541 lines
17 KiB
Markdown
541 lines
17 KiB
Markdown
# Users
|
||
|
||
Linux is a [multi user](https://en.wikipedia.org/wiki/Multi-user_software) operating system.
|
||
For an end user's perspective this means we can have multiple accounts on one machine.
|
||
For example, one for each member of your household or company.
|
||
User can log in, out or switch accounts when seated at the computer or do multiple simultaneous logins via `ssh` or remote desktop software.
|
||
|
||
From a more internal point of view, Linux uses different accounts to do perfrom different tasks on the system.
|
||
These accounts are often called [system accounts](https://unix.stackexchange.com/questions/80277/whats-the-difference-between-a-normal-user-and-a-system-user).
|
||
|
||
We can list all know accounts with the following command.
|
||
|
||
```
|
||
waldek@debian:~$ cat /etc/passwd | cut -d ":" -f 1
|
||
root
|
||
daemon
|
||
bin
|
||
sys
|
||
sync
|
||
games
|
||
man
|
||
lp
|
||
mail
|
||
news
|
||
uucp
|
||
proxy
|
||
www-data
|
||
backup
|
||
list
|
||
irc
|
||
gnats
|
||
nobody
|
||
_apt
|
||
systemd-network
|
||
systemd-resolve
|
||
messagebus
|
||
systemd-timesync
|
||
sshd
|
||
waldek
|
||
systemd-coredump
|
||
waldek@debian:~$
|
||
```
|
||
|
||
Accounts are nothing more than a correctly defined line in a text file!
|
||
We can add and remove accounts as we please but luckily there are some tools to help us.
|
||
|
||
## Adding and removing users
|
||
|
||
### GNOME
|
||
|
||
In the gnome activities window we can search for *add user* and when we launch the program we'll see the dialog below.
|
||
|
||
|
||
|
||
As adding a user is quite *invasive* to the system we need to prove we have the administration rights to do so.
|
||
|
||
|
||
|
||
Now we can add a user.
|
||
|
||
|
||
|
||
Done!
|
||
|
||
|
||
|
||
Now we can verify the account's existence by logging in.
|
||
|
||
|
||
|
||
Or via the command line.
|
||
|
||
```
|
||
waldek@metal:~$ su david
|
||
Password:
|
||
david@metal:/home/local/waldek$ tail -3 /etc/passwd
|
||
nvpd:x:125:137:NVIDIA Persistence Daemon,,,:/var/run/nvpd/:/usr/sbin/nologin
|
||
_flatpak:x:126:138:Flatpak system-wide installation helper,,,:/nonexistent:/usr/sbin/nologin
|
||
david:x:1005:1005:david,,,:/home/david:/bin/bash
|
||
david@metal:/home/local/waldek$
|
||
```
|
||
|
||
We can also **remove** a user via the graphical interface.
|
||
|
||
|
||
|
||
### command line
|
||
|
||
This why you're here no?
|
||
To learn how to manager a Linux system like a pro.
|
||
So let's look into how to add and remove users via the command line.
|
||
As it's an *administrative* task we'll need to prove we have to right to do so.
|
||
This implies the use of `sudo`.
|
||
|
||
```
|
||
waldek@debian:~$ sudo add
|
||
addgroup addpart add-shell adduser
|
||
waldek@debian:~$ apropos adduser
|
||
adduser.conf (5) - configuration file for adduser(8) and addgroup(8) .
|
||
adduser (8) - add a user or group to the system
|
||
waldek@debian:~$ sudo adduser
|
||
[sudo] password for waldek:
|
||
adduser: Only one or two names allowed.
|
||
waldek@debian:~$
|
||
```
|
||
|
||
The `adduser` program takes one or two arguments.
|
||
The behaviour changes quite dramatically depending on the number of arguments.
|
||
When you give *one* argument, the program will add a user to the system.
|
||
When using *two* arguments the program will add a user to a group.
|
||
|
||
```
|
||
waldek@debian:~$ sudo adduser ilies
|
||
Adding user `ilies' ...
|
||
Adding new group `ilies' (1001) ...
|
||
Adding new user `ilies' (1001) with group `ilies' ...
|
||
Creating home directory `/home/ilies' ...
|
||
Copying files from `/etc/skel' ...
|
||
New password:
|
||
Retype new password:
|
||
passwd: password updated successfully
|
||
Changing the user information for ilies
|
||
Enter the new value, or press ENTER for the default
|
||
Full Name []:
|
||
Room Number []:
|
||
Work Phone []:
|
||
Home Phone []:
|
||
Other []:
|
||
Is the information correct? [Y/n]
|
||
waldek@debian:~$ tail -1 /etc/passwd
|
||
ilies:x:1001:1001:,,,:/home/ilies:/bin/bash
|
||
waldek@debian:~$ su ilies
|
||
Password:
|
||
ilies@debian:/home/waldek$
|
||
```
|
||
|
||
If we want to add `ilies` to the group of administrators we can use the same program but with **two** arguments, first the user, then the group in question.
|
||
|
||
```
|
||
ilies@debian:~$ sudo apt update
|
||
[sudo] password for ilies:
|
||
ilies is not in the sudoers file. This incident will be reported.
|
||
ilies@debian:~$ exit
|
||
exit
|
||
waldek@debian:~$ sudo adduser ilies sudo
|
||
Adding user `ilies' to group `sudo' ...
|
||
Adding user ilies to group sudo
|
||
Done.
|
||
waldek@debian:~$ su ilies
|
||
Password:
|
||
ilies@debian:/home/waldek$ sudo apt update
|
||
[sudo] password for ilies:
|
||
Get:1 http://security.debian.org/debian-security bullseye-security InRelease [44.1 kB]
|
||
Hit:2 http://deb.debian.org/debian bullseye InRelease
|
||
Get:3 http://deb.debian.org/debian bullseye-updates InRelease [39.4 kB]
|
||
Get:4 http://security.debian.org/debian-security bullseye-security/main Sources [120 kB]
|
||
Get:5 http://security.debian.org/debian-security bullseye-security/main amd64 Packages [146 kB]
|
||
Fetched 350 kB in 0s (902 kB/s)
|
||
Reading package lists... Done
|
||
Building dependency tree... Done
|
||
Reading state information... Done
|
||
1 package can be upgraded. Run 'apt list --upgradable' to see it.
|
||
ilies@debian:/home/waldek$
|
||
```
|
||
|
||
`ilies` is now a user account with full administrator rights!
|
||
An important detail you should know is that a user's groups are only loaded upon login.
|
||
This has as a side effect that when you add a user to a group, they need to log out and back in order for the changes to take effect.
|
||
There are [tricks](https://superuser.com/questions/272061/reload-a-linux-users-group-assignments-without-logging-out) to bypass the behaviour though but I must say I always log out and back in myself.
|
||
|
||
Removing a user is done with the `deluser` program.
|
||
|
||
```
|
||
waldek@debian:~$ sudo deluser ilies
|
||
Removing user `ilies' ...
|
||
Warning: group `ilies' has no more members.
|
||
Done.
|
||
waldek@debian:~$ tail -1 /etc/passwd
|
||
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
|
||
waldek@debian:~$ grep ilies /etc/passwd
|
||
waldek@debian:~$ su ilies
|
||
su: user ilies does not exist or the user entry does not contain all the required fields
|
||
waldek@debian:~$
|
||
```
|
||
|
||
It's worth pointing out that both `adduser` and `deluser` are scripts.
|
||
We can verify this as follows.
|
||
|
||
```
|
||
waldek@debian:~$ file $(sudo which adduser)
|
||
/usr/sbin/adduser: Perl script text executable
|
||
waldek@debian:~$ file $(sudo which deluser)
|
||
/usr/sbin/deluser: Perl script text executable
|
||
waldek@debian:~$ head $(sudo which deluser)
|
||
#!/usr/bin/perl
|
||
|
||
# deluser -- a utility to remove users from the system
|
||
# delgroup -- a utilty to remove groups from the system
|
||
my $version = "3.118";
|
||
|
||
# Copyright (C) 2000 Roland Bauerschmidt <rb@debian.org>
|
||
# Based on 'adduser' as pattern by
|
||
# Guy Maor <maor@debian.org>
|
||
# Ted Hajek <tedhajek@boombox.micro.umn.edu>
|
||
waldek@debian:~$
|
||
```
|
||
|
||
The *real* heavy lifting is done by two *other* programs called `useradd` and `userdel`.
|
||
When writing your own scripts to add and remove users you should use these programs an not the `perl` scripts!
|
||
|
||
```
|
||
waldek@debian:~$ file $(sudo which useradd)
|
||
/usr/sbin/useradd: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=cddbc9a8bae8b6f626a47a2b5ed1ea76081eae6d, for GNU/Linux 3.2.0, stripped
|
||
waldek@debian:~$ file $(sudo which userdel)
|
||
/usr/sbin/userdel: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=cdf46de13b11b883951743d5652347a141bafba7, for GNU/Linux 3.2.0, stripped
|
||
```
|
||
|
||
## Switching user
|
||
|
||
There are **two** different ways of *switching* user accounts or performing tasks *as* someone else: `su` and `sudo`.
|
||
`su` means **switch user**, while `sudo` means **switch user and do**.
|
||
`sudo` is a bit more modern but both have their [utility](https://www.redhat.com/sysadmin/difference-between-sudo-su).
|
||
So, some examples.
|
||
|
||
```
|
||
waldek@debian:~$ whoami
|
||
waldek
|
||
waldek@debian:~$ sudo whoami
|
||
root
|
||
waldek@debian:~$ sudo -u steve whoami
|
||
steve
|
||
waldek@debian:~$ sudo -u ilies bash
|
||
ilies@debian:/home/waldek$ whoami
|
||
ilies
|
||
ilies@debian:/home/waldek$ cd
|
||
ilies@debian:~$ pwd
|
||
/home/ilies
|
||
ilies@debian:~$
|
||
```
|
||
|
||
Above we can see that `sudo` is used to perform a task *as* an other user.
|
||
We can use this to launch single commands but also to launch a `bash` shell.
|
||
A more *classic* way to switch identity is to use `su`.
|
||
Below you can see the difference between a simple `su` call and with the `-` argument.
|
||
The difference is subtle but quite important.
|
||
Have a read of the `man su` for more information.
|
||
|
||
```
|
||
waldek@debian:~$ su ilies
|
||
Password:
|
||
ilies@debian:/home/waldek$ whoami
|
||
ilies
|
||
ilies@debian:/home/waldek$ pwd
|
||
/home/waldek
|
||
ilies@debian:/home/waldek$ exit
|
||
exit
|
||
waldek@debian:~$ su - ilies
|
||
Password:
|
||
ilies@debian:~$ pwd
|
||
/home/ilies
|
||
ilies@debian:~$ whoami
|
||
ilies
|
||
ilies@debian:~$
|
||
```
|
||
|
||
For the lazy...
|
||
|
||
```
|
||
-, -l, --login
|
||
Start the shell as a login shell with an environment similar to a real
|
||
login:
|
||
|
||
o clears all the environment variables except TERM and variables
|
||
specified by --whitelist-environment
|
||
|
||
o initializes the environment variables HOME, SHELL, USER, LOG‐
|
||
NAME, and PATH
|
||
|
||
o changes to the target user's home directory
|
||
|
||
o sets argv[0] of the shell to '-' in order to make the shell a
|
||
login shell
|
||
```
|
||
|
||
## Groups
|
||
|
||
Groups are a second fundamental concept of any Linux distribution.
|
||
Every user has a **primary** group, most of the time the same name as their user account, and none/one/more **secondary** groups.
|
||
These groups can be made by us or by the distribution.
|
||
For example, `sudo` is the group that all administrators need to be a member of.
|
||
A few examples above I added `ilies` to the `sudo` group.
|
||
Once this was done, and `ilies` logged back in, he could perform administrative tasks.
|
||
|
||
`adduser` is used with **two** arguments to add a `user` to a `group`.
|
||
To create or delete groups we use `addgroup` and `delgroup`.
|
||
An example:
|
||
|
||
```
|
||
waldek@debian:~$ groups
|
||
waldek cdrom floppy sudo audio dip video plugdev netdev
|
||
waldek@debian:~$ su - ilies
|
||
Password:
|
||
ilies@debian:~$ groups
|
||
ilies
|
||
ilies@debian:~$ exit
|
||
logout
|
||
waldek@debian:~$ sudo addgroup friends
|
||
[sudo] password for waldek:
|
||
Adding group `friends' (GID 1003) ...
|
||
Done.
|
||
waldek@debian:~$ sudo adduser ilies friends
|
||
Adding user `ilies' to group `friends' ...
|
||
Adding user ilies to group friends
|
||
Done.
|
||
waldek@debian:~$ su - ilies
|
||
Password:
|
||
ilies@debian:~$ groups
|
||
ilies friends
|
||
ilies@debian:~$
|
||
```
|
||
|
||
Just like a user account is *just* a line in a text file, the group definitions are the same.
|
||
|
||
```
|
||
waldek@debian:~$ tail -5 /etc/group
|
||
waldek:x:1000:
|
||
systemd-coredump:x:999:
|
||
steve:x:1001:
|
||
ilies:x:1002:
|
||
friends:x:1003:ilies
|
||
waldek@debian:~$ sudo adduser steve friends
|
||
Adding user `steve' to group `friends' ...
|
||
Adding user steve to group friends
|
||
Done.
|
||
waldek@debian:~$ tail -5 /etc/group
|
||
waldek:x:1000:
|
||
systemd-coredump:x:999:
|
||
steve:x:1001:
|
||
ilies:x:1002:
|
||
friends:x:1003:ilies,steve
|
||
waldek@debian:~$
|
||
```
|
||
|
||
And we can delete the group as follows.
|
||
|
||
```
|
||
waldek@debian:~$ sudo delgroup friends
|
||
Removing group `friends' ...
|
||
Done.
|
||
waldek@debian:~$ tail -5 /etc/group
|
||
ssh:x:111:
|
||
waldek:x:1000:
|
||
systemd-coredump:x:999:
|
||
steve:x:1001:
|
||
ilies:x:1002:
|
||
waldek@debian:~$ su - ilies
|
||
Password:
|
||
ilies@debian:~$ groups
|
||
ilies
|
||
ilies@debian:~$
|
||
```
|
||
|
||
# Permissions
|
||
|
||
Unix like systems differ greatly from a Windows system because they are not just *multi tasking* but also *multi user*.
|
||
Users and groups imply [permissions](https://en.wikipedia.org/wiki/File-system_permissions#Notation_of_traditional_Unix_permissions), meaning **who** is allowed to do **what** on a system.
|
||
Permissions are tied to a **file system**, either real or virtual, but can't exist outside of this context.
|
||
When we list the files in a directory, we can add the `-l` flag to see more information.
|
||
In the example below I create a file called `helloworld` and show it's details with `ls -l`.
|
||
|
||
```
|
||
waldek@debian:~$ touch helloworld
|
||
waldek@debian:~$ ls -l
|
||
total 0
|
||
-rw-r--r-- 1 waldek waldek 0 May 16 10:32 helloworld
|
||
waldek@debian:~$
|
||
```
|
||
|
||
Next up I create a directory to store my pictures in.
|
||
|
||
```
|
||
waldek@debian:~$ mkdir photos
|
||
waldek@debian:~$ ls -l
|
||
total 4
|
||
-rw-r--r-- 1 waldek waldek 0 May 16 10:32 helloworld
|
||
drwxr-xr-x 2 waldek waldek 4096 May 16 10:33 photos
|
||
waldek@debian:~$
|
||
```
|
||
|
||
The file and directory above points us to suite a bit of information.
|
||
Let's break it down.
|
||
The table below slices each individual element apart.
|
||
The first column indicates the *type* of file.
|
||
This can be a directory, link, block device, character device, among others.
|
||
Have a look [here](https://en.wikipedia.org/wiki/Unix_file_types) for an elaborate explanation of all possible types in Linux.
|
||
|
||
| type | owner | group | others | nr links | owner | group | size | mod date | name |
|
||
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|
||
| - | rw- | r-- | r-- | 1 | waldek | waldek | 0 | May 16 10:32 | helloworld |
|
||
| d | rwx | r-x | r-x | 2 | waldek | waldek | 4096 | May 16 10:33 | photos |
|
||
|
||
## Octal number system
|
||
|
||
The octal number system is the most used one to represent permissions in Linux.
|
||
At first it might me a bit confusing but it's not *that* complicated.
|
||
You just have to **know** that:
|
||
|
||
* **read** is worth **4**
|
||
* **write** is worth **2**
|
||
* **execute** is worth **1**
|
||
|
||
The **sum** of these permissions is the octal representation.
|
||
Below is a little grid to help you understand.
|
||
|
||
| sum | 4 | 2 | 1 |
|
||
| --- | --- | --- | ---|
|
||
| 0 | - | - | - |
|
||
| 1 | - | - | x |
|
||
| 2 | - | w | - |
|
||
| 3 | - | w | x |
|
||
| 4 | r | - | - |
|
||
| 5 | r | - | x |
|
||
| 6 | r | w | - |
|
||
| 7 | r | w | x |
|
||
|
||
Each file in Linux has **three** different permissions.
|
||
|
||
1. for the **owner** of the file
|
||
1. for the **group** of the file
|
||
1. and for **everyone** who is not the *owner* nor in the *group*
|
||
|
||
In the example below I use `chmod` to change the *mode* or permissions of a file.
|
||
I *highly* encourage you to read the `man chmod`.
|
||
|
||
```
|
||
waldek@debian:~$ chmod 777 permission_test
|
||
waldek@debian:~$ ls -l permission_test
|
||
-rwxrwxrwx 1 waldek waldek 0 May 16 10:54 permission_test
|
||
waldek@debian:~$ chmod 000 permission_test
|
||
waldek@debian:~$ ls -l permission_test
|
||
---------- 1 waldek waldek 0 May 13 16:45 permission_test
|
||
waldek@debian:~$ chmod 123 permission_test
|
||
waldek@debian:~$ ls -l permission_test
|
||
---x-w--wx 1 waldek waldek 0 May 13 16:45 permission_test
|
||
waldek@debian:~$ chmod 640 permission_test
|
||
waldek@debian:~$ ls -l permission_test
|
||
-rw-r----- 1 waldek waldek 0 May 16 10:54 permission_test
|
||
waldek@debian:~$
|
||
```
|
||
|
||
When searching or files we discovered that we don't have the permission to read certain files, and now we know *why* that is!
|
||
A small specific example.
|
||
|
||
```
|
||
waldek@debian:~$ file /etc/shadow
|
||
/etc/shadow: regular file, no read permission
|
||
waldek@debian:~$ cat /etc/shadow
|
||
cat: /etc/shadow: Permission denied
|
||
waldek@debian:~$ ls -l /etc/shadow
|
||
-rw-r----- 1 root shadow 1001 May 13 13:49 /etc/shadow
|
||
waldek@debian:~$ whatis shadow
|
||
shadow (5) - shadowed password file
|
||
waldek@debian:~$
|
||
```
|
||
|
||
As administrator we do have the right to read this file.
|
||
So we can add `sudo` before the command to peek into the file.
|
||
|
||
```
|
||
waldek@debian:~$ sudo tail -2 /etc/shadow
|
||
steve:$y$j9T$UHjx5oOFKyFR6VMY6y1IB/$EnLPe41c46wW9xN.6oKNUhHw2XH4xchlxb8w7k2T853:19125:0:99999:7:::
|
||
ilies:$y$j9T$5ykW1sIfDSOFUbaFEcS6i0$/r73taI9vEcXNuMGw.3evLqhWDuPTVaC1dK6wjmpTb2:19125:0:99999:7:::
|
||
waldek@debian:~$
|
||
```
|
||
|
||
What on earth are this lines?
|
||
Well, those are the passwords of your user accounts which are stored in the [shadow](https://en.wikipedia.org/wiki/Passwd#Shadow_file) file format.
|
||
Historically they where [plain text](https://en.wikipedia.org/wiki/Plaintext) but now they are [hashed](https://en.wikipedia.org/wiki/Hash_function).
|
||
Don't forget you can read up about them in your terminal with `man shadow`, `man passwd`.
|
||
|
||
```
|
||
waldek@debian:~$ whatis passwd
|
||
passwd (5) - the password file
|
||
passwd (1) - change user password
|
||
passwd (1ssl) - compute password hashes
|
||
waldek@debian:~$ man 5 passwd
|
||
```
|
||
|
||
Now is a good time to point out the manual **sections**.
|
||
The manual for the passwd file and program are not the same.
|
||
We can read the file manual with `man 5 passwd` and the program manual with `man 1 passwd`.
|
||
More information of the sections can be found via `man man` where the table below comes from.
|
||
|
||
| section | description |
|
||
| --- | --- |
|
||
|1 | Executable programs or shell commands |
|
||
|2 | System calls (functions provided by the kernel) |
|
||
|3 | Library calls (functions within program libraries) |
|
||
|4 | Special files (usually found in /dev) |
|
||
|5 | File formats and conventions, e.g. /etc/passwd |
|
||
|6 | Games |
|
||
|7 | Miscellaneous (including macro packages and conventions), e.g. man(7), groff(7) |
|
||
|8 | System administration commands (usually only for root) |
|
||
|9 | Kernel routines [Non standard] |
|
||
|
||
## Essential programs
|
||
|
||
Below is a small list of often used programs when dealing with file permissions.
|
||
We'll go a into detail on some of them right after.
|
||
|
||
| name | description |
|
||
| --- | --- |
|
||
| `id` | print real and effective user and group IDs |
|
||
| `chmod` | change file mode bits |
|
||
| `chown` | change ownership of a file |
|
||
| `umask` | set file mode creation mask |
|
||
| `chgrp` | change group ownership |
|
||
| `passwd` | change user password |
|
||
| `su` | run a command with substitute user and group ID |
|
||
| `sudo` | execute a command as another user |
|
||
|
||
## Changing ownership
|
||
|
||
# Remote control of a server
|
||
|
||
## History
|
||
|
||
[Here](https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access) you have a nice article on the history of remote shells.
|
||
The two main ones are:
|
||
|
||
* [rsh](https://en.wikipedia.org/wiki/Remote_Shell)
|
||
* [telnet](https://en.wikipedia.org/wiki/Telnet)
|
||
|
||
But today we **don't** use those anymore!
|
||
We use [ssh](https://en.wikipedia.org/wiki/Secure_Shell) now!
|
||
|
||
## SSH and SFTP
|
||
|
||
# Bandit
|
||
|