Administration System Users, Groups and Permissions
In Linux, each user has his/her own account name. Accompanying each user account is a record that describes the user: User ID# User password (encrypted) User groups (see below) User home directory (if there is one) User login shell Password expiration information (if any) Comments (usually stores the user's full name) Other fields are available as needed but are not very commonly used. Groups are available so that users can set permissions on files so that other people in the same group(s) can have common access. A private group is usually created whenever a user account is created. This inserts the user into a group that just contains themselves. When you do an ls l, you will see a file's owner (user name) and group (group name of the owner). You can also insert multiple users into other defined groups (this will be discussed later). To create a user, you may use the command line instruction useradd, or you may use the graphical user/group manager tool. To create a group, you may use the command line instruction groupadd, or you may use the graphical user/group manager tool. You may modify and delete users and groups using either the graphical user/group manager tool or by using usermod, groupmod, userdel, and groupdel. The graphical tool (shown below) is pretty straightforward to use. The command line instructions take a little practice.
As you can see, you can switch between managing users and groups by clicking on either tab. You can add a user or group by clicking on the appropriate button. To delete a user or group, you must first click on that user or group in the listing. To modify a user or group, select the user or group and the click on Properties. The useradd instruction is simple to use if you do not want to use anything but the default values. The instruction is as simple as useradd name. The command does allow a number of parameters: useradd [-u uid [-o]] [-g group] [-G group, ...] [-d home] [-s shell] username. Using u, you can set the new user's ID number. If you do not specify this, Linux will use the next available UID. d allows you to specify the user's home directory. If you do not specify this, Linux will use /home/username. Using s you can specify the user's default shell. If you do not specify this, it
will default to /bin/bash. Finally, -p allows you to specify an initial password. If you do not specify one, there is no initial password and the user can log in by simply hitting the enter key when asked for a password. This is a security problem and should never be done. Alternatively, once the account is created, you can use passwd to set the user's initial password. The name that comes at the end of useradd is the user's log in name. Using the c comment, you can specify the user's full name by placing it (or other comments) in " ". Using G, you can specify multiple groups that this new user will belong to. User account information is placed in the file /etc/passwd. The information in this file includes for each user, their user ID, user name, home directory, default shell, and comment (which usually is their full name). Interestingly, missing from this file is the user's password. In the past, this file included all user passwords, stored in an encrypted format. But because this file is readable by anyone, it allowed people to try to crack passwords because, while encrypted, it gave an indication of the password's length. Now, passwords are stored in the file /etc/shadow, which is only readable by root. Group information is stored in /etc/group. Each group is listed along with its group ID and the users who have been placed into that group. Groups are an important feature in Linux because it provides flexibility in defining access rights. Aside from the private group, a user can be added to any number of other groups. Permissions are associated with every file and directory in the Linux file space. Permissions break up into three categories for three sets of people. The three categories are read, write and execute and the three sets of people are the file's owner, the file's group, and others (everyone else). The three categories are fairly self explanatory for files. Note to modify a file, you must have write access otherwise you will have to copy the file and modify the copy instead. Some files may not require execute access because they are not executed (including files that are interpreted, for instance in a web browser). Shell scripts are like executable programs though and require execute privilege to be executed in your shell. Directories require execute access to be able to cd into them only read access to see what is in them. When you use ls l, you will see a file's owner and group. If you are in the group as listed in ls l, then you have that group's permissions. Remember that you may be in several different groups so you can have access to different files that are owned by different groups. The permissions are listed using this notation: filetype owner:read/write/execute group:read/write/execute other:read/write/execute. A typical file may look like this -rwxr-xr-meaning that the is file of type - (standard file), the owner has rwx (read, write and execute) permission, the group has read and execute permission and everyone else has read only permission. Another example might be drwxr----- which says that this directory has rwx for the owner and read only for the group. People in the same group can read the contents of the directory, but cannot cd to it nor copy or access any files from that directory. As the owner of a file, you can chance the file's owner or group (as long as you are the new owner, or belong to the new group) using chown and chgrp respectively, and you can change the file's permissions using chmod. The chmod instruction works like this: chmod newpermissions filename where newpermissions is one of the following: A 3-digit number that describes rwx permission for each of owner, group and world. A read permission is equal to 4, a write permission is equal to 2, and an execute permission is equal to 1. So to assign read and execute, it would be 4+1 = 5. If you want to set the permission of a file, foo, to be read/write/execute for the owner, read/write for the group, and read-only for everyone else, you would use chmod 764 foo. If you wanted to make the file read/execute for yourself and the group, and inaccessible to the rest of the world, you would use chmod 550 foo. The chmod
operation also allows you to change permissions for just owner (u), group (g) or world (o) by using u=rwx,g=rx,o=r or by using + to add a permission or to remove a permission. If the file currently is set as 764 and you want to remove write permission from the group, you would use chmod g-w foo. If you wanted to change the file to add execute to the group and remove read from the world, you would use chmod g+x,o-r foo. You can combine u, g, o terms and =, +, - terms as you like. When you create a new account, it automatically does several things. First, it adds the new user's information to /etc/passwd and the initial password to /etc/shadow. It also creates a home directory (unless you specify that you do not want the user to have one) and populates the directory with any files that are in the directory /etc/skel. As a system administrator, you can place certain files in /etc/skel that you want everyone to have (such as your .bashrc or a .profile or .login script). In Ubuntu, this directory has default files of .bashrc, .bash_logout and .bash_profile. Other items that you might choose to place in /etc/skel could be template documents that all users might use, environment variables to access resources such as printers, and additional scripts for other shells or for other start-up routines. Configuration files /etc/login.defs and /etc/default/useradd are used by all users. Note that /etc/skel is set up already for you, but you should tailor it based on the needs of your particular organization. As a system administrator, some important instructions to know are su, passwd, chage. su switch user. As root, you can switch to any user without needing to know their password. Once you have switched, you have that user's full access rights. If y...