Hello and welcome to this video on Oracle Linux 8.
In this video, I will cover Oracle Linux 8's users and group administration.
For our objectives today and after viewing this video, you should be able to:
Explain user and group implementation
Describe user and group configuration files
Configure users and groups
And lastly you will be able to implement user private groups (UPG).
Each user in Linux has a unique user ID or UID, which is an ordinary integer number,
and an associated username.
Users log in by using their usernames, but the system uses the associated UIDs.
Each user account also has a home directory and a login shell.
When users log in, they are placed in their home directory and their login shell executes.
All of this user account information is stored in the /etc/passwd file.
Each user also belongs to one or more groups.
Different users can be assigned to the same group.
Access can be given to a group and all members of the group are granted the same access privileges.
Each group account in Linux has a unique group ID (GID) and an associated group name.
Group information is stored in the /etc/group file.
Oracle Linux uses a user private group (UPG) scheme.
When a new user account is added, a new user private group is also created.
The user private group has the same name as the user, and the new user is the only member
of this group.
Both users and groups use shadow passwords.
Passwords are hashed and stored in different files: /etc/shadow for users and /etc/gshadow
for groups.
Security improves by storing hashed passwords in shadow files, because these files are readable
only by the root user.
The use of shadow passwords also provides password aging parameters and allows security
policies to be enforced using the /etc/login.defs file.
Only the root user can add, modify, or delete user and group accounts.
When a new user is added, the information is stored as a single, colon-separated line
in /etc/passwd.
Referencing the example entry shown:
Oracle is the username
X indicates that shadow passwords are used
Next 1000 is the UID.
Followed by 1000 which is the GID of the user's primary group.
The oracle student is designated as General Electric Comprehensive Operating System or
GECOS information, used only for informational purposes such as full name.
/home/oracle is the home directory for this user
And /bin/bash is the default shell for this user.
With shadow passwords, a new entry is automatically added to /etc/shadow when a new user is created.
This file can be viewable only by root.
As an example of an entry in this file:
Oracle is the username
$6$zGK... is the hashed password value
The plain text password itself is not stored on the disk.
An algorithm creates a unique string from a password.
17429 is the number of days since the password has changed counted in days since Jan 1, 1970.
0 is the number of days that need to pass before the password must be changed by the
user.
99999 is the maximum number of days since the password changed that the password can
be used.
After this amount of days, the password must be changed by the user.
7 is the number of days before the expire date that the user is warned about the pending
password change policy.
If the password is not changed after this number of days, the user account is locked.
The next field is empty but is used to store the last date when the account was locked.
The last field is also empty but is not used.
Because Oracle Linux uses a UPG scheme, a new entry is automatically created in /etc/group
when a new user is added.
The group name is the same as the username.
As an example as shown:
oracle is the group name
x indicates that shadow passwords are used
1000 is the GID
Oracle is the List of users that are members of the group.
Hashed group passwords are stored in the /etc/gshadow file.
However, group passwords are rarely used.
An example of an entry in this file is shown:
Oracle is the group name
!! is the hashed password
The !! indicates that the account is locked
oracle is the list of users that are members of the group
The last two fields are used to designate administrators and members.
You can use the useradd command to add a user account.
The syntax is useradd with any [options] followed by username.
When creating a new user without any options, the default settings are applied which are
stored in /etc/default/useradd.
You can use the -D option to display or modify the defaults.
Also by default, useradd creates a locked user account.
To unlock the account and assign a password, run the passwd user_name command as root.
Whenever a new user is created the users' home directory is populated with files from
the /etc/skel directory.
You can also create a nologin user by using the -s option followed by the /sbin/nologin
command and the user's username.
Now let's add a user from the command line.
As root, use the useradd command to add the user alice.
Use the cat command to view the newly added user's entry in the /etc/passwd file.
Notice that the new user's UID and GID.
Also, notice that a home directory was created for alice.
A new default shell was also created for alice.
Now, let's use the ls command to verify that alice's home directory was created.
Use the ls command to verify.
Notice that a home directory was created because CREATE_HOME in /etc/login.defs is set to yes.
Next clear the screen by entering the clear command.
And now let's verify by viewing the value of CREATE_HOME in /etc/login.defs by running
the grep command.
Let's view the default settings for a new user stored in /etc/default/useradd by entering
the cat command.
Notice that the SKEL directive is set to /etc/skel.
Let's view the contents of /etc/skel directory.
Let's also view the contents of the new user's home directory.
Notice that the contents of SKEL are copied to alice's home directory.
Let's view alice's entry in /etc/passwd.
Run the tail command as follows.
Notice that the UID and GID are 1002.
Also note the GECOS information and the default shell.
You can use the usermod command to modify an existing user account.
The syntax is usermod followed by any [options] followed by user_name.
One of the most common uses of the usermod command is to add a user to another secondary
group.
Use the -a capital G options followed by a comma-separated list of the secondary groups
for adding the user.
As shown, the example adds the the user to the secondary group 1017.
You can use the userdel command to delete a user account.
The syntax is userdel followed any options again followed by the username.
For options, -f will force removal of the user even if the user is logged in.
And 'r will remove the user's home directory.
Let's modify a user account.
You can use the usermod command to modify the GECOS information for the user alice as
follows.
Now view alice's entry in the /etc/passwd file.
As you can see the modification to alice's GECOS information was successful.
Next let's assign a password to the new user.
Use the cat command to view the /etc/shadow file.
Notice that the "!!" in alice's record indicate no password has been assigned and the account
is locked.
Let's use the passwd command to create a password for the user alice.
Enter in a password when prompted.
Clear the screen again with the clear command.
Revisit and view the /etc/shadow file.
Notice the "!!" has been replaced with a hashed password value.
Use the groupadd command to add a group account.
The syntax is groupadd then [options] followed by the group_name
Use the groupmod command to modify a group account.
The syntax is for this command is groupmod followed by [options] then the group_name.
Use the groupdel command to delete a group account.
The syntax is groupdel group_name.
You can remove groups even if there are members in the group.
You cannot remove the primary group of any existing user.
You must remove the user before removing the group.
Use the gpasswd command to administer /etc/group and /etc/gshadow.
Every group can have administrators, members, and a password.
The syntax is gpasswd [options] group_name.
As shown, the user alice is added to the staff group.
Let's add a group.
Use the groupadd command without any options to add the staff group.
View the new staff entry in the /etc/group file.
Notice that the GID for the new group staff is incremented by one.
Let's add alice to the group.
Use the usermod command to add alice to the staff group.
Clear the screen with the clear command once again.
Use the tail command to view the last group called staff.
Notice that alice has a secondary group membership in the staff group.
Lastly view the primary group membership for alice.
Notice that alice's primary group is still 1002.
As previously mentioned, Oracle Linux uses a user private group (UPG) scheme.
Whenever new user accounts are added, they have a unique group.
The purpose of this UPG scheme is to make Linux groups easier to use.
Traditionally on Linux systems, the umask was 0022, which prevented other users and
other members of a user's primary group from modifying a file.
The following example illustrates the permissions on newly created files and directories when
umask is set to 0022.
For implementing UPG:
First, create a directory to share.
Next create a new group then add users to this new group.
Followed by, changing the group ownership for the directory.
And finally, set the setgid bit on the directory.
After watching this video, you should now be able to:
Explain user and group implementation
Describe user and group configuration files
Configure users and groups
And lastly you should now be able to implement user private groups.
Oracle provides an extensive number of resources which you can use to learn more about this
subject and others.
Look for additional videos on Oracle Linux 8 and other topics using the links shown.
This concludes the video.
Thank you for watching.