RHCSA - Part8 - User/group management and basic permissions
It is easy to create a user with useradd, but if you have to create multiple user accounts, it is much more convenient to do it with a bash script that will loop the command for you.
USERADD
Usage: useradd [options] <user_name>
Important options:
-D : defaults (can be altered with additional options)
-m : create home directory if it doesn’t exist
-s : shell (/bin/bash, /sbin/nologin, etc. …)
-e : expire date with format YYYY-MM-DD
-f : inactive after creation
-g : manual gid number
-u : manual uid number
-G : groups (coma separated)
-r : system account, doesn’t create home, mail, usergroup…
More on man useradd
CHAGE
Usage: chage [options] <user_name>
The -l option will display password aging information:
# chage -l alice
# chage -l ben
The -E option will set a password expiration date for the user:
# chage -E 2017-12-31 alice
# chage -E 2017-12-31 ben
GROUPADD
Usage: groupadd [options] <group_name>
Just create the group dba:
# groupadd dba
USERMOD
Usage: usermod [options] <user_name>
The -aG option appends group (add a supplementary group to the user).
# usermod -aG dba alice
# usermod -aG dba ben
CHOWN
Use chown to change user and/or group ownership:
# chown alice /srv/groupdir
or
# chown alice:dba /srv/groupdir
or
# chown alice: /srv/groupdir
or
# chown :dba /srv/groupdir
CHGRP
Use chgrp to change the group on a file or folder:
# chgrp /srv/groupdir dba
CHMOD
Use chmod to change permissions to rwx (read, write, execute) on /srv/groupdir for owner and group members only:
# chmod -R 770 /srv/groupdir
or
# chmod -R ug=rwx,o-rwx /srv/groupdir
Group collaboration:
SetGID: All files created belong to the group. All the members of the group can create files, edit or remove any files from the group.
# chmod 2770 /srv/groupdir
or
# chmod g+s /srv/groupdir
SetUID is not recommended. Users allowed to execute a program use the identity (and permissions) of the owner.
# chmod 4770 /srv/groupdir/script.sh
or
# chmod u+s /srv/groupdir/script.sh
StickyBit:
# chmod 1770 /srv/groupdir/myfile
or
# chmod +t /srv/groupdir/myfile
StickyBit with SetGID:
StickyBit sets additional permissions on a file. It comes very convenient in case of group collaboration because only the owner can delete its files:
# chmod 3770 /srv/groupdir/myfile
CHATTR
Change attributes on a file, set the file to immutable (even by root):
# chattr +i file
or, to remove
# chattr -i file
GPASSWD
Usage: gpasswd [option] <user_name> <group_name>
Remove user alice from the dba group:
# gpasswd -d alice dba
USERDEL
Delete a user:
# userdel alice
Delete a user with its home directory and mailbox:
# userdel -r ben
GROUPDEL
Delete a group:
# groupdel dba
EXAMPLE
Create several users in 1 command:
# for i in user{1,2,3,4,5}; do useradd $i; done
Check created accounts in /etc/passwd:
# tail -5 /etc/passwd
or
# for i in user{1,2,3,4,5}; do id $i; done
Set password for all newly created users by redirecting “password” in the standard input:
# for i in user{1,2,3,4,5}; do echo "password" | passwd $i --stdin; done
Warning: this is not the safest way to do it!
There are several discussions related to this topic, for example in https://stackoverflow.com/questions/714915/using-the-passwd-command-from-within-a-shell-script
Also, it may not be ideal to keep this command in the bash history. If you want to run the command without keeping it in history, just add a space at the beginning of the line (works for bash shell, not for zsh).