30 - User Accounts

Question 1

User Account Management

By the end of this chapter, you should be able to:

Answer 1

1) Explain the purpose of individual user accounts and list their main attributes.
2) Create new user accounts and modify existing account properties, as well as remove or lock accounts.
3) Understand how user passwords are set, encrypted and stored, and how to require changes in passwords over time for security purposes.
4) Explain how restricted shells and restricted accounts work.
5) Understand the role of the root account and when to use it.
6) Use Secure Shell (ssh) and remove logins and commands.

Question 2

User Accounts:

Linux systems provide a multi-user environment which permits?

Answer 2

People & processes to have separate simultaneous working environments

Question 3

User Accounts:

What is the purposes of having individual user accounts include?

Answer 3

1) Providing each user with their own individualized private space
2) Creating particular user accounts for specific dedicated purposes
3) Distinguishing privileges among users.

Question 4

User Accounts:

What special user account allow the user to do anything on the system?

Answer 4

root account

Question 5

User Accounts:

To avoid making costly mistakes, and for security reasons, the root account should only be used when?

Answer 5

absolutely necessary

Question 6

User Accounts:

Normal user accounts are for?

Answer 6

regular people who will work on the system

Question 7

User Accounts:

Some user accounts (like the daemon account) exist for?

Answer 7

the purpose of allowing processes to run as a user other than root.

Question 8

User Accounts:

What is group management for? (discussed more in future chapter)

Answer 8

where subsets of the users on the system can share files, privileges, etc., according to common interests.

Question 9

Attributes of a User Account:

Each user on the system has a corresponding line in the ____ file that describes their basic account attributes. (We will talk about passwords, as well as this file, later). For example:

Answer 9

/etc/passwd

….

beav:x:1000:1000:Theodore Cleaver:/home/beav:/bin/bash warden:x:1001:1001:Ward Cleaver:/home/warden:/bin/bash dobie:x:1002:1002:Dobie Gillis:/home/dobie:/bin/bash

….

Question 10

Attributes of a User Account:

What are the 7 attributes of a User Account?

Answer 10

1. User name
2. User password
3. User Identification Number (UID)
4. Group Identification Number (GID)
5. Comment or GECOS Information
6. Home Directory
7. Login Shell

Question 11

Attributes of a User Account:

What is the User name attribute?

Answer 11

The unique name assigned to each user.

Question 12

Attributes of a User Account:

What is the User Identification Number (UID)​ attribute?

Answer 12

A unique number assigned to the user account. The UID is used by the system for a variety of purposes, including a determination of user privileges and activity tracking.

Question 13

Attributes of a User Account:

What is the User password attribute?

Answer 13

The password assigned to each user.

Question 14

Attributes of a User Account:

What is the Group Identification Number (GID) attribute?

Answer 14

Indicates the primary, principal, or default group of the user.

Question 15

Attributes of a User Account:

What is the Comment or GECOS Information attribute?

Answer 15

A defined method to use the comment field for contact information (full name, email, office, contact number). (Don’t worry about what GECOS means, it is a very old term.)

Question 16

Attributes of a User Account:

What is the Login Shell attribute?

Answer 16

Normally, this is a shell program such as /bin/bash or /bin/csh. Sometimes, however, an alternative program is referenced here for special cases. In general, this field will accept any executable.

Question 17

Attributes of a User Account:

What is the Home Directory attribute?

Answer 17

For most users, this is a unique directory that offers a working area for the user. Normally, this directory is owned by the user, and except for root will be found on the system somewhere under /home.

Question 18

Creating User Accounts

What command is used to create user accounts?

Answer 18

useradd

Question 19

Creating User Accounts

What is the location of the file that is used to configure useradd default settings?

Answer 19

/etc/default/useradd

Question 20

Creating User Accounts

Where is the defaults file that is used by a lot of the user management commands?

Answer 20

/etc/login.defs

The /etc/login.defs file provides default configuration information for several user account parameters. The useradd, usermod, userdel, and groupadd commands, and other user and group utilities take default values from this file. Each line consists of a directive name and associated value.

Question 21

Creating User Accounts

The default algorithm for creating a user accounts will auto assign the new users ___ and ___, ___ , and ___.

Answer 21

• UID
• GID
• home directory
• shell choice

Question 22

Creating User Accounts

What steps occur when creating this new user account?

$ sudo useradd dexter

Answer 22

1. The next available UID greater than UID_MIN (specified in /etc/login.defs) by default is assigned as dexter’s UID.
2. A group called dexter with a GID=UID is also created and assigned as dexter’s primary group.
3. A home directory /home/dexter is created and owned by dexter.
4. dexter’s login shell will be /bin/bash.
5. The contents of /etc/skel is copied to /home/dexter. By default, /etc/skel includes startup files for bash and for the X Window system.
6. An entry of either !! or ! is placed in the password field of the /etc/shadow file for dexter’s entry, thus requiring the administrator to assign a password for the account to be usable.

Question 23

Deleting User Accounts

What is the command used to delete a user?

Answer 23

userdel

Question 24

Deleting User Accounts

Only the ___ user can delete users

Answer 24

root

Question 25

Deleting User Accounts

When deleting a user as in:

$ sudo userdel morgan

What gets erased by default and what doesn’t?

Answer 25

Removes the user’s record in these files by default:

• /etc/passwd
• /etc/shadow
• /etc/group

Not Erased:

• the users home directory /home/morgan
• unless -r option is used,

Question 26

Modifying User Accounts

What command is used to change characteristics of a user account, such as group memberships, home directory, login name, password, default shell, user id, etc. It modifies the respective /etc files.

Answer 26

usermod

Question 27

Modifying User Accounts

What command is used to lock a user named “dexter” out of his account? (Making it so “dexter” cannot login anymore)

Answer 27

sudo usermod -L dexter

Question 28

Locked Accounts

What does a “locked” account mean?

Answer 28

A Locked account can run programs, but can never login to the system and have no valid password associated with them.

For example, /etc/passwd has entries like:

• *bin:x:1:1:bin:/bin:/sbin/nologin
  daemon: x:2:2:daemon:/sbin:/sbin/nologin**

The nologin shell returns the following if a locked user tries to login to the system:

This account is currently not available.

or whatever message may be stored in /etc/nologin.txt.

Question 29

Locked Accounts

What are some of the locked user accounts that Linux ships with?

Answer 29

• bin
• daemon or sys

Question 30

Locked Accounts

What are the commands to lock and unlock an account?

Answer 30

• $ sudo usermod -L dexter
• $ sudo usermod -U dexter

Question 31

Locked Accounts

What is another way to lock an account other than using the usermod -L command?

Answer 31

$ sudo chage -E 2014-09-11 morgan

Another way to lock an account is to use chage to change the expiration date of an account to a date in the past

Question 32

User IDs and /etc/passwd

Describe the record information for this user in the /etc/passwd file:

beav:x:1000:1000:Theodore Cleaver:/home/beav:/bin/bash

Answer 32

• username - the user’s unique name
• password - either the hashed password (if /etc/shadow is not used) or a placeholder (“x” when /etc/shadow is used)
• UID - user identification number
• GID - primary group identification number for the user
• comment - comment area, usually the user’s real name
• home - directory pathname for the user’s home directory
• shell - absolutely qualified name of the shell to invoke at login.

Question 33

User IDs and /etc/passwd

The convention most Linux distributions have used is that any account with a user ID less than ___ is considered special and belongs to the system; normal user accounts start at ___. The actual value is defined as ___ and is defined in ___.

Answer 33

• 1000
• 1000
• UID_MIN
• /etc/login.defs

Historically, Red Hat-derived distributions used UID_MIN=500, not 1000, but beginning with RHEL 7 the more common value of 1000 was adopted.

Question 34

User IDs and /etc/passwd

If a User ID is not specified when using useradd, the system will incrementally assign UIDs starting at the ___ environment variable.

Answer 34

• UID_MIN

Question 35

User IDs and /etc/passwd

It is bad practice to edit /etc/passwd, /etc/group or /etc/shadow directly; use appropriate utilities such as ___.

Answer 35

• usermod

Question 36

Why Use /etc/shadow?

Why use /etc/shadow for storing user passwords vs storing it in the /etc/passwd?

Answer 36

Use of /etc/shadow enables password aging on a per user basis. At the same time, it also allows for maintaining greater security of hashed passwords.

Question 37

Why Use /etc/shadow?

Why is using /etc/passwd bad for storing user hashed passwords vs storing it in /etc/shadow?

Answer 37

The default permissions of /etc/passwd are 644 (-rw-r–r–); anyone can read the file. This is unfortunately necessary because system programs and user applications need to read the information contained in the file. These system programs do not run as the user root and, in any event, only root may change the file.

Of particular concern are the hashed passwords themselves. If they appear in /etc/passwd, anyone may make a copy of the hashed passwords and then make use of utilities such as Crack and John the Ripper to guess the original cleartext passwords given the hashed password. This is a security risk!

/etc/shadow has permission settings of 400 (-r——–), which means that only root can access this file. This makes it more difficult for someone to collect the hashed passwords.

Unless there is a compelling good reason not to, you should use the /etc/shadow file.

Question 38

Password Management

Explain the pieces of this user’s password record in the /ect/shadow file.

daemon:*:16141:0:99999:7:::
…..
beav:$6$iCZyCnBJH9rmq7P.$RYNm10Jg3wrhAtUnahBZ/mTMg.RzQE6iBXyqaXHvxxbKTYqj.d 9wpoQFuRp7fPEE3hMK3W2gcIYhiXa9MIA9w1:16316:0:99999:7:::

Answer 38

The colon-separated fields are:

1. username: unique user name
2. password: the hashed (sha512) value of the password
3. lastchange: days since Jan 1,1970 that password was last changed
4. mindays: minimum days before password can be changed
5. maxdays: maximum days after which password must be changed
6. warn: days before password expires that the user is warned
7. grace: days after password expires that account is disabled
8. expire: date that account is/will be disabled
9. reserved: reserved field.

The username in each record must match exactly that found in /etc/passwd, and also must appear in the identical order.

All dates are stored as the number of days since Jan. 1, 1970 (the epoch date).

The password hash is the string “$6$” followed by an eight character salt value, which is then followed by a $ and an 88 character (sha512) password hash.

Question 39

Password Management

What command is used to change a user’s password?

Answer 39

passwd

By default, the password choice is examined by pam_cracklib.so, which furthers making good password choices.

Question 40

Password Management

What’s the difference between powers that a regular user has vs the root user has when changing password?

Answer 40

A regular user can only change their password. While the root user can change anyones passwords.

Question 41

Password Management

When using passwd to change a user’s password what program under the hood by default is used to check if the password meets security requirements?

Answer 41

pam_cracklib.so

Question 42

Normal users will not be allowed to set bad passwords, such as ones that are too short, or based on dictionary words. However, ___ is allowed to do so.

Answer 42

root user

Question 43

Password Aging

What utility is used to manage password aging?

Answer 43

chage

chage [-m mindays] [-M maxdays] [-d lastday] [-I inactive] [-E expiredate] [-W warndays] user

Examples:

$ sudo chage -l dexter
$ sudo chage -m 14 -M 30 kevlin
$ sudo chage -E 2012-4-1 morgan
$ sudo chage -d 0 clyde

Only the root user can use chage. The one exception to this is that any user can run chage -l to see their aging, as in the screenshot on this page.

To force a user to change their password at their next login, do:

$ sudo chage -d 0 USERNAME

Question 44

Restricted Shell

What utility is used to use a restricted shell?

Answer 44

$ bash -r

• A restricted shell functions in a more tightly controlled environment than a standard shell, but otherwise functions normally. In particular, it:
• Prevents the user from using cd to change directories.
• Prevents the user from redefining the following environment variables: SHELL, ENV, and PATH.
• Does not permit the user to specify the absolute path or executable command names starting from /.
• Prevents the user from redirecting input and/or output.

There are other restrictions; the best way to see them all is to do man bash and search for RESTRICTED SHELL.

Restricted accounts can also be enabled by creating a symlink to /bin/bash, named /bin/rbash, and using in /etc/passwd, as we will discuss next.

rbash is not secure! It is actually very easy to avoid the restrictions and modern techniques such as the use of SELinux are much more robust. We discuss only if you encounter the methods described here.

Restricted Accounts:

There are times when granting access to a user is necessary, but should be limited in scope. Setting up a restricted user account can be useful in this context. A restricted account:

• Uses the restricted shell
• Limits available system programs and user applications
• Limits system resources
• Limits access times
• Limits access locations.

From the command line, or from a script, a restricted shell may be invoked with /bin/bash -r. However, flags may not be specified in the /etc/passwd file. A simple way to get around this restriction would be to do one of the following:

$ cd /bin ; sudo ln -s bash rbash
$ cd /bin ; sudo ln bash rbash
$ cd /bin ; sudo cp bash rbash

and then, use /bin/rbash as the shell in /etc/passwd.

When setting up such an account, one should avoid inadvertently adding system directories to the PATH environment variable; this would grant the restricted user the ability to execute other system programs, such as an unrestricted shell.

Restricted accounts are also sometimes referred to as limited accounts.

Question 45

The Root Account

The ___ account should only be used for administrative purposes when absolutely necessary and never used as a regular account. Mistakes can be very costly, both for integrity and stability, and system security.

Answer 45

root

Question 46

The Root Account

By default, ___ logins through the network are generally prohibited for security reasons. You can permit Secure Shell logins using ssh, which is configured with the file ___, and PAM (Pluggable Authentication Modules), which we will discuss later, through the pam_securetty.so module and the associated ___ file. Root login is permitted only from the devices listed in ___.

Answer 46

• root
• /etc/ssh/sshd_config
• /etc/securetty
• /etc/securetty

Question 47

The Root Account

It is generally recommended that all ___ access be through su, or sudo (causing an audit trail of all root access through sudo). Note that some distributions (such as Ubuntu), by default actually prohibit logging in directly to the ___ account.

Answer 47

• root
• root

Question 48

The Root Account

___ can also be used to restrict which users are allowed to su to root. It might also be worth it to configure ___ to log all commands executed as root.

Answer 48

• PAM
• auditd

Question 49

SSH

What command do you use to login to a remote system?

Answer 49

ssh

Question 50

SSH

How do you copy files and folders from one system to another via ssh?

Answer 50

To copy files from one system to another:

$ scp file.txt farflung.com:/tmp
$ scp file.tex student@farflung.com/home/student
$ scp -r some_dir farflung.com:/tmp/some_dir

Question 51

SSH

What is the bash script to run ssh on multiple system?

Answer 51

To run a command on multiple machines simultaneously:

$for machines in node1 node2 node3
do
(ssh $machines some_command &)
done

Question 52

SSH Configuration Files

Where is the ssh configuration file location?

Answer 52

Every user had a .ssh config directory with config files in thier home directory.

You can configure SSH further to expedite its use, in particular to permit logging in without a password. User-specific configuration files are created under every user’s home directory in the hidden .ssh directory:

Question 53

SSH

What config files are location in the .ssh folder? And what are they for?

Answer 53

id_rsa: the user’s private encryption key

id_rsa.pub: the user’s public encryption key

authorized_keys: A list of public keys that are permitted to login

known_hosts: A list of hosts from which logins have been allowed in the past

config: A configuration file for specifying various options.

Question 54

SSH

What are the steps to setup ssh connection to a server?

Answer 54

1. First, a user has to generate their private and public encryption keys with ssh-keygen:
   
   1. $ ssh-keygen
      
      1. ​.ssh/id_rsa (private key generated)
      2. .ssh/id_rsa.pub (public key generated)

​​​The public key can be given to any machine with which you want to permit password-less access. It should also be added to your authorized_keys file, together with all the public keys from other users who have accounts on your machine and you want to permit password-less access to their accounts.

The .ssh/known_hosts file is gradually built up as ssh accesses occur. If the system detects changes in the users who are trying to log in through ssh, it will warn you of them and afford the opportunity to deny access.

Note that the authorized_keys file contains information about users and machines:

$ cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQ
…0000aSd…hilda@sbc

while the known_hosts only contains information about computer nodes:

$ cat known_hosts
192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSw
….BK6Tb…==

Question 55

SSH

What is the .ssh/known_hosts config file contain?

Answer 55

The known_hosts file is gradually built up as ssh accesses occur. If the system detects changes in the users who are trying to log in through ssh, it will warn you of them and afford the opportunity to deny access. Note that the authorized_keys file contains information about users and machines:

$ cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQ
…0000aSd…hilda@sbc

while the known_hosts only contains information about computer nodes:

$ cat known_hosts
192.30.252.129 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSw
….BK6Tb…==

You can examine the man ssh_config page to see what kinds of options can go into the ssh configuration files.

Question 56

SSH

What command give you information about what options can go into the ssh configuation files?

Answer 56

man ssh_config

Question 57

Remote Graphical Login

What is a common program you can use to graphically connect to a remote machine?

Answer 57

tigervnc

Question 58

Remote Graphical Login

What does VNC stand for?

Answer 58

Virtual Network Computing

Question 59

Remote Graphical Login

Which vnc packages do you need installed for vnc to work?

How can you check if these packages are installed?

How can you install these packages if you don’t have them?

Answer 59

• vncserver
• vncviewer

which vncserver vncviewer

*/usr/bin/vncserver
/usr/bin/vncviewer*

$ sudo [dnf|yum|zypper|apt-get] install tigervnc*

Question 60

Remote Graphical Login

How do you use tigervnc?

Answer 60

1. Start the with
   
   1. $ vncserver
2. Test the vnc server locally
   
   1. $ vncviewer localhost:2
   2. You may have to play with numbers other than 2, such as 1, 3, 4…, depending on what you are running at the moment, and how your machine is configured.
3. View the vnc server remotely
   
   1. vncviewer -via username@host_machine localhost:2

If you get a rather strange message about having to authenticate because of ‘color profile’, and no passwords work, you have to kill the colord daemon on the server machine, as in:

$ sudo systemctl stop colord

This is a bug (not a feature), and it will only appear in some distributions and some systems for unclear reasons.​