Heading

Users and Groups


While users can be either people (meaning accounts tied to physical users) or accounts which exist for specific applications to use, groups are logical expressions of organization, tying users together for a common purpose. Users within a group can read, write, or execute files owned by that group.

Each user is associated with a unique numerical identification number called a user ID (UID). Likewise, each group is associated with a group ID (GID). A user who creates a file is also the owner and group owner of that file. The file is assigned separate read, write, and execute permissions for the owner, the group, and everyone else. The file owner can be changed only by root, and access permissions can be changed by both the root user and file owner.
Additionally, Red Hat Enterprise Linux supports access control lists (ACLs) for files and directories which allow permissions for specific users outside of the owner to be set.

 User Private Groups

Red Hat Enterprise Linux uses a user private group (UPG) scheme, which makes UNIX groups easier to manage. A user private group is created whenever a new user is added to the system. It has the same name as the user for which it was created and that user is the only member of the user private group.
User private groups make it safe to set default permissions for a newly created file or directory, allowing both the user and the group of that user to make modifications to the file or directory.
The setting which determines what permissions are applied to a newly created file or directory is called a umask and is configured in the /etc/bashrc file. Traditionally on UNIX systems, the umask is set to 022, which allows only the user who created the file or directory to make modifications. Under this scheme, all other users, including members of the creator's group, are not allowed to make any modifications. However, under the UPG scheme, this “group protection”is not necessary since every user has their own private group.

Shadow Passwords

In environments with multiple users, it is very important to use shadow passwords provided by theshadow-utils package to enhance the security of system authentication files. For this reason, the installation program enables shadow passwords by default.
The following is a list of the advantages shadow passwords have over the traditional way of storing passwords on UNIX-based systems:
  • Shadow passwords improve system security by moving encrypted password hashes from the world-readable /etc/passwd file to /etc/shadow, which is readable only by the rootuser.
  • Shadow passwords store information about password aging.
  • Shadow passwords allow the /etc/login.defs file to enforce security policies.
Most utilities provided by the shadow-utils package work properly whether or not shadow passwords are enabled. However, since password aging information is stored exclusively in the /etc/shadow file, any commands which create or modify password aging information do not work. The following is a list of utilities and commands that do not work without first enabling shadow passwords:
  • The chage utility.
  • The gpasswd utility.
  • The usermod command with the -e or -f option.
  • The useradd command with the -e or -f option.

    Adding a New Group

    To add a new user group, select Add Group from the toolbar. A window similar to  “New Group” appears. Type the name of the new group. To specify a group ID for the new group, select Specify group ID manually and select the GID. Note that Red Hat Enterprise Linux also reserves group IDs lower than 500 for system groups.
    New Group
     New Group

    Click OK to create the group. The new group appears in the group list.

     Adding a New User


    To add a new user, click the Add User button. A window as shown in Figure 3.2, “Adding a new user” appears.
    Adding a new user
    Figure 3.2. Adding a new user

    The Add New User dialog box allows you to provide information about the newly created user. In order to create a user, enter the username and full name in the appropriate fields and then type the user's password in the Password and Confirm Password fields. The password must be at least six characters long.
    The Login Shell pulldown list allows you to select a login shell for the user. If you are not sure which shell to select, accept the default value of /bin/bash.
    By default, the User Manager application creates the home directory for a new user in /home/username/. You can choose not to create the home directory by clearing the Create home directory checkbox, or change this directory by editing the content of the Home Directory text box. Note that when the home directory is created, default configuration files are copied into it from the /etc/skel/ directory.
    Red Hat Enterprise Linux uses a user private group (UPG) scheme. Whenever you create a new user, a unique group with the same name as the user is created by default. If you do not want to create this group, clear the Create a private group for the user checkbox.
    To specify a user ID for the user, select Specify user ID manually. If the option is not selected, the next available user ID above 500 is assigned to the new user. Because Red Hat Enterprise Linux reserves user IDs below 500 for system users, it is not advisable to manually assign user IDs 1–499.
    Clicking the OK button creates the new user. To configure more advanced user properties, such as password expiration, modify the user's properties after adding the user.

    Using Command Line Tools

     However, if you prefer command line tools or do not have the X Window System installed, you can use command line utilities that are listed in Table 3.1, “Command line utilities for managing users and groups”.
    Table 3.1. Command line utilities for managing users and groups
    UtilitiesDescription
    useradd, usermod, userdelStandard utilities for adding, modifying, and deleting user accounts.
    groupadd, groupmod, groupdelStandard utilities for adding, modifying, and deleting groups.
    gpasswdStandard utility for administering the /etc/groupconfiguration file.
    pwck, grpckUtilities that can be used for verification of the password, group, and associated shadow files.
    pwconv, pwunconvUtilities that can be used for the conversion of passwords to shadow passwords, or back from shadow passwords to standard passwords.

     Adding a New User

    To add a new user to the system, typing the following at a shell prompt as root:
    useradd [options] username
    …where options are command line options as described in, “useradd command line options”.
    By default, the useradd command creates a locked user account. To unlock the account, run the following command as root to assign a password:
    passwd username
    Optionally, you can set password aging policy. Refer to Red Hat Enterprise Linux 6 Security Guidefor information on how to enable password aging.
    Table 3.2. useradd command line options
    OptionDescription
    -c 'comment'comment can be replaced with any string. This option is generally used to specify the full name of a user.
    -d home_directoryHome directory to be used instead of default /home/username/.
    -e dateDate for the account to be disabled in the format YYYY-MM-DD.
    -f daysNumber of days after the password expires until the account is disabled. If 0 is specified, the account is disabled immediately after the password expires. If -1 is specified, the account is not be disabled after the password expires.
    -g group_nameGroup name or group number for the user's default group. The group must exist prior to being specified here.
    -G group_listList of additional (other than default) group names or group numbers, separated by commas, of which the user is a member. The groups must exist prior to being specified here.
    -mCreate the home directory if it does not exist.
    -MDo not create the home directory.
    -NDo not create a user private group for the user.
    -p passwordThe password encrypted with crypt.
    -rCreate a system account with a UID less than 500 and without a home directory.
    -sUser's login shell, which defaults to /bin/bash.
    -u uidUser ID for the user, which must be unique and greater than 499.

    Explaining the Process

    The following steps illustrate what happens if the command useradd juan is issued on a system that has shadow passwords enabled:
    1. A new line for juan is created in /etc/passwd:
      juan:x:501:501::/home/juan:/bin/bash
      The line has the following characteristics:
      • It begins with the username juan.
      • There is an x for the password field indicating that the system is using shadow passwords.
      • A UID greater than 499 is created. Under Red Hat Enterprise Linux, UIDs below 500 are reserved for system use and should not be assigned to users.
      • A GID greater than 499 is created. Under Red Hat Enterprise Linux, GIDs below 500 are reserved for system use and should not be assigned to users.
      • The optional GECOS information is left blank. The GECOS field can be used to provide additional information about the user, such as their full name or phone number.
      • The home directory for juan is set to /home/juan/.
      • The default shell is set to /bin/bash.
    2. A new line for juan is created in /etc/shadow:
      juan:!!:14798:0:99999:7:::
      The line has the following characteristics:
      • It begins with the username juan.
      • Two exclamation marks (!!) appear in the password field of the /etc/shadow file, which locks
      • The password is set to never expire.
    3. A new line for a group named juan is created in /etc/group:
      juan:x:501:
      A group with the same name as a user is called a user private group. For more information on user private groups, refer to, “User Private Groups”.
      The line created in /etc/group has the following characteristics:
      • It begins with the group name juan.
      • An x appears in the password field indicating that the system is using shadow group passwords.
      • The GID matches the one listed for user juan in /etc/passwd.
    4. A new line for a group named juan is created in /etc/gshadow:
      juan:!::
      The line has the following characteristics:
      • It begins with the group name juan.
      • An exclamation mark (!) appears in the password field of the /etc/gshadow file, which locks the group.
      • All other fields are blank.
    5. A directory for user juan is created in the /home/ directory:
      ~]# ls -l /home
total 4
drwx------. 4 juan juan 4096 Mar  3 18:23 juan
      This directory is owned by user juan and group juan. It has read, write, and executeprivileges only for the user juan. All other permissions are denied.
    6. The files within the /etc/skel/ directory (which contain default user settings) are copied into the new /home/juan/ directory:
      ~]# ls -la /home/juan
total 28
drwx------. 4 juan juan 4096 Mar  3 18:23 .
drwxr-xr-x. 5 root root 4096 Mar  3 18:23 ..
-rw-r--r--. 1 juan juan   18 Jun 22  2010 .bash_logout
-rw-r--r--. 1 juan juan  176 Jun 22  2010 .bash_profile
-rw-r--r--. 1 juan juan  124 Jun 22  2010 .bashrc
drwxr-xr-x. 2 juan juan 4096 Jul 14  2010 .gnome2
drwxr-xr-x. 4 juan juan 4096 Nov 23 15:09 .mozilla
    At this point, a locked account called juan exists on the system. To activate it, the administrator must next assign a password to the account using the passwd command and, optionally, set password aging guidelines.