NDG Linux Essentials - Lab 14_ Creating a User

14.1 IntroductionThis is Lab 14: Creating a User. By performing this lab, students will learn about how to create a new user account, establish the initial password for this account, and make other modifications such as making them a member of a secondary group.In this lab, you will perform the following tasks:1. Create a new user with the useradd command2. Set and reset a user's password with the passwd command3. Make changes to the user account with the usermod command14.2 Creating Users and GroupsIn this task, you will create group and user accounts.Group accounts can be helpful to be able to assign permissions on files shared by a group of users.User accounts in Linux distributions based upon Red Hat, like the CentOS distribution, start with the first User ID (UID) at 500, the next UID given at 501, and so on. The current trend followed by many other distributions is to have the first UID be 1000, the second to be 1001, and so on.If managing accounts for multiple systems, then it is desirable to have a network-based authentication server, where accounts can be created once, but used on many machines. Otherwise, managing multiple accounts on multiple machines can be challenging as it can be difficult to ensure that the user, and all the groups they belong to all have the same UIDs and GIDs on all machines.Another issue with multiple machine accounts that can be difficult is trying to keep the passwords to each account synchronized across all machines.Managing accounts for local users is still useful for individual machines, even if they have access to a network-based authentication server. In this lab, you will manage local group and user accounts.14.2.1 Step 1In order to administer the user and group accounts, you will want to switch users to the root account with the following command:su -(Provide the root password "netlab123" when prompted)sysadmin@localhost:~$ su -Password:root@localhost:~#14.2.2 Step 2Use the groupadd command to create a group called "research":groupadd -r researchroot@localhost:~# groupadd -r researchroot@localhost:~#The research group that was just added was added in the reserved range (between 1-999) because the -r option was used. Group Identifiers (GIDs) are automatically assigned with a value of less than the lowest normal user UID with this option. The groupadd command modifies the /etc/group file where group account information is stored.The groupmod command could be used with a -n option to change the name of this group or the -g option in order to change the GID for this group. The groupdel command can be used to delete this group, as long as it has not been made the primary group for a user.14.2.3 Step 3Use a getent command to retrieve information about the new group:getent group researchYour output should appear similar to the following, although the GID that was assigned may be different:root@localhost:~# getent group researchresearch:x:999:root@localhost:~#Now that the research group has been created, existing or new users can be made a member of this group. The usermod option -G must have a comma separated list of all secondary groups the user is to belong.When usermod is used with the -a and -G options, then only the new group will need to be specified and it will be added to the existing secondary group memberships.14.2.4 Step 4Use the usermod command to add the research group as a secondary group for the sysadmin user:usermod -aG research sysadminroot@localhost:~# usermod -aG research sysadminroot@localhost:~#Users who are actively logged into the system will not be able to use any new group memberships until the next time they log into the system.14.2.5 Step 5There are several commands that could be used to verify the new group membership. Use the groups, id and getent commands to verify the sysadmin's membership:groups sysadminid sysadmingetent group researchThe output of the previous commands should appear similar to:root@localhost:~# groups sysadminsysadmin : sysadmin adm sudo researchroot@localhost:~# id sysadminuid=1001(sysadmin) gid=1001(sysadmin) groups=1001(sysadmin),4(adm),27(sudo),999(research) root@localhost:~# getent group researchresearch:x:999:sysadminroot@localhost:~#The useradd command will create a new user account and, in Red Hat-based distributions, a new group for that user. This new group will be named after the user and that will be their primary group.Red Hat-based distributions use what is known as "User Private Groups", or UPG, each user is a primary member of their own private group.For distributions that do not use UPG, all new users belong to the users group as their primary group.14.2.6 Step 6Create a new user named student who is a secondary member of the research group and a primary member of their own private group. Use a comment of Linux Student that will appear as the full name of the user when they do a graphical login. Make sure that their home directory will be created by specifying the -m option:useradd -G research -c 'Linux Student' -m studentroot@localhost:~# useradd -G research -c 'Linux Student' -m studentroot@localhost:~#The user's account information is stored in the /etc/passwd and /etc/shadow files. The user's group information can be found in/etc/passwd and /etc/group file.14.2.7 Step 7Using the getent command, view the research group members again, but also use getent to show the student group, and the passwd and shadow databases for the student user:getent group researchgetent group studentgetent passwd studentgetent shadow studentroot@localhost:~# getent group researchresearch:x:999:sysadmin,studentroot@localhost:~# getent group studentstudent:x:1002:root@localhost:~# getent passwd studentstudent:x:1002:1002:Linux Student:/home/student:/bin/shroot@localhost:~# getent shadow studentstudent:!:16902:0:99999:7:::root@localhost:~#The output should now show that both sysadmin and student are secondary members of the research group.The GID of the student group matches the fourth field of the passwd information. This is what makes the student a primary member of the student group.Finally, the ! appearing in the password field (second field) of the shadow file, shows that the password for the student has not been set.14.2.8 Step 8Use the passwd command to set the password, netlab123 for the student user and view the shadow file entry for the student user again:passwd student(type the same password twice)getent shadow studentThe output from the /etc/shadow file now shows an encrypted password in the second field:root@localhost:~# passwd studentEnter new UNIX password:Retype new UNIX password:passwd: password updated successfullyroot@localhost:~# getent shadow studentstudent:$6$pIEEdvAX$GBo0beYhojL3/vDrOP2UAQR6uVCWMZXxMPqImREJWw/5oR2WTtM6dH3H83VjrmG6hGd9ux2I9FQFWQLtg3/:16 root@localhost:~#14.2.9 Step 9Just because a user has a password doesn't mean that they have ever logged into the system. Use the last command to see if the student has ever logged in:lastlast studentThe output of the last command should show that the sysadmin user has logged in before, but not the student user:root@localhost:~# lastsysadmin console Mon Apr 11 19:08 still logged insysadmin console Mon Apr 11 19:08 - 19:08 (00:00)wtmp begins Mon Apr 11 18:25:26 2016root@localhost:~# last studentwtmp begins Mon Apr 11 18:25:26 2016root@localhost:~#There is also a lastb command, which works similar to the last command except that it shows "bad" or failed log in attempts.If you no longer wanted the student user to have access to the system, then the usermod -L student command could be used to "lock" the account. The account could be unlocked with the usermod -U student command.A more permanent solution to preventing access to the student account would be to delete the account with either the userdel student or userdel -r student commands. Using the -r option with the userdel command removes the user's home directory and mail, in addition to deleting the user's account.14.2.10 Step 10Delete the student account and remove the user's home directory:userdel -r studentExecuting the command should look like this:root@localhost:~# userdel -r studentroot@localhost:~#。