Linux Learning - User & Group Management

1. 'system-config-users' - create additional users and evaluate
Note: If user's $SHELL is set to: '/sbin/nologin' the user will not be able to obtain a shell, nor will 'root' be able to 'su' as that user: i.e. 'adm', 'daemon', 'bin', etc.
Note: System accounts typically are present in the process listing sans TTY because they do not need a $SHELL
Note: Regular users who are defined with: '/sbin/nologin' as their $SHELL may not access the system via a $SHELL. i.e. via 'SSH' or 'Telnet', however, they may access the system via an appropriate daemon. i.e. 'FTPD'


Note: Defaults are assigned to new accounts, including, but not limited to:
 1. $SHELL = /bin/bash
 2. $HOME = /home/$USER


 2. $SHELL Tools
  a. 'groupadd linuxcbt4'
  b. 'useradd -d /home/linuxcbt4 -s /bin/bash -g linuxcbt4 linuxcbt4'
  c. 'passwd linuxcbt4'


Note: Account information, by default, is stored in:
 a. '/etc/passwd' - general account data: username, uid, gid, $HOME, $SHELL, reference to shadow
 b. '/etc/shadow' - password and policy data


Sample '/etc/shadow' entry:
linuxcbt:$CqvB.$o4lwrI5pS2Ovh6IgyA9w3FDwGi9wJjEXYcbot6o5NsjahpEQK5GzHz8ccj7pX3rnPq2ozE7fwQEchJmEZB8T8/:14981:0:99999:7:::
  d. '/etc/shadow':
   d1. login name
   d2. encrypted password
   d3. Days since Unix epoch, password was last changed
   d4. Days before password may be changed
   d5. Days after which password must be changed
   d6. Days before password is to expire that user is warned
   d7. Days after password expires that account is disabled
   d8. Days since Unix epoch, that account is disabled
   d9. Reserved


Note: 'usermod' - basic: /etc/passwd changes
Note: 'chage' - /etc/shadow policy changes


 3. Use 'chage' to alter account policy for users
  a. 'chage -M 10 linuxcbt4 && chage -l linuxcbt4'
  b. 'chage -M 3 -m 1 linuxcbt3 && chage -l linuxcbt3'


 4. Explore: '/etc/login.defs'
  a. Contains account policy settings
  b. Modify defaults to company policy


 5. Test policy changes by creating new account
  a. 'groupadd linuxcbt5 && useradd -g linuxcbt5 -d /home/linuxcbt5 -s /bin/bash linuxcbt5 && chage -l linuxcbt5'


 6. 'userdel'
  a. 'userdel -r linuxcbt5' - removes user, group, $HOME, $MAIL traces