Now, let's look at how to create delete and modify local user accounts. In Linux.
Each person that needs to log into our Linux
server should have their own separate user account.
This allows them to have personal files
and directories protected by proper permissions.
They also get to choose their own settings for whatever tools they use.
And it also helps us as administrators,
we can limit the privileges of each user based on what they require to do their job
where John can be replaced with whatever username
we want to choose for this specific account.
We'll be prompted to choose a password for
this user and then repeat the same password.
Then we can type in some user information like the full name of this user,
a phone number and so on.
Usually we'll just press enter in those fields to skip, adding such information.
And at the end, you'll have to type y to confirm that the information is correct.
And we want to create the user
after we run this, the following things happen.
A new user called John is added to the system.
A new group also called John is automatically created
the group John will be set to the primary group of the user. John. A
home directory is created for this account at slash home slash John.
This is where John can store his personal
files and subdirectories plus his program settings.
Their default shell will be sent to the program found at slash bin slash bash.
Whenever John logs in this is the application he'll be dropped into
effectively.
His entire login session will run inside this app and all files from Etsy
skill will be copied into the user's home directory slash home slash John.
You can explore it with LS dash A
slash
Etsy slash SKELL. If you're curious to see what's inside,
we'll see why this so called skeleton directory is useful in
one of the next lessons and the account will never expire.
We'll see what that means later in this lesson.
Ok. At this point, we have an account for John.
But how does he log in
his account? Has no password now.
But if we're certain those files aren't necessary anymore,
we can make the Dell user command also remove the user's home
directory and his or her mail spool with the following command.
Now, coming back to the adduser command, if we're not happy with the defaults,
we could choose a different shell and home directory with a command such as this.
Of course, if we only want to choose a different shell,
but keep the default location for the home directory,
we can just pass the shell option and omit the home directory option.
Now, these account details such as usernames, user I DS group,
I DS preferred shells and home directories are all stored at Etsy pass WD.
And we can see them if we type in something like cat
Etsy pass WD,
we'll see a line like this.
The first number 1001
is the ID number associated with John's username.
The next 1001 is a numeric idea of his primary group, also called John in this case.
And then we can see the home directory and the preferred login shell.
Now add user will automatically select a proper numeric D available incrementally
for the first user. The id will be 1000
for the next 1001 and so on.
If we want to manually select a different ID, we can use a command such as this,
the user Smith will have the numeric ID 1100 but also
the group called Smith will get a numeric id of 1100.
If we want to see what username and group owns files or directories,
we can do so with the usual LS dash L.
But if we want to see the numeric id of the user and group owners,
we can add the dash N option.
It might also be useful sometimes to find out
more about the user we're currently logged in as
we can see the username,
we're logged in as plus groups or members
of alongside with respective ids with this command
to just print out the username,
we type in who am I
up until now. We've created user accounts.
But there's another type we can create called system accounts
to create a system account called CIS AC C.
We just add the dash dash system option.
Also notice that we added the no create home option to
tell our command not to create a home directory.
Since system accounts don't usually need these.
The numeric ids of system accounts are usually numbers smaller than 1000.
So we might see an id like 114 or 115 for our
S AC C account. But why would we create these?
Well, user accounts are intended for people.
System accounts are intended for programs.
Usually daemons use system accounts.
We might see something like a database server daemon running under a system account
in case you're following along with these commands inside a virtual machine,
remove the two user accounts that we previously created.
Remember if we ever forget the options for the adduser command,
we can get a quick reminder with
add user dash dash help. Now let's say we create the user john again.
But later we decide that we want to change some details for this account.
The command usermod or user modify is used for this purpose
would be this.
Now the dash dash move home option ensures that
the old directory will be moved or renamed.
So that John can still access his old files.
In our case slash home slash John was renamed to slash home slash other directory.
This effectively disables the account,
but without deleting it,
the user will not be able to log in with his or her password anymore.
However, they might still be able to log in with an SSH key.
If such a login method was previously set up,
we'll discuss SSH keys in a future lesson. Now to cancel this and unlock the account,
we would type in this
to set a date at which a user's account expires. We can use this
after expiration.
They won't be able to log in and we need
to contact a system administrator to reenable their account.
If we want to immediately set an account as expired,
we can just choose a date that's in the past
and you would use the date format, year, month day
now to remove the expiration date,
just specify an empty date,
use two quotes with nothing inside.
We can also set an expiration date on the password.
Please keep in mind that this is not the same as the account. Expiration
account. Expiration completely disables user logins,
password, expiration forces the user to change their password.
The next time they log in
there is a difference.
They can still use the account if we want to immediately set the password as expired,
we can enter this command.
Now, this word Chage stands for change age
the next time Jane logs in, she'll have to change her password.
If we want to cancel this, just un expire the password.
If we want to make sure that a user changes their password.
Once every 30 days, we can use this command.
If we want to make sure their password never expires. We set MAC days to negative one
to see when the account expires.
We would type in this.
Now, in case you followed along with this exercise on your virtual machine,
delete the user called Jane
and the group called John.