Creation of User Accounts

Chapter 7: User Account Management

7.1 Users and Groups

Managing user accounts is an important and unavoidable administrative duty. The overall system administration will often be evaluated by the way the user accounts are managed. Users participate in a UNIX system through their accounts: they navigate through their environment, work from their terminals, use their favorite commands, and do their jobs in their way. They want to control their resources and restrict access to them by others; however, they also want to reach all available resources. This is a profile of an average user on an UNIX system. UNIX systems exist to be used by users; making users happy is one of the primary administrative tasks, because happy users make for a happy administrator. The advice is very simple: manage user accounts properly, be tough when necessary and flexible at other times, and pay special attention to security issues, or you could experience a lot of headache later. From the systems standpoint, a user is not necessarily an individual. A user is any entity capable of executing programs or own files. The UNIX concepts of ownership and access privileges involve a number of system entities. These entities may be other computer systems, they may be particular system functions that run automatically, or they may be a group of people with similar functions. In most cases, however, a user is a particular individual who can log−in, edit files, run programs, and otherwise make use of the system. Each user has a username also known as a loginname that uniquely identifies the user. A system recognizes a user by the users identification number UID, which is assigned by the system administrator at the time the users account is created. The administrator also assigns each new user to at least one group a group is a collection of users who generally share similar functions. Each group has a group identification number GID, which serves the same purpose as the UID on the user level. Together, the users UID and GID determine the users credentials, i.e., the access rights a user has to files and other system resources. Basic user account information is stored in the etcpasswd file — this is the master users database for all users on the system. The etcpasswd file is an ASCII text file, readable by everyone on the system; this general file readability is required for regular system operations. Each user is described by a single entry in the file; each entry is a single line of information. Similarly, information about groups are stored in the file etcgroup. These two files contain comprehensive information about any user in the system, regardless of the users origin. Both files are public information; everyone may read them, but only the superuser is allowed to modify them.

7.1.1 Creation of User Accounts

You must create a new user account to add a new user to the system. User account creation is a routine procedure that consists of several mutually related steps; most of these steps are mandatory, but a few are optional. The required procedure consists of: Assigning a username, a user ID number, and a primary group to the user • Entering this data in the system user database the etcpasswd file and, if required, in any secondary password file • Assigning a password to the new account • Setting other user account parameters in use on the system, such as password aging, account expiration date, and other resource limits • 169 Placing initialization files in the home directory • Setting the new user ownership to the home directory and initialization files • Adding the user to any other facilities in use such as the disk quotas system • Defining any secondary group membership for the user in the system group file, etcgroup • Performing any other site−specific initialization tasks • Testing the new account • Basically, adding a new user means adding a new entry into the etcpasswd file. This may be done by simply editing the file using any editor on the UNIX platform the common editor is vi, or on BSD systems using the special editing command vipw vi password file. However, all UNIX systems provide some kind of utility for this purpose, a specific front−end command sometimes a script, but usually a program that performs efficient, accurate creations of new user accounts. On many UNIX systems, user account management is also a standard part of the existing general system administration tools such as SAM on HP−UX platform, or SMIT on AIX platform. All of these toolsutilities create new user accounts by automatically performing the previously listed steps; of course, the administrator must supply the required personal data for the user. These utilities check the supplied data and update the system user and group databases. Preexisting tools provide a general approach to user account creation; however, any site−specific requirements will call for additional administration. Quite often, system administrators make their own private utilities to perform site−specific functions in managing user accounts. Usually these are homemade scripts shell, expect, perl, etc.. Even though the use of existing utilities is highly recommended, the following text has a more basic approach. For educational purposes, the next section of the text goes through the gradual creation of a user account, step by step from the command line. First, though, let us see what the system user and group databases look like.

7.1.2 User Database — File etcpasswd