The Process of Creating User Accounts
When you create a user account using the
User Manager application, you can manage all
aspects of the user account. For detailed instructions on using
User Manager, see the chapter titled
User and Group Configuration in the
Official Red Hat Linux Customization Guide. This section will highlight the
multi-step user creation process necessary when using the command line
tools.
There are two steps to creating a user with the command line tools
included with Red Hat Linux:
Issue the useradd command to create a locked
user account.
Unlock the account by issuing the passwd
command to assign a password and set password aging
guidelines.
The following steps illustrate what happens if the command
/usr/sbin/useradd juan is issued on a system that has
shadow passwords enabled:
A new line for juan is created
in /etc/passwd. The line has the following
characteristics:
It begins with the username,
juan.
There is an x for the
password field indicating that the system is using shadow
passwords.
A UID at or above 500 is created. (Under Red Hat Linux UIDs and GIDs
below 500 are reserved for system use.)
A GID at or above 500 is created.
The optional GECOS information is left blank.
The home directory (/home/juan/) is
specified.
The default shell is set to
/bin/bash.
A new line for a group named
juan is created in
/etc/shadow. The line has the following
characteristics:
It begins with the username,
juan.
Two exclamation points (!!)
appear in the password field of the
/etc/shadow file, which locks the
account.
The password is set to never expire.
A new line for a group named
juan is created in
/etc/group. A group bearing the same name as a
user is called a user private group. For more
information on user private groups, see the chapter titled
Users and Groups in the
Official Red Hat Linux Reference Guide.
The line created in /etc/group has the
following characteristics:
It begins with the group name,
juan.
An x appears in the
password field indicating that the system is using shadow group
passwords.
The GID matches the one listed for user
juan in
/etc/passwd.
A new line for a group named
juan is created in
/etc/gshadow. The line has the following
characteristics:
It begins with the group name,
juan.
Two exclamation points (!!)
appear in the password field of the
/etc/gshadow file, which locks the
group.
All other fields are blank.
A directory for user juan is created in the
/home/ directory. This directory is owned by
user juan and group
juan. However, it has read, write,
and execute privileges only for the user
juan. All other permissions are
denied.
The files within the /etc/skel/ directory
(which contain default user settings) are copied into the new
/home/juan/ directory.
At this point, a locked account called
juan exists on the system. To activate
it, the administrator must next assign a password to the account using
the passwd command and, optionally, set password
aging guidelines.
It is also possible to configure the account so that during the
first log in, the user is asked to create a password. See the Section called New User Passwords.
Password Security
Creating strong passwords is important for the security of the
organization. There are two options available to enforce the use of
good passwords:
The system administrator can create passwords for all
users.
The system administrator can let the users create their own
passwords, while verifying that the passwords are of acceptable
quality.
Creating passwords for the users ensures that the passwords are
good, but it becomes a daunting task as the organization grows.
It also increases the risk of users writing their passwords
down.
For these reasons, system administrators prefer to have the user
create their own passwords. However, a good system administrator
actively verifies that the passwords are good and, in some cases,
forces users to change their passwords periodically through password
aging.
For guidelines on how to create strong passwords and how to set
password aging policies, see the chapter titled Workstation
Security in the Official Red Hat Linux Security Guide.
New User Passwords
If passwords within an organization are created centrally by the
administrator, adding new users to the organization means the
administrators must configure the account so the user is asked to
create a password when logging in for the first time.
To configure a user account in this manner, follow these
steps:
Create the user account using the
useradd command. — At this
point the account is created, but locked.
Force immediate password expiration
— To do this. type the following command:
This sets the value for the date the password was last changed
to the epoch (January 1, 1970). This value forces immediate
password expiration no matter what password aging policy, if any,
is in place.
Unlock the account — There are two
common approaches to this. The administrator can assign an initial
password:
/usr/sbin/usermod -p "<password>" |
In the above command, replace
<password>
with the initial password.
Or, the administrator can assign a null password:
 | Caution |
|---|
| | While using a null password is convenient for both the user
and the administrator, there is a slight risk that a third party
can log in first and access the system. To minimize this threat,
it is recommended that administrators verify that user is ready
to log in when they unlock the account. |
In either case, upon initial log in, the user is prompted for
a new password.
