Administrando Usuarios y Grupos

El control de usuarios y grupos es un elemento central de la administración del sistema Fedora. Este capítulo explica como añadir, administrar y borrar usuarios y grupos con la interfaz gráfica de usuario y desde la línea de comandos y cubre temas avanzados como la creación de directorios de grupo.

Introducción a los Usuarios y Grupos

Mientras que los usuarios pueden ser bien personas (lo que significa cuentas asignadas a usuarios físicos) o bien cuentas que existen para que las usen aplicaciones específicas, los grupos son expresiones lógicas de organización asignando usuarios juntos para un propósito común. Los usuarios dentro de un grupo comparten los mismos permisos para leer, escribir o ejecutar ficheros que los que tenga el grupo.

Cada usuario se asocia con una única identificación numérica llamada ID de usuario (UID). Igualmente, cada grupo se asocia con una ID de grupo (GID). Un usuario que crear un fichero es también el propietario y el grupo propietario de ese fichero. Al fichero se le asignan permisos separados de lectura, escritura y ejecución para el usuario, el grupo y para cualquier otro. El propietario del fichero sólo puede ser cambiado por root y los permisos de acceso pueden ser cambiados tanto por el usuario root como por el propietario del fichero.

Adicionalmente, Fedora soporta listas de control de acceso (ACLs) para ficheros y directorios que permiten permisos para usuarios específicos fuera del propietario. Para más información sobre esta función, vea el capítulo Listas de Control de Acceso de la Guía de Administradores de Sistema Red Hat Enterprise Linux 7.

Grupos Privados de Usuarios

Fedora utiliza un esquema de grupo privado de usuario (UPG), que hace más fáciles de administrar los grupos UNIX. Un grupo privado de usuario se crea siempre que se añade un nuevo usuario al sistema. Tiene el mismo nombre que el usuario creado y este usuario es el único miembro del grupo privado de usuario.

Los grupos privados de usuario hacen que sea seguro establecer permisos predeterminados para un archivo o directorio recién creado, permitiendo tanto al usuario como al grupo de ese usuario hacer modificaciones al archivo o directorio.

El ajuste que determina que permisos se aplican a los archivos o directorios de nueva creación se llama umask y está configurado en el archivo /etc/bashrc. Tradicionalmente en los sistemas basados en UNIX, umask se fija a 022, que permite que solo el usuario que ha creado el archivo o directorio haga modificaciones. Bajo este esquema, todos los demás usuarios, incluyendo los miembros del grupo del creador, no tienen permitido hacer ninguna modificación. Sin embargo, bajo el esquema UPG, esta "protección de grupo" no es necesaria puesto que cada usuario tiene su propio grupo privado.

Una lista de todos los grupo se almacena en el archivo de configuración /etc/group.

Shadow Passwords

In environments with multiple users, it is very important to use shadow passwords provided by the shadow-utils package to enhance the security of system authentication files. For this reason, the installation program enables shadow passwords by default.

The following is a list of the advantages shadow passwords have over the traditional way of storing passwords on UNIX-based systems:

  • Shadow passwords improve system security by moving encrypted password hashes from the world-readable /etc/passwd file to /etc/shadow, which is readable only by the root user.

  • Shadow passwords store information about password aging.

  • Shadow passwords allow the /etc/login.defs file to enforce security policies.

Most utilities provided by the shadow-utils package work properly whether or not shadow passwords are enabled. However, since password aging information is stored exclusively in the /etc/shadow file, some utilities and commands do not work without first enabling shadow passwords:

  • The chage utility for setting password-aging parameters. For details, see the Password Security section in the Red Hat Enterprise Linux 7 Security Guide.

  • The gpasswd utility for administrating the /etc/group file.

  • The usermod command with the -e, --expiredate or -f, --inactive option.

  • The useradd command with the -e, --expiredate or -f, --inactive option.

Managing Users in a Graphical Environment

The Users utility allows you to view, modify, add, and delete local users in the graphical user interface.

Using the Users Settings Tool

Press the Super key to enter the Activities Overview, type Users and then press Enter. The Users settings tool appears. The Super key appears in a variety of guises, depending on the keyboard and other hardware, but often as either the Windows or Command key, and typically to the left of the Spacebar.

To make changes to the user accounts, first select the Unlock button and authenticate yourself as indicated by the dialog box that appears. Note that unless you have superuser privileges, the application will prompt you to authenticate as root. To add and remove users, select the + and - button respectively. To add a user to the administrative group wheel, change the Account Type from Standard to Administrator. To edit a user’s language setting, select the language and a drop-down menu appears.

The Users settings tool
Figure 1. The Users Settings Tool

When a new user is created, the account is disabled until a password is set. The Add User menu contains the options to set a password by the administrator immediately, or to allow the user to choose a password at the first login.

Using Command Line Tools

Apart from the Users settings tool described in Managing Users in a Graphical Environment, which is designed for basic managing of users, you can use command line tools for managing users and groups that are listed in Command line utilities for managing users and groups.

Table 1. Command line utilities for managing users and groups
Utilities Description

id

Displays user and group IDs.

useradd, usermod, userdel

Standard utilities for adding, modifying, and deleting user accounts.

groupadd, groupmod, groupdel

Standard utilities for adding, modifying, and deleting groups.

gpasswd

Standard utility for administering the /etc/group configuration file.

pwck, grpck

Utilities that can be used for verification of the password, group, and associated shadow files.

pwconv, pwunconv

Utilities that can be used for the conversion of passwords to shadow passwords, or back from shadow passwords to standard passwords.

grpconv, grpunconv

Similar to the previous, these utilities can be used for conversion of shadowed information for group accounts.

Adding a New User

To add a new user to the system, type the following at a shell prompt as root:

useradd options username

…where options are command-line options as described in Common useradd command-line options. By default, the useradd command creates a locked user account. To unlock the account, run the following command as root to assign a password:

passwd username

Optionally, you can set a password aging policy. See Enabling Password Aging for information on how to enable password aging.

Table 2. Common useradd command-line options
Option Description

-c 'comment'

comment can be replaced with any string. This option is generally used to specify the full name of a user.

-d home_directory

Home directory to be used instead of default /home/username/.

-e date

Date for the account to be disabled in the format YYYY-MM-DD.

-f days

Number of days after the password expires until the account is disabled. If 0 is specified, the account is disabled immediately after the password expires. If -1 is specified, the account is not disabled after the password expires.

-g group_name

Group name or group number for the user’s default (primary) group. The group must exist prior to being specified here.

-G group_list

List of additional (supplementary, other than default) group names or group numbers, separated by commas, of which the user is a member. The groups must exist prior to being specified here.

-m

Create the home directory if it does not exist.

-M

Do not create the home directory.

-N

Do not create a user private group for the user.

-p password

The password encrypted with crypt.

-r

Create a system account with a UID less than 1000 and without a home directory.

-s

User’s login shell, which defaults to /bin/bash.

-u uid

User ID for the user, which must be unique and greater than 999.

The command-line options associated with the usermod command are essentially the same. Note that if you want to add a user to another supplementary group, you need to use the -a, --append option with the -G option. Otherwise the list of supplementary groups for the user will be overwritten by those specified with the usermod -G command.

Explaining the Process

The following steps illustrate what happens if the command useradd juan is issued on a system that has shadow passwords enabled:

  1. A new line for juan is created in /etc/passwd:

    juan:x:1001:1001::/home/juan:/bin/bash

    The line has the following characteristics:

    • It begins with the user name juan.

    • There is an x for the password field indicating that the system is using shadow passwords.

    • A UID greater than 999 is created. Under Fedora, UIDs below 1000 are reserved for system use and should not be assigned to users.

    • A GID greater than 999 is created. Under Fedora, GIDs below 1000 are reserved for system use and should not be assigned to users.

    • The optional GECOS information is left blank. The GECOS field can be used to provide additional information about the user, such as their full name or phone number.

    • The home directory for juan is set to /home/juan/.

    • The default shell is set to /bin/bash.

  2. A new line for juan is created in /etc/shadow:

    juan:!!:14798:0:99999:7:::

    The line has the following characteristics:

    • It begins with the username juan.

    • Two exclamation marks (!!) appear in the password field of the /etc/shadow file, which locks the account.

      Aviso

      If an encrypted password is passed using the -p flag, it is placed in the /etc/shadow file on the new line for the user.

    • The password is set to never expire.

  3. A new line for a group named juan is created in /etc/group:

    juan:x:1001:

    A group with the same name as a user is called a user private group. For more information on user private groups, see User Private Groups.

    The line created in /etc/group has the following characteristics:

    • It begins with the group name juan.

    • An x appears in the password field indicating that the system is using shadow group passwords.

    • The GID matches the one listed for juan's primary group in /etc/passwd.

  4. A new line for a group named juan is created in /etc/gshadow:

    juan:!::

    The line has the following characteristics:

    • It begins with the group name juan.

    • An exclamation mark (!) appears in the password field of the /etc/gshadow file, which locks the group.

    • All other fields are blank.

  5. A directory for user juan is created in the /home/ directory:

    ~]# ls -ld /home/juan
    drwx------. 4 juan juan 4096 Mar  3 18:23 /home/juan

    This directory is owned by user juan and group juan. It has read, write, and execute privileges only for the user juan. All other permissions are denied.

  6. The files within the /etc/skel/ directory (which contain default user settings) are copied into the new /home/juan/ directory. The contents of /etc/skel/ may vary depending on installed applications:

    ~]# ls -la /home/juan
    total 24
    drwx------. 4 juan juan 4096 Mar  3 18:23 .
    drwxr-xr-x. 5 root root 4096 Mar  3 18:23 ..
    -rw-r--r--. 1 juan juan   18 Jul 09 08:43 .bash_logout
    -rw-r--r--. 1 juan juan  176 Jul 09 08:43 .bash_profile
    -rw-r--r--. 1 juan juan  124 Jul 09 08:43 .bashrc
    drwxr-xr-x. 4 juan juan 4096 Jul 09 08:43 .mozilla

At this point, a locked account called juan exists on the system. To activate it, the administrator must next assign a password to the account using the passwd command and, optionally, set password aging guidelines.

Adding a New Group

To add a new group to the system, type the following at a shell prompt as root:

groupadd options group_name

…where options are command-line options as described in Common groupadd command-line options.

Table 3. Common groupadd command-line options
Option Description

-f, --force

When used with -g gid and gid already exists, groupadd will choose another unique gid for the group.

-g gid

Group ID for the group, which must be unique and greater than 999.

-K, --key key=value

Override /etc/login.defs defaults.

-o, --non-unique

Allows creating groups with duplicate GID.

-p, --password password

Use this encrypted password for the new group.

-r

Create a system group with a GID less than 1000.

Enabling Password Aging

For security reasons, it is advisable to require users to change their passwords periodically. This can be done by using the chage command.

Shadow passwords must be enabled to use chage

Shadow passwords must be enabled to use the chage command. For more information, see Shadow Passwords.

To configure password expiration for a user from a shell prompt, run the following command as root:

chage options username

…where options are command line options as described in chage command line options. When the chage command is followed directly by a username (that is, when no command line options are specified), it displays the specified users current password aging values and allows you to change these values interactively.

Table 4. chage command line options
Option Description

-d days

Specifies the number of days since January 1, 1970 the password was changed.

-E date

Specifies the date on which the account is locked, in the format YYYY-MM-DD. Instead of the date, the number of days since January 1, 1970 can also be used.

-I days

Specifies the number of inactive days after the password expiration before locking the account. If the value is 0, the account is not locked after the password expires.

-l

Lists current account aging settings.

-m days

Specify the minimum number of days after which the user must change passwords. If the value is 0, the password does not expire.

-M days

Specify the maximum number of days for which the password is valid. When the number of days specified by this option plus the number of days specified with the -d option is less than the current day, the user must change passwords before using the account.

-W days

Specifies the number of days before the password expiration date to warn the user.

You can configure a password to expire the first time a user logs in. This forces users to change passwords immediately.

  1. Set up an initial password. There are two common approaches to this step: you can either assign a default password, or you can use a null password.

    To assign a default password, type the following at a shell prompt as root:

    passwd username

    To assign a null password instead, use the following command:

    passwd -d username
    Avoid using null passwords whenever possible

    Using a null password, while convenient, is a highly insecure practice, as any third party can log in first and access the system using the insecure username. Always make sure that the user is ready to log in before unlocking an account with a null password.

  2. Force immediate password expiration by running the following command as root:

    chage -d 0 username

    This command sets the value for the date the password was last changed to the epoch (January 1, 1970). This value forces immediate password expiration no matter what password aging policy, if any, is in place.

Upon the initial log in, the user is now prompted for a new password.

Enabling Automatic Logouts

Especially when the user is logged in as root, an unattended login session may pose a significant security risk. To reduce this risk, you can configure the system to automatically log out idle users after a fixed period of time:

  1. Make sure the screen package is installed. You can do so by running the following command as root:

    dnf install screen

    For more information on how to install packages in Fedora, refer to Installing Packages.

  2. As root, add the following line at the beginning of the /etc/profile file to make sure the processing of this file cannot be interrupted:

    trap "" 1 2 3 15
  3. Add the following lines at the end of the /etc/profile file to start a screen session each time a user logs in to a virtual console or remotely:

    SCREENEXEC="screen"
    if [ -w $(tty) ]; then
      trap "exec $SCREENEXEC" 1 2 3 15
      echo -n 'Starting session in 10 seconds'
      sleep 10
      exec $SCREENEXEC
    fi

    Note that each time a new session starts, a message will be displayed and the user will have to wait ten seconds. To adjust the time to wait before starting a session, change the value after the sleep command.

  4. Add the following lines to the /etc/screenrc configuration file to close the screen session after a given period of inactivity:

    idle 120 quit
    autodetach off

    This will set the time limit to 120 seconds. To adjust this limit, change the value after the idle directive.

    Alternatively, you can configure the system to only lock the session by using the following lines instead:

    idle 120 lockscreen
    autodetach off

    This way, a password will be required to unlock the session.

The changes take effect the next time a user logs in to the system.

Crear directorios de grupo

System administrators usually like to create a group for each major project and assign people to the group when they need to access that project’s files. With this traditional scheme, file management is difficult; when someone creates a file, it is associated with the primary group to which they belong. When a single person works on multiple projects, it becomes difficult to associate the right files with the right group. However, with the UPG scheme, groups are automatically assigned to files created within a directory with the setgid bit set. The setgid bit makes managing group projects that share a common directory very simple because any files a user creates within the directory are owned by the group that owns the directory.

For example, a group of people need to work on files in the /opt/myproject/ directory. Some people are trusted to modify the contents of this directory, but not everyone.

  1. As root, create the /opt/myproject/ directory by typing the following at a shell prompt:

    mkdir /opt/myproject
  2. Add the myproject group to the system:

    groupadd myproject
  3. Associate the contents of the /opt/myproject/ directory with the myproject group:

    chown root:myproject /opt/myproject
  4. Allow users in the group to create files within the directory and set the setgid bit:

    chmod 2775 /opt/myproject

    At this point, all members of the myproject group can create and edit files in the /opt/myproject/ directory without the administrator having to change file permissions every time users write new files. To verify that the permissions have been set correctly, run the following command:

    ~]# ls -ld /opt/myproject
    drwxrwsr-x. 3 root myproject 4096 Mar  3 18:31 /opt/myproject
  5. Añada usuarios al grupo miproyecto:

    usermod -aG myproject username

Recursos Adicionales

For more information on how to manage users and groups on Fedora, see the resources listed below.

Installed Documentation

For information about various utilities for managing users and groups, see the following manual pages:

  • useradd(8) — The manual page for the useradd command documents how to use it to create new users.

  • userdel(8) — The manual page for the userdel command documents how to use it to delete users.

  • usermod(8) — The manual page for the usermod command documents how to use it to modify users.

  • groupadd(8) — The manual page for the groupadd command documents how to use it to create new groups.

  • groupdel(8) — The manual page for the groupdel command documents how to use it to delete groups.

  • groupmod(8) — The manual page for the groupmod command documents how to use it to modify group membership.

  • gpasswd(1) — The manual page for the gpasswd command documents how to manage the /etc/group file.

  • grpck(8) — The manual page for the grpck command documents how to use it to verify the integrity of the /etc/group file.

  • pwck(8) — The manual page for the pwck command documents how to use it to verify the integrity of the /etc/passwd and /etc/shadow files.

  • pwconv(8) — The manual page for the pwconv, pwunconv, grpconv, and grpunconv commands documents how to convert shadowed information for passwords and groups.

  • id(1) — The manual page for the id command documents how to display user and group IDs.

For information about related configuration files, see:

  • group(5) — The manual page for the /etc/group file documents how to use this file to define system groups.

  • passwd(5) — The manual page for the /etc/passwd file documents how to use this file to define user information.

  • shadow(5) — The manual page for the /etc/shadow file documents how to use this file to set passwords and account expiration information for the system.