2.1 Shadow Passwords - /etc/shadow Index

• When a system has shadow passwords enabled (the default), the password field in /etc/passwd is replaced by an “x” and the user’s real encrypted password is stored in /etc/shadow.
• /etc/shadow is only readable by the root user, so even the encrypted password is hidden and can’t be used in a password-cracking program
• Each line in /etc/shadow contains the user’s login userid, their encrypted password, and fields relating to password expiration.
• Special passwords (see “man shadow”):
  • a leading ! means the password (and thus account) is locked
  • * indicates the account has been disabled

2.2 useradd Index

• Used to create a new login account.
• Also creates a group with the same name.
• Usually the defaults are correct, but options let you change any of the information to be stored in the passwd and group files.
• Sometimes called “adduser”, but sometimes “adduser” is a different program (e.g. Ubuntu).

2.3 userdel Index

• Remove an account from the password and group files.
• To actually remove the home directory, you must use the “-r” option!
  • if you forget -r, you will leave a home directory with no owner!
• Will not remove an account that has active processes running (e.g. a shell)

2.4 usermod Index

• Change any of the information about a user account.
• Changing the home directory with “-d” changes only the field in /etc/passwd; it does not actually move the directory unless you also give “-m”.
• Can lock/unlock an account by inserting “!” in front of the password field.
• Will not modify an account that has active processes running (e.g. a shell)

2.5 chsh Index

• “CHange SHell”
• Changes the login shell in /etc/passwd - does not affect current shell
• Only root can change shells of other accounts
• If a shell isn’t specified on the command line, it will prompt for one
• Usually only allows setting a shell from a small system-defined list

2.6 passwd Index

• Changes the login password in /etc/passwd (and /etc/shadow)
• Only root can change passwords of other accounts

2.7 su Index

• Set userid or substitute user
• See below

2.8 sudo Index

• Execute a single command with other (usually root) privileges
• See below

3.1 Group Shadow Passwords - /etc/gshadow Index

• When a system has shadow passwords enabled (the default), the password field in /etc/group is replaced by an “x” and the user’s real encrypted password is stored in /etc/gshadow.
• /etc/gshadow is only readable by the root user, so even the encrypted password is hidden and can’t be used in a password-cracking program
• Each line in /etc/gshadow contains the group name, the group encrypted password, an optional list of Group Administrators, and an optional list of Group Members (which should be the same in /etc/group)
• Special passwords (see “man gshadow”):
  • a leading ! means the group password is locked
  • * indicates the group cannot be logged into by non-members

3.2 Group Commands - groupadd, groupdel, groupmod, gpasswd, group, id, newgrp Index

• groupadd - create a new group in /etc/group
• groupdel - remove a group from /etc/group
• groupmod - modify the name or GID of a group in /etc/group
• gpasswd - administer the /etc/group and /etc/gshadow files
  • can be used by the Group Administrator as well as root
  • add and delete group members, or set the member list
  • root can set the list of Group Administrators for a group
• group - list all the groups a user belongs to
• id - more detailed version of “groups” showing numeric values
• newgrp - (rarely used) use the group password to start a new shell with additional group privileges

4.1 su - substitute user or set userid Index

• Example: su --login
• Opens up a subshell as the new user, with that user’s privileges
• Exiting the subshell goes back to the previous user
• Ordinary (non-root) users need to enter the password for the other account
• A dash - or --login option (options must be surrounded by spaces) means use a full login shell that clears the environment, sets groups and goes to the user’s home directory as if the user had just logged in.
• Without the full login, the command will set privileges but will leave most of the existing environment unchanged, including an unchanged current directory (that may not grant the new user any permissions!).
• If you don’t give a userid, it assumes you want to become the root user

[idallen@localhost]$ whoami
idallen
[idallen@localhost]$ su
password: XXX
[root@localhost]# whoami
root
[root@localhost]# exit 
[idallen@localhost]$
[idallen@localhost]$ whoami
idallen

4.2 sudo - do as if su Index

• Example: sudo passwd idallen
• Execute a single command with other (usually root) privileges
• Safer way to do root tasks (avoids running a whole shell as root)
• The root account can update /etc/sudoers with the list of who can do what
• XKCD comic about sudo

[idallen@localhost]$ whoami
idallen
[idallen@localhost]$ sudo passwd alleni
[sudo] password for idallen: XXXXXXXXXX
Changing password for user alleni.
New password: XXX
Retype new password: XXX
passwd: all authentication tokens updated successfully.
[idallen@localhost]$ whoami
idallen
[idallen@localhost]$ 

4.3 newgrp - log in to a new group Index

• Opens up a subshell as the new group, with that group’s privileges
• Exiting the subshell goes back to the previous group
• rarely used - needs a group password set