In addition, every user has a default group, which is also identified by a numeric value. All of the available groups are listed in /etc/group. Again, lower numbers are typically reserved for special groups.
Managing users involves a number of activites:
| Entry | Meaning |
|---|---|
| GROUP=100 | default group id or name e.g. GROUP=users |
| HOME=/home | where the home dir is located |
| INACTIVE=-1 | days to disable after expiration, -1 = never |
| EXPIRE= | when the account expires, blank = never |
| SHELL=/bin/bash | |
| SKEL=/etc/skel | location of files copied to home |
There are programs that will test passwords and make sure that they are "crack-proof". Basically, they are the same tools that people user to break into your system. It is better to test passwords as they are created - see above, but these programs will test passwords and tell you which are vulnerable.
I took this from a site that is dedicated to hacking.
Information in a Password File
This is one of the most important things that you do for two reasons - first, your job probably depends on keeping the users reasonably happy. Second, it will eat up all of your time if you allow it to. Users can be incredibly demanding and helpless given the opportunity, so you need to have an organized approach.
#!/bin/sh echo "This account is locked. Please contact your sysadmin." exit
| login name |
| encrypted password |
| Days since password changed (since 1/1/1970) |
| Days before password may be changed |
| Days after password must be changed |
| Days before expiration that the user is warned |
| Days after password expiration that the account is disabled |
| Days the account has been disabled (since 1/1/1970) |
On some systems, it is important to control access to su just for you own piece of mind. This can be done by restricting access to su by changing the ownership and permissions. Traditionally, the wheel group is used for people that can access root types of things, so change the ownership of /bin/su:
and then change the permissions to:
The permissions and ownership for /bin/su should be:
-rwsr-xr-x 1 root wheel 19132 Aug 29 14:56 /bin/su
If you want someone to be able to run su, they must belong to the wheel group, which can be done by editing the /etc/group file, or with groupadd.
Most recent Linux installs include sudo.
The sudo command syntax is straight forward and documented in the man pages (sudo and sudoers) , but you seldom need to do anything fancy. Of some use is the -l option which lists the commands a user is allowed to execute with sudo.
The hosts part of the sudo process is for performing system administration tasks remotely. For example, on host A, you run a sudo command that uses rsh to access and execute a command on another system via sudo. For example,
On blah.blee.com, sudo will ask for your password and insure that the system are executing on is a trusted host for the shutdown command and user. rsh is not secure (and is disabled on many systems) so a better way to do this is:
You will have to type in a password for accessing the system as well as the sudo password. You can eliminate the first one by setting up ssh to access the remote host without a password.
sudo is controlled by the sudoers file, /etc/sudoers, as shown here /etc/sudoers. This is a very simple format, in spite of the way it looks. The lines at the bottom tell sudo how to control things, and the lines above simple define lists of, hosts, users, commands and run_as lists.
If you modify /etc/sudoers, use visudo as it locks the file and also performs syntax checking on the file when you close it. All sudoer accesses are logged in /var/log/sudo.log by default.
Most 2.x Linux kernels include quota support, and it can be enabled either at installation or by rebuilding the kernel. If kernel support is on, /etc/rc.d/rc.sysinit will enable quotas at boot time.
There are several steps. First, you need to turn on the quotas when the disk is mounted. In the following, all examples are related to a /home file system, but it could be any file system.
/dev/hda6 /home ext2 defaults,usrquota,grpquota 1 1
usrquota places quotas on users and grpquoata places defaults on groups. Next, you need to create the quota files for the filesystems as root.
Now reboot your system and quotas will be on. If you don't want to reboot, do the following:
If your quotas aren't on after rebooting try running quotacheck and then quotaon for each filesystem.
Note: This is really not a good way to do this as you could create corrupted quota files if there are users logged on. With this in mind, you should only do this booted to single user mode, or by mounting the partition read-only. You will not be able to mount the / partition read-only unless you boot from a floppy or CD-ROM.
To set quotas for a user:
edquota bozo
|
| before changing
V
Quotas for user bozo:
/dev/hda6: blocks in use 180, limits (soft = 0, hard = 0)
inodes in use 45, limits (soft =0, hard = 0)
|
| after changing
V
Quotas for user bozo:
/dev/hda6: blocks in use 180, limits (soft = 50000, hard = 50500)
inodes in use 45, limits (soft =1500, hard = 1550)
Other the commands related to quotas are:
| who | A list of current users
that are logged on. This
might include repeats of single users with multiple
login shell sessions. By default, it shows the user
name, terminal and login time.
Syntax: who [options] Options
|
| ac | Print a report of connect
time by user as recorded in /var/log/wtmp.
Syntax: ac [options] Options
|
| last,lastb | Print a list of users
that have logged in and out. lastb shows failed login
attempts.
Syntax: last [options] [username][tty] Options
|
| users,rusers | Print a simple list
of logged in users. rusers prints the rwho information
for all hosts on the network that participate.
Syntax: users [options] Options
|
| wall,rwall | Send a message to
all terminals on a host. rwall sends to all logged in users
on a specified host.
Syntax: wall [-n] message
|
| w | Print a a list of users
logged in, their terminals, dynamic usage statistics
and command executed. The header also shows current
system performance statistics.
Syntax: w[options] Options
|
| bin | daemon | adm | ||
| lp | sync | shutdown | ||
| halt | news | |||
| gopher | ftp | nobody | ||
| ntp | rpc | sshd | ||
| rpm | mailnull | nfsnobody | ||
| named | gdm | apache |
Some of these could be used simply for setting permissions on the file system, others could be actual login names. For example, the named daemon (implements DNS services) runs as named to insure that it can be isolated from roots capabilities. If these ran as root, with uid 0, they could do considerable damage to your system if they happened to be a trojan horse or simply had a serious bug. It is important that the password field in /etc/passwd for thse accounts be set to prevent logins (an "x").
Set up a user named gjh, and use the password you have been given. You will also have to set up your tcp wrappers so that I can telnet to your machine from 153.90.199.77.