% Linux Installation and Getting Started    -*- TeX -*-
% users.tex
% Copyright (c) 1993 by Matt Welsh and Lars Wirzenius
%
% This file is freely redistributable, but you must preserve this copyright 
% notice on all copies, and it must be distributed only as part of "Linux 
% Installation and Getting Started". This file's use is covered by
% the copyright for the entire document, in the file "copyright.tex".

\section{Managing Users}\label{sec-manage-users}\label{sec-add-user}

\index{system administration!adding users}
\index{adding users}
\index{users!adding}
Whether or not you have many users on your system, it's important
to understand the aspects of user management under Linux. Even if you're
the only user, you should presumably have a separate account for yourself
(an account other than {\tt root} to do most of your work). 

	Each person using the system should have his or her own
	account.  It is seldom a good idea to have several people share
	the same account. Not only is security an issue, but accounts
	are used to uniquely identify users to the system. You need
	to be able to keep track of who is doing what.

\subsection{User management concepts}
The system keeps track of a number of pieces of information about 
each user. They are summarized below.
\begin{dispitems}

\index{users!username of}
\index{username!defined}
\ditem{{\bf username}}
The username is the unique identifier given to every user on the system.
Examples of usernames are {\tt larry}, {\tt karl}, and {\tt mdw}. 
Letters and digits may be used, as well as the characters ``{\tt \_}''
(underscore) and ``{\tt .}'' (period). Usernames are usually limited
to 8 characters in length.

\index{users!user ID of}
\index{user ID!defined}
\index{UID!defined}
\ditem{{\bf user ID}}
The user ID, or UID, is a unique number given to every user on the
system. The system usually keeps track of information by UID, not
username. 

\index{users!group ID of}
\index{group ID!defined}
\ditem{{\bf group ID}}
The group ID, or GID, is the ID of the user's default group. In
Section~\ref{sec-perms} we discussed group permissions; each user
belongs to one or more groups defined by the system administrator.
More about this below.

\index{users!password of}
\ditem{{\bf password}}
The system also stores the user's encrypted password. The {\tt passwd}
command is used to set and change user passwords.

\index{users!full name of}
\ditem{{\bf full name}}
The user's ``real name'' or ``full name'' is stored along with the
username. For example, the user {\tt schmoj} may have the name
``Joe Schmo'' in real life. 

\index{users!home directory of}
\index{home directory!defined}
\ditem{{\bf home directory}}
The home directory is the directory in which the user is initially
placed at login time. Every user should have his or her own home
directory, usually found under {\tt /home}.

\index{users!login shell of}
\index{login shell!defined}
\ditem{{\bf login shell}}
The user's login shell is the shell which is started for the user at
login time. Examples are {\tt /bin/bash} and {\tt /bin/tcsh}. 
\end{dispitems}

\index{/etc/passwd@{\tt /etc/passwd}}
\index{password file!format of}
The file {\tt /etc/passwd} contains this information about users. 
Each line in the file contains information about a single user; 
the format of each line is
\begin{tscreen}
username:encrypted password:UID:GID:full name:home directory:login shell
\end{tscreen}
An example might be:
\begin{tscreen}
kiwi:Xv8Q981g71oKK:102:100:Laura Poole:/home/kiwi:/bin/bash
\end{tscreen}

As we can see, the first field, ``{\tt kiwi}'', is the username.

The next field, ``{\tt Xv8Q981g71oKK}'', is the encrypted password.
Passwords are not stored on the system in any human-readable format.
The password is encrypted using itself as the secret key. In other
words, you need to know the password to decrypt it. This form of
encryption is fairly secure.

Some systems use ``shadow password'' in which password information is
relegated to the file {\tt /etc/shadow}. Because {\tt /etc/passwd}
is world-readable, {\tt /etc/shadow} provides some degree of extra
security because it is not. Shadow password provides some other features
such as password expiration and so on; we will not go into these
features here.

The third field, ``{\tt 102}'', is the UID. This must be unique for each
user. The fourth field, ``{\tt 100}'', is the GID. This user belongs
to the group numbered 100. Group information, like user information, is
stored in the file {\tt /etc/group}. See Section~\ref{sec-manage-groups}
for more information.

The fifth field is the user's full name, ``{\tt Laura Poole}''. The
last two fields are the user's home directory ({\tt /home/kiwi}) and
login shell ({\tt /bin/bash}), respectively. It is not required
that the user's home directory be given the same name as the username.
It does help identify the directory, however.

\subsection{Adding users}
\index{users!adding!with adduser@adding with {\tt adduser}}
\index{users!adding!with useradd@adding with {\tt useradd}}
\index{adding users!with adduser@with {\tt adduser}}
\index{adding users!with useradd@with {\tt useradd}}
\index{useradd@{\tt useradd}}
\index{adduser@{\tt adduser}}
When adding a user, there are several steps to be taken. First, the
user must be given an entry in {\tt /etc/passwd}, with a unique
username and UID. The GID, fullname, and other information must be
specified. The user's home directory must be created, and the permissions
on the directory set so that the user owns the directory. Shell 
initialization files must be provided in the new home directory and other 
system-wide configuration must be done (for example, setting up a spool
for incoming e-mail for the new user).

While it is not difficult to add users by hand (I do), when you are
running a system with many users it is easy to forget something. 
The easiest way to add users is to use an interactive program which
asks you for the required information and updates all of the system
files automatically. The name of this program is {\tt useradd} or
{\tt adduser}, depending on what software was installed. The man pages
for these commands should be fairly self-explanatory.

\subsection{Deleting users}
\index{users!deleting}
\index{deleting users}
\index{userdel@{\tt userdel}}
\index{deluser@{\tt deluser}}
Similarly, deleting users can be accomplished with the commands
{\tt userdel} or {\tt deluser} depending on what software was
installed on the system. 

\index{users!disabling}
\index{disabling users}
If you'd like to temporarily ``disable'' a
user from logging into the system (without deleting the user's account),
you can simply prepend an asterisk (``{\tt *}'') to 
the password field in {\tt /etc/passwd}. For example, changing {\tt kiwi}'s
{\tt /etc/passwd} entry to
\begin{tscreen}
kiwi:*Xv8Q981g71oKK:102:100:Laura Poole:/home/kiwi:/bin/bash
\end{tscreen}
will restrict {\tt kiwi} from logging in. 

\subsection{Setting user attributes}
\index{users!setting attributes for}
\index{users!setting password for}
\index{passwd@{\tt passwd}}
After you have created a user, you may need to change attributes for
that user, such as home directory or password. The easiest way to
do this is to change the values directly in {\tt /etc/passwd}. To
set a user's password, use the {\tt passwd} command. For example,
\begin{tscreen}
\# {\em passwd larry}
\end{tscreen}
will change {\tt larry}'s password. Only {\tt root} may change other
user's password in this manner. Users can change their own passwords with
{\tt passwd} as well.

\index{login shell!setting with chsh@setting with {\tt chsh}}
\index{fullname!setting with chfn@setting with {\tt chfn}}
\index{chfn@{\tt chfn}}
\index{chsh@{\tt chsh}}
\index{users!changing login shell for}
\index{users!changing fullname for}
On some systems, the commands {\tt chfn} and {\tt chsh} will be available
to allow users to set their own fullname and login shell attributes. If
not, they will have to ask the system administrator to change these
attributes for them.

\subsection{Groups}\label{sec-manage-groups}
\index{groups}
\index{permissions!group}
\index{files!permissions!group}
As we have mentioned, each user belongs to one or more groups. The
only real importance of group relationships pertains to file permissions,
as you'll recall from Section~\ref{sec-perms}, each file has a ``group
ownership'' and a set of group permissions which defines how users in that
group may access the file. 

There are several system-defined groups such as {\tt bin}, {\tt mail},
and {\tt sys}. Users should not belong to any of these groups; they
are used for system file permissions. Instead, users should belong to
an individual group such as {\tt users}. If you want to be cute, you
can maintain several groups of users such as {\tt student},
{\tt staff}, and {\tt faculty}. 

\index{/etc/group@{\tt /etc/group}!format of}
The file {\tt /etc/group} contains information about groups. 
The format of each line is
\begin{tscreen}
group name:password:GID:other members
\end{tscreen}
Some example groups might be:
\begin{tscreen}
root:*:0: \\
users:*:100:mdw,larry \\
guest:*:200: \\
other:*:250:kiwi
\end{tscreen}
\index{users!list groups for}
\index{groups@{\tt groups}}
The first group, {\tt root}, is a special system group reserved for
the {\tt root} account. The next group, {\tt users}, is for regular
users. It has a GID of 100. The users {\tt mdw} and {\tt larry}
are given access to this group. Remember that in {\tt /etc/passwd}
each user was given a default GID. However, users may belong to 
more than one group, by adding their usernames to other group lines
in {\tt /etc/group}. The {\tt groups} command lists what groups you
are given access to.

The third group, {\tt guest}, is for guest users, and {\tt other}
is for ``other'' users. The user {\tt kiwi} is given access to this
group as well.

As you can see, the ``password'' field of {\tt /etc/group}
is rarely used. It is sometimes used to set a password on group
access. This is seldom necessary. To protect users from changing into
priveleged groups (with the {\tt newgroup} command), set the password
field to ``{\tt *}''.

\index{addgroup@{\tt addgroup}}
\index{groupadd@{\tt groupadd}}
\index{groups!adding}
\index{groups!deleting}
The commands {\tt addgroup} or {\tt groupadd} may be used to
add groups to your system. Usually, it's easier just to add
entries in {\tt /etc/group} yourself, as no other configuration
needs to be done to add a group. To delete a group, simply delete
its entry in {\tt /etc/group}.
