
\section{Management of User Accounts}

\begin{frame}
   {Creating User Accounts with useradd}

   \begin{itemize}
      \item \textbf{useradd} allows for default operation
      \begin{cmd}
$ sudo useradd dexter
      \end{cmd}
      \begin{itemize}
         \item Creates account \texttt{dexter}
         \item Uses defaults for user and group id, home
         directory, and shell
      \end{itemize}
      \item Override defaults by using options to \textbf{useradd}
      \begin{cmd}
$ sudo useradd -s /bin/csh -m -k /etc/skel -c "Bullwinkle J Moose" bmoose
      \end{cmd}
      \item Specifies shell, skel directory, comment field using options
   \end{itemize}

\end{frame}

\cprotect\note{

   \begin{cmd}
$ sudo useradd dexter
   \end{cmd}
   causes the following steps to execute:

   \begin{itemize}

      \item
      The next available \texttt{UID} greater than
      \verb?UID_MIN? (specified in
      \filelink{/etc/login.defs}) by default is assigned as
      \texttt{dexter}'s \texttt{UID}.

      \item
      A group called \texttt{dexter} with a
      \texttt{GID=UID} is also created and assigned as
      \texttt{dexter}'s primary group.

      \item
      A home directory \filelink{/home/dexter} is created
      and owned by \texttt{dexter}.

      \item
      \texttt{dexter}'s login shell will be
      \textbf{/bin/bash}.

      \item
      The contents of \filelink{/etc/skel} is copied to
      \filelink{/home/dexter}. By default,
      \filelink{/etc/skel} includes startup files for
      \textbf{bash} and for the \textbf{X Window} system.

      \item
      An entry of \texttt{!!} is placed in the password
      field of the \filelink{/etc/shadow} file for
      \texttt{dexter}'s entry, thus requiring the
      administrator to assign a password for the account to
      be usable.
   \end{itemize}

   The defaults can easily be overruled by using options
   to \textbf{useradd} as in:
   \begin{cmd}
$ sudo useradd -s /bin/csh -m -k /etc/skel -c "Bullwinkle J Moose" bmoose
   \end{cmd}
   where explicit non-default values have been given for
   some of the user attributes.

}



\begin{frame}
   {Modifying and Deleting User Accounts}

   \begin{itemize}
      \item The root user can delete user accounts with
      \textbf{userdel}

      \begin{cmd}
$ sudo userdel morgan
      \end{cmd}
      Deletes the \texttt{morgan} user account, but does not
      remove her home directory

      \item User accounts can be modified with
      \textbf{usermod}

      \begin{cmd}
$ sudo usermod -L dexter
      \end{cmd}
      Locks the account for \texttt{dexter} so he cannot
      login

   \end{itemize}

\end{frame}

\cprotect\note{

   \begin{cmd}
$ sudo userdel morgan
   \end{cmd}

   \small{
      All references to the user \verb?morgan? will be erased from
      \filelink{/etc/passwd}, \filelink{/etc/shadow}, and
      \filelink{/etc/group}.
      While this removes the account, it does not delete the
      home directory (usually \filelink{/home/morgan}) in
      case the account may be re-established later.  If the
      \texttt{-r} option is given to \textbf{userdel}, the
      home directory will also be obliterated.  However, all
      other files on the system owned by the removed user
      will remain.

      \textbf{usermod} can be used to change characteristics
      of a user account such as group memberships, home
      directory, login name, password, default shell, user id
      etc.
      Usage is pretty straightforward.  Note \textbf{usermod}
      will take care of any modifications to files in the
      \filelink{/etc} directory as necessary.}
   \begin{figure}[H]

      \includegraphics[width=3.6in]{IMAGES/usermod}
      \caption{Using usermod}
   \end{figure}
   \vspace{-20pt}

}

\section{Locked Accounts}
\begin{frame}
   {Locked Accounts}

   \begin{itemize}
      \item \textbf{Linux} ships with some system accounts that
      are \textbf{locked:}
      \begin{itemize}
         \item Accounts such as \texttt{bin}, \texttt{daemon}, or
         \texttt{sys}
         \item May run programs but are never used for login
         purposes
      \end{itemize}
      \item Other locked accounts may be created for other
      purposes
      \begin{itemize}
         \item Accounts used by major applications like a
         database
      \end{itemize}
      \item Locked account has no valid password
      \begin{itemize}
         \item Usually represented by "!!"
         \item Fewer or greater than 100 characters for password
      \end{itemize}
      \item Ensure that all locked accounts also have an invalid
      shell (generally \filelink{/sbin/nologin})
   \end{itemize}

\end{frame}

\cprotect\note{

   \textbf{Linux} ships with some \textbf{locked}
   accounts, which means they can run programs, but can
   never login to the system and have no valid password
   associated with them.  For example
   \filelink{/etc/passwd} has entries like:
   \vspace{-10pt}
   \begin{klst}[]
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
   \end{klst}
   \vspace{-10pt}
   The \textbf{nologin} shell returns the following if a
   locked user tries to login to the system:
   \vspace{-10pt}
   \begin{klst}[]
This account is currently not available.
   \end{klst}
   \vspace{-10pt}
   or whatever message may be stored in
   \filelink{/etc/nologin.txt}.
   Such locked accounts are created for special purposes,
   either by system services or applications; if you scan
   \filelink{/etc/passwd} for users with the
   \textbf{nologin} shell you can see who they are on your
   system.
   It is also possible to lock the account of a particular
   user as in:
   \begin{cmd}
$ sudo usermod -L dexter
   \end{cmd}
   which means the account stays on the system but logging
   in is impossible.  Unlocking can be done with the
   \texttt{-U}  option.
   A customary practice is to lock a user's account
   whenever they leave the organization or is on an
   extended leave of absence.
   Another way to lock an account is to use \textbf{chage}
   to change the expiration date of an account:
   \begin{cmd}
$ sudo chage -E 2014-09-11 morgan
   \end{cmd}
   The actual date is irrelevant as long as it is in the
   past.
}




