Figure 3-4 Delete User warning message


However, after the account has been removed (but not the home directory), the files will now look like this:


# ls -al /homes/billc
total 1370
drwxr-xr-x 2 20002 exec 512 Oct 22 15:30 .
drwxr-xr-x 4 root other 512 Oct 22 15:29 ..
-rw-r--r-- 1 20002 exec 338 Oct 22 15:30 .login
-rw-r--r-- 1 20002 exec 582 Oct 22 15:29 .profile
-rw-r--r-- 1 20002 exec 192411 Oct 22 15:29 figure3_1
-rw-r--r-- 1 20002 exec 230477 Oct 22 15:29 figure3_2
-rw-r--r-- 1 20002 exec 230477 Oct 22 15:29 figure3_3
-rw-r--r-- 1 20002 exec 338 Oct 22 15:29 sig


The reason for this is that within UNIX, the ownership of the directories and files use the user identification number—not the name—and in this case, 20002 is the numerical identification for the account billc. UNIX maps the name of the account with the defined user ID within the /etc/passwd file. So, when this mapping is broken—that is, the account name has been removed from the /etc/passwd file—UNIX no longer knows how to map the name and just displays the actual account ID instead. Note also that the group name remains intact. However, should we remove the exec group from the /etc/group file, we would encounter a similar mapping problem where only the group ID number will be displayed.
#########

Deleting the password of a user or allowing password less login for a user

#passwd -d u_name