Account Management

Most users should have already created accounts through a graphical user interface during Linux installation. However, managing accounts through the command-line interface allows for finer adjustments, such as setting the password expiration date, specifying the home directory location, and choosing the default shell. It also provides an opportunity to understand the underlying principles.

Linux is a multi-user and multi-tasking operating system, allowing multiple users and groups to use it simultaneously. Therefore, managing and maintaining user accounts is a fundamental and necessary task for system administrators, especially considering that many Linux servers may not have a graphical user interface and can only be managed through command-line methods.

• /etc/passwd
  File "/etc/passwd" is a configuration file that traditionally stored user account information, including login passwords. However, the permissions of "/etc/passwd" are set to "rw- r-- r--," allowing anyone to read it. Having such an important file easily accessible like this poses a security risk, as it can be easily compromised. To address this issue, a more secure approach was introduced, and the sensitive information in "/etc/passwd" was moved to a shadow file called "/etc/shadow."

  Now, since "/etc/passwd" no longer contains password information, let's see what it actually stores. We can observe the file by examining the first and last few lines using the head and tail commands, as shown below:

  
  

  $ head -n3 /etc/passwd root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin $ tail -n3 /etc/passwd gdm:x:42:42::/var/gdm:/sbin/nologin aaa:x:500:500::/home/aaa:/bin/bash bbb:x:501:501::/home/bbb:/bin/bash

  
  The contents of "/etc/passwd" are structured in rows with fields separated by colons ":". Each row contains 7 pieces of information, in the following format:
  
  

  User Name:	Password:	UID:	GID:	Remark:	Home Directory:	Shell
  ↑	↑	↑	↑	↑	↑	↑
  1	2	3	4	5	6	7

  
  Here is a detailed explanation of the contents:
  
  
  1. User Name :
     This field records the username of the account. Typically, the superuser account (root) is listed in the first row, followed by system accounts (used for system services and commands like sync or shutdown, and finally, user accounts (intentionally chosen with high visibility, such as "aaa" or "bbb").
     
     
  2. Password :
     Why is the password field only represented by "x"? In the early days of UNIX, passwords were stored in this field directly. However, this practice posed a security risk as the passwords could be easily accessed. To address this, tools like the "Shadow Suite" were developed. The command pwconv (password convert) can be used to move the passwords to the shadow file ("/etc/shadow"). The "x" in this field indicates that the password is stored in the shadow file.
     
     
  3. UID (User ID) :
     The User ID represents the unique identifier for each user. The general rules for assigning UIDs are as follows:
     
     • ID=0:
       Superuser's ID (root).
     • ID=0~499
       
     System account IDs (may vary slightly depending on the Linux distribution).
     • ID > 500:
     General user account IDs (in the case of Fedora).
     
     Each user account has a corresponding UID, which should ideally be unique. Generally, a lower UID indicates a higher priority.
     
     
  4. GID (Group ID):
     The Group ID represents the identifier for the user's group. It follows similar rules as UID but pertains to groups instead of individual users.
     
     
  5. Remark :
     This field allows for additional information or comments about the user. For example, if multiple people have the same name (e.g., "michael"), the remark field can be used to distinguish them (e.g., "michael Jordan," "michael jackson"). It can be left blank if not needed.
     
     
  6. Home Directory :
     The home directory specifies the user's designated directory (using absolute path notation) where they store their personal files and configurations.
     
     
  7. Shell:
     The shell field denotes the default shell for the user upon login. UNIX/Linux systems offer various shell options, so the choice of shell can be customized based on the user's needs.

  Taking the example of the "aaa" account, the entry in the "/etc/passwd" file "aaa:x:500:500::/home/aaa:/bin/bash" represents the following information from left to right: username ("aaa"), password field ("x" indicating it is stored in the shadow file), UID and GID (both set to 500), home directory ("/home/aaa"), no remark specified, and the default shell upon login ("/bin/bash").
  
  

• /etc/shadow
  The "/etc/shadow" file serves as the shadow file for the account passwords stored in "/etc/passwd." It primarily contains the password information. Let's examine its contents:
  

  # ls -l /etc/passwd /etc/shadow ←Checking the permissions of these two files -rw-r--r-- 1 root root 1736 2011-11-03 01:47 /etc/passwd -r-------- 1 root root 1147 2011-11-03 01:47 /etc/shadow ↑Both files are owned by "root," but only "root" has read access to "/etc/shadow." # head -n3 /etc/shadow ←Make sure to read this as "root." root:$1$iTcAPoAy$a28ghr3y112Dxtp1AGpzF0:15280:0:99999:7::: bin:*:15280:0:99999:7::: daemon:*:15280:0:99999:7::: # tail -n3 /etc/shadow gdm:!!:15280:0:99999:7::: aaa:$1$01Mc6F6n$09JiVXW1PrT5JANipdaCr/:15280:0:99999:7::: bbb:$1$oXtIbeRn$u92TjWY.Okkr8SQY2kthr1:15280:0:99999:7:::

  By observing, we can see that "/etc/shadow" also uses colons ":" as separators, but it records 9 pieces of password information. The format is as follows:
  
  

  User Name:	Password:	Last:	May:	Must:	Warn:	Expire:	Disable:	Reserved:
  ↑	↑	↑	↑	↑	↑	↑	↑	↑
  1	2	3	4	5	6	7	8	9

  詳細內容如下:
  

  1. User Name:
     This field represents the account username, which is the same as in "/etc/passwd."
     
     
  2. Password :
     The actual password for the account is stored in this field. However, it is encrypted using ASCII characters, making it challenging to retrieve the original password unless you are an expert at decryption. If this field is empty, it means that no password is required for login. If the field starts with "!" or "!!," it indicates that the account is locked (cannot be logged into).
     
     
  3. Last (Last Password Change:):
     This field records the date of the last password change. Instead of directly recording the date, UNIX/Linux systems typically use the "UNIX Epoch Time," which is January 1, 1970, 00:00 as the reference point. In the example provided, "15280" for the "aaa" account means that the password was last changed 15,280 days after the UNIX Epoch Time, which corresponds to November 3, 2011. [note:1.0]
     
     
  4. May (Password Expiration):
     This field indicates the number of days before the password can be changed again after it has been modified or initially set. For example, if a new employee is on a trial period for a month, and you do not want them to change their password during that time, you can set this field to "30." A value of "0" means the password can be changed at any time.
     
     
  5. Must (Password Expiration Warning):
     It functions similarly to the requirement for changing a password within a specified time period when obtaining a bank's debit card. If this field contains "99999," it means that the password is set to never expire.

     When a password expiration time is set, the system will notify the user with a message like "Your password will expire in N days" when they log in. This serves as a reminder for the user to change their password before it expires.
     

  6. Warn (Account Inactivity Days):
     This field allows for a grace period after the password expiration date, during which the user can still log in and change their password to make it valid again. If not used, this field remains blank. It is commonly used for situations where an employee may be traveling or ill before their password expiration date, ensuring they can still access their account upon return without burdening the system administrator.
     
     
  7. Expire (Account Expiration):
     Similar to the "Password Expiration" field, this field represents the number of days after which the account becomes invalid. It uses the "UNIX Epoch Time" format. If not used, this field remains blank. It is often employed for temporary contract employees, where the account becomes invalid after a specific time period.
     
     
  8. Disable (Expiration Time):
     The configuration in this field is similar to the third field, represented by the number of days since the UNIX Epoch Time[note:1.0.]It is commonly used for time-limited contract employees, where the account becomes inactive once the specified time period has passed. If not used, this field remains blank.

     For example, if an employee's contract is set to expire on December 30, 2012, you can calculate the number of days between that date and the UNIX Epoch Time. To do this, you can use the command "date -d '2012/12/30' +%s" to obtain the number of seconds since the UNIX Epoch Time for the given date. Then, you divide this timestamp by 86400 (the number of seconds in a day), round the result, and take the integer value as the answer.

     Setting an expiration date using the "disable" field ensures that an account becomes inactive once the specified period has elapsed. This feature is commonly used for managing time-limited access or temporary user accounts, such as those created for contract employees.[note 1.1]
     

  9. Reserved :
     This field is currently reserved and not utilized.。

^ back on top ^

The passwd command has special permissions with the SUID (Set User ID) permission, which temporarily elevates the user's privileges to root, allowing them to modify "/etc/shadow" (similarly, commands like chfn or chsh have the same special privileges). While it is possible to manually modify "/etc/shadow" as the Superuser to achieve the same result as the passwd command, it involves dealing with the 9 fields, which can be error-prone. Using passwd simplifies the process for you.

The passwd command has additional or advanced options that are typically applicable only to the Superuser. Here is an example of one such option:

For regular users, the passwd command can only change their own passwords. To change someone else's password, lock an account, set password expiration, or perform advanced management tasks, Superuser privileges are required. The usage for these cases is passwd username.

For example, if someone is on a leave of absence, the Superuser can use the vipw command to add a "!" or "!!" at the beginning of the password field (second field) in "/etc/shadow" to temporarily lock the account (preventing login). The "!" or "!!" is then removed when the person resumes work. However, it is recommended to use the passwd -l and passwd -u commands to simplify this process without directly editing "/etc/shadow".

^ back on top ^

After creating an account but before setting a password with passwd, if you observe the "/etc/passwd" file, you will notice that the password field (second field) displays "!!," indicating that the account is locked (since it exists but has no password yet). Therefore, the typical next step is to use passwd to set a password for the new account. Alternatively, you can use passwd -uf USER_NAME to forcibly unlock a locked account. However, since no password is set, this account can be accessed without a password. Although users of this account can set their preferred password after logging in, it is not recommended to rely on this approach.

The useradd command records the relevant information for the newly created account in "/etc/shadow" and "/etc/passwd". Advanced usage is as follows:

The useradd -D command allows you to query and modify the default settings for creating new user accounts. These settings govern various aspects of account creation and can be adjusted using "useradd -D" followed by the appropriate options.

For example, running useradd -D will display the current default settings as shown below:

The actual useradd -D command shows the contents of the configuration file "/etc/default/useradd". You can manually edit this file to change the default account creation rules. However, it's recommended to use useradd -D [-option] to modify the settings to avoid potential errors.

The above command changes the "/etc/default/useradd" configuration file. From now on, when you use "useradd" to create new accounts, the expiration date in the 8th field of "/etc/shadow" will be automatically set to September 1, 2016.

^ back on top ^

^ back on top ^

Since editing "/etc/passwd" and "/etc/shadow" manually can be error-prone due to the numerous fields (and because many people find the "malicious interface" of vi unpleasant), it is recommended to use usermod as introduced next for more secure account management.

usermod : Modifying an account
The usermod command is similar to a combination of useradd and passwd. It allows you to modify various aspects of a user account, such as the account name, primary group, and password expiration date. Only the Superuser has the privilege to execute this command. Here are some examples of how to use it:

^ back on top ^

• chfn : Change finger command display information
  chfn allows users to modify the information displayed by the finger command. It actually changes the 5th field in "/etc/passwd," which is the comment or description section. This comment contains comma-separated fields, including the full name, company name, company phone number, home phone number, etc.

  The usage of "chfn" is as follows:

  
  

  Syntax:chfn -otpiton [USER_NAME]
  Command name/Function/Command user	Options	Function
  chfn/ change finger information/ Any	-f	Change the full name
  	-o	Change the company name
  	-p	Change the company phone number
  	-h	Change the home phone number
  	--help	Displays the command's built-in help and usage information

  
  Most distributions only allow the system administrator to execute the chfn command
  
  Example:
  

  # chfn -f "John Doe" -h "123-456-7890" john ←Sequentially change the full name and home phone of the account "john"

   

  
  
  
• chsh : Change login shell
  When a system administrator creates an account for you, the default shell might not be the one you prefer. In such cases, you can use the chsh command to change it to your desired shell. Here's how to use it:
  
  

  Syntax:chsh[-otpiton][--option] [USER_NAME]
  Command name/Function/Command user	Options	Function
  chsh/ Change login shell/ Any	-s	Specifies the login shell to be used
  	-l	Lists the available shells
  	--help	Displays the command's built-in help and usage information

  
  Example:

  $ chsh -l ←Lists the available shells /bin/sh /bin/bash /sbin/nologin /bin/zsh $ chsh -s /bin/zsh ←Sets "Z Shell" as the default shell for this account (effective after logging out and logging in again)

  
  

  The chsh -s command directly modifies the "Shell" field (7th field) in "/etc/passwd," while chsh -l reads the valid shells listed in the "/etc/shells" configuration file.

  A special shell is "/sbin/nologin," which is used to restrict local logins for certain accounts (e.g., system accounts) by not providing a home directory or loading a shell upon login. It is primarily used for remote logins and system accounts.

  If the system is undergoing maintenance and you don't want users to log in, the superuser can create the file "/etc/nologin" using the command echo > /etc/nologin. After creating this file, all users except for the root will be prevented from logging in.
  
  
  

• finger : Querying an account
  The finger command is used to search for and display information about user accounts.

  The finger command can search for both local and remote users and displays the following information:

  • Login Name
  • User Name (Full Name or other comments)
  • Home directory
  • Shell (login shell)
  • Login status
  • Mail status
  • ~/.plan (plan file) [Note 1.0A]
  • ~/.project (project file)
  • ~/.forward (forwarded email)
  • ~/.pgpkey (PGP key)
  Usage examples:

  Syntax:finger [-otpiton] [USER_NAME][@HOST]
  Command name/Function/Command user	Options	Function
  finger/ query account / Any	-l	This is the default and displays the user's full name, home directory, login shell, login status, mail status, and the content of the hidden files in the user's home directory (if they exist) 〝~/.plan〞[Note 1.0A]。 〝~/.forward〞 〝~/.project〞 〝~/.pgpkey〞
  	-m	Excludes searching by full name
  	-p	Excludes displaying the content of the hidden files in the user's home directory 〝~/.plan〞 〝~/.project〞 〝~/.pgpkey〞
  	-s	Excludes displaying the home directory, login shell, and mail status
  	--help	Displays the command's built-in help and usage information

  
  

  The finger command is case-insensitive when searching for accounts, and it searches for both the login name and the first name in the full name.

  The finger command can also be used to query remote users by specifying the format "finger user@host" or "finger@host."

  Examples:

  • finger john@abcd.com.tw: When using the "finger user@host" format, the default option is "-l" for the display mode.
  • finger @abcd.com.tw: When using the "finger @host" format, the default option is "-s" for the display mode.
    
    
  Please note that the availability and output of the finger command may vary based on the specific Linux distribution and its configuration. Also, keep in mind that in modern systems, some security practices might restrict or disable the use of the finger command due to potential privacy concerns.

^ back on top ^

The id command has various options to provide specific information: 

^ back on top ^

Here is the usage of the "who" command:

^ back on top ^

If the home directory contains a ".forward" file, "finger" will display the email addresses to which emails should be forwarded. For example, if the account "john" has a ".forward" file with the following content:

If forwarding is not successful despite having a ".forward" file, ensure that the "other" and "group" permissions do not have the "w" (write) permission. You can use the command "chmod go-w .forward" to remove write permissions, as the system may reject forwarding for security reasons.

Additionally, if you have multiple email accounts and don't want to check each one individually, you can use ".forward" to forward all emails to a single email account, making it more efficient.

Another hidden file, ".pgpkey," is used for "PGP keys."

[Note1.1]:
In practical applications, when setting the Linux system to UTC +8 (for example, Taipei time),'date -d '1970/01/01 08:00:00' +%s will output 0, as the "UNIX epoch" is based on UTC (Coordinated Universal Time) at "January 1, 1970, 00:00." When dealing with UNIX timestamps in different time zones, it is crucial to consider the "time difference" between the local time and UTC.