Hello, everyone, and welcome to a new lessoned user account management.
In this lesson, we will learn how can we manage user account and Linux?
There are a few commands that we use to manage user account.
The first one is user ad is to create a new user group, ad to create a new group, use it to lead to
delete a user that is already created group delete, to delete a group and use a mod, which is to modify
a user.
Now, whenever we create a new user, those user management are created.
Their record is maintained in three different files.
The first one is ETSI password, second one is ETSI group and the third one is Etsi Shadow.
And I remember etsi password is not a complete word password.
It's just past the example of how to run a user command, which includes all the parameters that you
have to define is as follows.
It goes with user add minus Xi with the option to add a group minus s option to give a shell environment
minus C to define the user description minus M, minus D to define the user home directory and the user
itself and their user home directory itself and the name of the user.
Now let's look at our Linux machine and we will practice these commands and learn these comen more into
detail of log into my Linux virtual console.
Let's move this to the side so we could see one of the command that we will be using.
OK.
Always first thing first you need to find out who you are.
You are yourself.
Where are you?
You are in your home directory, Purrfect, and what's inside of your home directory just to confirm
you are in the right place.
Yes, you are.
When you have confirmed this, just to clear screen now, we are going to create a user call, let's
say Spiderman, before I create a user.
I wanted to add their user to a group.
That, as let's call it, superheros, so in order to use these commands, you have to be rude, so
become rude as you space by Stasch.
OK, the first command that we will run is user ad space Biedermann.
You hit enter.
It gives you the back, which means it did create your user, Spider-Man, how do we verify if the if
the users created it is a command to check if users created is called I.D. Spider Man?
And I'll tell you that there is ID assigned to the user Spiderman and the group is created called Spiderman.
And the groups I did so on, you could also verify by going to the home territory home,
if you notice that it created right here the spider man, the next commander.
Do you want to learn is group.
And I want to create a group, a new group to come and the command to add a new group.
This group had and wanted to name it super.
It adds the group we could verified by looking at the group file, which will cover a little bit, but
if you wanted to see it, you could just look at see groups.
And at the bottom, you will see it created this.
Group name superheros.
Now I want to delete.
The user I created Spider-Man to the command to delete as user delete.
Now if you want to delete the home directory of Spider-Man.
Which is right here, you will run the command user, delete it, Miles, are as well say deleted,
delete the directorate as well.
So I deleted the user and let's check if I deleted the home directly.
Yes, it did delete the home directory as well.
So delete that I created and I use it before.
Just call Spider just for testing purposes.
As you can see here, the next command we have to do is, of course, to group delete.
So let's try to delete the group.
Let's start to lead.
A group of superheroes would create a new group and were deleted just for training purposes.
So let's create group AD.
No new group, let's call us the new group, the cabal is created equal, verified by going to the profile
and see at the bottom, says no new group.
That's new group ID.
We could delete any new group group.
Delete no new.
And it's deleted, we could verify again at the bottom it's gone, the next command that we have to
learn is using MOD.
This comment is used to modify the user.
You can run man on, use a mod to see what it does.
It modifies a user account.
If you notice A appends it as a user to supplement trade group, see the new value user password, change
the home directory.
So these are the things that if you want to do after you create a user.
So we will use this command to add our user Spierer Spearmen.
Let's see if we have Spider Man first or we deleted Spider-Man.
So let's create Spider-Man again.
User and Spider-Man.
As soon as you add.
The user user at Spiderman, it automatically creates its group as well.
If you don't specify, it creates a group with the same name as user IDs.
Now, I wanted to add Spider-Man to.
A different group as well, which is the superhero.
So how do we do that?
Use your mod minus G, which what's the name of the group Super Heroes and the name of the user that
I want to add a Spiderman to enter.
And it is added.
How do we verify it?
You do cat at sea, but instead of doing the cat and viewing the whole file above, you use scrub command
and just type spider man from that C group file.
And there you go.
You will see this is the super user group and Spider-Man is also part of that group.
This is the spider man's own group name and own group idea.
So Spider-Man has its own group and is also belongs to a group called Superheroes as well.
Not if you notice one here.
When you do this myself, you are the group of Spider-Man.
Right here is still Spider-Man.
Why didn't change to suit superheroes?
Because it's actual group as Spider-Man would always remain Spider-Man.
It is part of the other group as well, which is superheroes.
If you want this to change, then you have to run the command change group and then you specify superheroes
and then you specify Spider Man.
And remember, we have to use minus our option to cascade this permission of the group to every folder
of the Spider-Man.
So let's run this command and now see if the changes from Spider-Man are superheroes.
Yes.
See, now the user Spider-Man, the group is superhero.
So that's how you use these five different commands.
User AD is a group that use a delete group, delete and use a modification and the files that it creates
is information.
Is is the first one is etsi password.
Let's look at the etsi password cat and see password.
And you'll see at the bottom, as you add a new user to the Linux system, it adds the information of
the user at the Appends at the bottom, Spiderman and the spider, the one I quoted earlier, both are
in there.
The first column tells you the name.
The second one tells you the password, which is encrypted, is just give you the second one to tell
you the user ID and then the group ID.
And right here in between these two columns, we didn't specify the description.
So it's empty.
And then here it's a home directory of the Spider-Man.
And then at the end it's the shell the Spider-Man is using.
So that's the description of the ETSI password.
Let's look at the description of ETSI group and that's the group you have.
The first is group group name and then the group password, which is the same password that is used
for anyone within that group.
And then the group ID the last column that you see here with a few of them.
That means that these other users are also part of this group.
Then the last file will look at is the shadow etsi.
Shadow file is strictly for passwords of users that we create.
This does not mean the password right here, right here is actually a password.
It's just encrypted so we don't see it.
However, it does have some other parameters, like the password does not expire and these many days
there are password lente restrictions and so on.
You could view that in man command of creating users.
You'll get more information about Etsi Shadowfax.
Again, if you are Pacific about one user, let's say you just wanted to know the information about
Spider-Man in ATSE password, you do scrap Spider-Man Azzi password and you will only get the information
about your matching criteria, which is Spider-Man line.
Now we look at the last example, which is the example that is mostly used in the corporate environment,
that they would run one big command that will take care of all the parameters.
So let's create a new user user.
Ad.
Minus G to specify the group, which is we already have a group of super heroes.
And let's look at, uh, let's minimize this so we could move up and view all our command.
OK.
OK, superheroes minus s means the shell that you want to get their different shells, they are been
bag conch shell will cover the later minus C is the description.
You have to specify the description superheros you wanted to create ironmen.
So Ironman
character, just a description.
Nothing more than that then.
Minus N minus D specify the home directory which is home birhan man.
Space Island man.
This will create a user ironmen with all the parameters we have specified and how do verify you just
do ID man and you'll see that Iron Man is there and it's part of the group superheros.
And you could also view it and see password file and you see at the bottom it's there.
Now, one thing that we do have to cover every time you have to create a user, make sure you create
its password.
So the command to create a password is just a simple password.
Iren man and to specify the password and password that I've specified, it says password fills the dictionary
check.
It is based on a dictionary.
You could ignore that as long as you're running as root.
But if you are not rude, then it's going to force you to change the password that is not based on dictionary.
But again, you go through what you can do anything.
So this concludes our lesson for user account management.
The main the basic commands are these five commands and files that are used to managers is ETSI, password
group and shadow.
Change eight command issues per user and to use that command, which, by the way, I will show you
in the later lecture how we could use that command to specify those number of minimum days, maximum
days, last day, inactive expiry date and warning.
And as you notice at the end, it says user.
So you make that change to per user basis.
Now, what if you want to set those default values for every users that is created in your system?
What I mean is what if you have to create 10 users?
Would you run c, h, h command for every you to set the maximum days that is allowed to have the password
one by one?
Or would you rather have that value set in some kind of default configuration where every time a users
created that value is automatically set for that user?
For that there was a while again, it's called ETSI Log in default.
In that file you'll see there was a pass underscore max and disco days value, minimum days, minimum
length, warning age.
All those settings can be set up as a parameters in that file.
So let's look at that file really quick.
And here I have my Linux machine open.
I am logged in as a root and I will go ahead and do more RNC log in the defaults file, by the way,
it's def defaults, not def.
That's just a mistake on my slide.
So please make that note enter.
You will see right here everything that is set up as a hash sign means it's just a comment.
This is the pass for aging control.
Let's go down one page and this is what I'm talking about.
If you make the change here and specify the default settings that is based on your corporate or your
company requirements, you could set that up.
And then next time you create a user account will have that set setting apply to every user account.
Also, there are other values that could sit in this file as well.
So every time you create a user menu, max value for automatically wide selection user add, whenever
you run that user add command, the value of the UID is assigned by default to that user.
It starts with 1000.
So if you wanted to make that more secure, sometimes I have seen in corporate environment they start
the user ID with 10000 or 20000 or a number that cannot be guess easily.
You could put that in uid max meaning from one thousand to sixty thousand you could have a total of
59000 users.
Or you cannot assign anything that any I.D. to a user, which is like let's say 60000 one six user ID,
minimum system user I.D..
Max, this is that use ID for the systems processes, anything that is set up as a system process user.
There are other ones as group, user, group Max, the same way that for the users create a home directory.
Yes.
Every time you run user add comment, it will create an ID and group and encryption method that is set
by default.
Remember in the last slide I went over there five different settings and the setting that is used to
create the user encryption off that user password is SSA 512.
Now you're probably wondering what is those Ciccio 512 and different encryption.
Trust me, that gets very complicated and I don't want to get into that right now.
If you really want to learn more about those encryption, I a recommend you to go ahead and search online
and I'm sure you'll find tons of information on that.
You may ask is when you create a user, every time they use a creates a file, that file gets created
with specific permissions and permissions are actually assigned it right here.
And that, you may ask, permissions will be given to every use of that is created with this file.
Guys, remember, this file is very important.
C log in the defaults that file is actually controls how the passwords age minimum maximum is set for
each user.
And it is very, very important for you to know this file when someone is, uh, is in the corporate
environment and wants to tighten up the security that person always have to start with as user level.
That is why in my lectures, the first section that I'm going through, the security part is at the
user level.
And when you talk about creating users, this file is the one you really need to remember.
Now, in the coming lecture, I'll show you how to use the c, c, h, h command that could be used
to set these user password minimum days and H.
OK, now we actually going to run the S.H. age command, so it's not change again, a, c, h, h,
so change H, that command is specifically used to set parameters around the password.
It is not used to make any changes to the user account itself to change or make any changes to the user
account.
You will use user mod, which we learned in the previous lecture.
OK, the command is again, as I said before, is per user basis.
You could actually run the command H age with minus D, minus M and all different options that we cover.
Again, minus D is for last password, minus four minimum uppercase.
As for maximum minus W is for warning, minus is for inactive, minus four to expire.
OK, now let's get into my Linux machine right away.
OK, so we know the account exist, we have created we verified it, now we are going to make the change
of that Babou but password parameters before we make the change, let's grep for Barbu and let the shadow
file since I only have one Barbu that so I could just simply grab for Bubu instead of the complete name
Barbu.
But OK, here you'll notice it has all the default information, the username, the password, the last
password change minimum and all of the parameters, same default value.
These are the value from here till the end are the value we are going to change.
And again, the reason we're making this change is so we could secure our environment.
And of course, our entire topic is about securing the environment.
So we make that change for what?
For one specific user to change the environment.
Now, to run the command S.H. age, you could do minus D for last day.
And I would not like to make that change because I want it to be consistent with the systems time and
the system.
Time is days since January 1st, 1970 that the password was last changed.
If I make that change right now, I won't have I can't keep track of the password change.
So right now, if I take this number and minus the date of January 1st, 1970, then I could tell that
password was changed today.
So I don't want to make that change.
I wanted to keep that for my own information.
So I will start with minus M, which says minimum.
What is that minimum?
The minimum number of days required between password changes.
That is the number of days left before the user is allowed to change his or her password.
Meaning if you are changing password today and if I make this five right now, it means you cannot change
the password until those five days has already been passed.
So right now I notice it is set to zero, meaning there is no restriction.
But for this exercise, I'll put five.
Next one.
We have uppercase M, which is maximum.
What does this maximum mean?
It means the maximum number of days.
A password is valid after that uses force to change his or her password.
So right now, the total number of days I have to change my password is nine nine nine nine nine, which
is a lot too many days.
So the system is not going to prompt the user to change his or her password until that day comes.
And of course, hopefully we all live to that age, but that's not possible.
So it's good to make the user change his or her password every, let's say, three months.
That makes it ninety days.
I'll put nine zero.
So every 90 days the system will prompt this user, hey, your password is expiring, so please go ahead
and change the person.
Then the number six is warning.
So for warning meaning before it expires.
So I want the system to notify the user ten days before the password expires, which is ninety.
So I'm going to put ten.
So automatically the system does the calculation for you and it will see, hey, the maximum number
of days is 90.
So I have to remind to remind the person ten days before next one is minus E is an active.
That means the number of days after password expires, the account is disabled.
So if your password expires today, your account will be disabled tomorrow, day after tomorrow or whenever
that is specified right here.
So I will say delete disable account.
If the password is not changed, disable it after three days.
OK, the last one is expired, which I pick e sorry.
This inactive one was I and the last expired days since this account is disable, that is an absolute
date specified when the login may no longer be used.
So you can specify a number when the password is actually completely expires.
Actually the only one inactive one is an anak div meaning it's in making the account is inactive now
expire one days since January 1st.
Nineteen seventy.
That account is disabled so it will does the calculation until that account is disabled.
So for now you can leave that.
OK, so I just ran the command and gave me an error message.
OK, now I know why it gave me an error message is because I forgot to specify the username.
Which user am I going?
Am I picking to make that change to.
That is why I'm getting this options.
So that is Bubu.
But OK, so it took it and it gave me the back.
Now I am going to view these parameters in Etsi Shadowfax so I'll do grep Bubu but see Shadow.
And here you will see I didn't pick the miners D, which is the last day of the last display, you can
make your own last day from whichever date if you want, but I'm just leaving it to some default.
That's why I didn't pick the next one.
If you notice, I have number five, which was a minimum day I picked right here.
Then the next one is maximum.
It has a system to remind the user to change the password, force the user to change the password up
to 90 days.
And then the next one is W is a warning.
It will remind 10 days before and seven is that seven and and activate the the user account after three
days of password expiry.
So that's how the S.H. age password works.
Parameters to change it.
If you again, if you want to make that change throughout your systems, then which file do you have
to modify.
Yes, etsi login defaults and that's a common practice of recommend you can modify there.
But if you are making changes to a few users, only then I would recommend that you see each each commit.
So that's one of the each command that is mostly used for securing your user environment.
Since we know how to manage user account, now it's time to learn about how do we switch users and how
do we allow sudo access to user, what is ASUDA access?
It's basically a command which allows an ordinary user to run root level commands.
The commands that you can run to switch from one user to another is simply Asou space dash basters user
name and then it will ask you for the user name password.
You enter that and you become that user.
The next command is the sudo command and this is how you run the command.
If you do not have route privileges or you cannot become rude, but you still need to run certain commands,
then you were on Soudas, followed by the command and then the last command is visu to visu to edit
the ETS at C-store file, which is a configuration file that allows user to add or remove the rights
to run certain commands.
And the file is Etsi Sudar.
If you remember at the beginning we talked about file structure and we talked about the ETSI.
ATSE is the is the folder or directory in Lennix where all the configuration files are stored.
Now, let's look at these commands one by one by logging into our Linux machine, and this time he will
log into our Linux machine through the PUDI.
First, we need to find out what is the IP address of our Linux machine.
If we don't know, we just log in and clear this out.
And the command to check the IP address of your machine is if config you hit enter.
And the IP address is right here.
This this is the primary interface that is used to communicate the computers.
This is the local interface.
You could know that.
And this is another interface.
You could know what that is for private communication.
So focus on this one.
Open up your play terminal.
And type in the IP address, when I one 68, the 56 dot one or one enter, put it in the username and
password.
Once we were logged in, we could simply minimise this console access.
Now we will be using the Putti.
Make this a little bigger.
OK, so we logged in as ourself.
Now, what if he wanted to become another user?
So you do as you dash Spiderman will ask you for the password and then you become Spiderman.
Exit out, go back to our account.
What if you want to become rude?
Simply do as you dash, which we have covered many times, will enter the password and you become Barut
when you are rude.
And from this level you wanted to switch to a different user.
This is Spider-Man.
Then it will not ask you for the password because super user Aruda account is very powerful.
That does not need any other password to be authenticated.
We are.
We are Spider-Man.
Let's go back.
We are now route.
Let's go one step back, exit out and we are ourself.
Let's clear this.
Up next command.
We will learn a sudo sudo is the command that is used to run a different commands that is only owned
or only has permissions by route to run them.
For example, one of the command is DMI Decode.
You were on that.
That will give you permission denied because we can now run that command.
Another command would be, for example, if desk to check check the disk size, it will give you the
permission denied as well because we do not have the right again.
Who am I?
We are ourselves.
So how do we get the permission without becoming route?
Well, only route can allow that.
I could become route here and run the command.
So Sue to root and and to know I'm root and the command that I will run to add a group to at Cisarua
file is VSC suitable for hair.
You need to look for the group name of veal.
Veal is the group that is automatically by default added to this file.
We go down, we're coming down.
Remember to come down.
When you are in V.I. mode, you come down, you use your upkeep, right.
Key, bottom key.
And there you go.
So this is the veal and it tells you this group allows people in group veal to run all commands.
So all we need to do is to add I have salt into the veal group and it will allow all users, whoever
and veal group to run all commands.
So it's already added there.
We don't have to modify the executer.
If you wanted to add a new group or if you wanted to add a new user, then you would change that to
allow run all the commands.
Let's say if you want, if you want to add I have TSOL to run, I'll use a command and you will put
it right here.
You put I saw all dash all tab and then you will run pseudo command and you could become root.
Rights to run any comment, but we don't want to go at the user level, we want.
We will stay at the group level.
So what I will do all delete this line to delete a line is and then I'll save the pile.
Now, we know that we need to add user to vehle group.
So to add a user user mod minus G.
And the command is now which group is Vehle and which user is.
Enter Reverify Krehbiel from ETSI Group because group has the file, the managers, that user manages
all the groups and you'll see right here now I am part of the wheel, so if I become myself to a T..
So who am I myself.
So if I become myself now, if I run sudo dmi decode it will ask me for the first time password.
OK, so the command that I typed was wrong sudo DMI, not DMI Decode.
Sorry about that.
There you go.
See, now the command is running.
What if you run this command?
Just vidaza, it's now going to run.
You have to run the command sudo followed by the DMI Decode and that's how it will run.
You can also run the second command sudo f disk which will tell you the size of your desk and here it
will tell you the size of the disk is ten point seven gig and all the information, all that you can
only you that information only if you are route.