In this lesson,
you're going to learn how to create accounts for users
and if necessary, modify and delete user accounts as well.
In order to create user accounts
and configure basic settings,
you're going to need to use the useradd command
and you do this by entering useradd,
the options, and then the username.
As part of the account creation process,
useradd is going to reference several different files.
The account is going to be stored in the /etc/passwd file.
It's configured according to various options
set in the /etc/login.defs file.
The user's home directory is going to be created
at the /home/ account name directory
and populate using files from the /etc/skel
or skeleton directory.
Note the useradd command
does not set the password for the account,
which means the user account exists
but it's not usable yet.
The useradd command is going to feature many different options
that you can use to customize your user accounts.
The first option is -c.
This sets the comment field as typically used
as the field for the full name of the user.
The -e option is going to set the account expiration date.
For example, if I added in useradd -e 2021/12/31,
it's going to create a user account
that would expire at the end of 2021.
The -s option is going to be used
to set the default shell of that user.
For example, I can use useradd -s /bin/ksh
if I wanted to set the corn shell as the user's default
instead of using the Bash shell.
The last option we can use is the -D option.
And this allows you to view
the default configurations for new users
that would be created using the useradd command.
After you create the account with the useradd command,
you can set an initial password for that user.
The passwd command is going to be used by the root user
to set or reset a password for any user on the system.
Now, a user can also use the passwd command themselves
if they want to reset their own password.
When a user sets or changes his password,
the screen will not show any output
because Linux is hiding the number of characters
that are being used in the password
as a way to add some additional security.
Some newbie users might mistake this for a problem
but it's actually just doing what it was designed to do.
All the user passwords
used to be stored in a file called /etc/passwd
and system administrators usually will refer to this file
when they want to learn about specific user accounts
on a system.
But this file doesn't actually store the passwords anymore
because it was a security issue.
Instead, it's going to contain
seven fields worth of information.
Each field is going to be separated by a colon,
but not all fields are required to be populated.
Several of them are optional.
These seven fields are going to include things
like the username, the password, user ID, group ID,
comment, home directory, and login shell.
The username contains the name
that the user is going to log into the system with
and the password contains the assigned password to that user
and it's usually going to be represented by an X
because again, we're not storing the password
in this file anymore because of security reasons.
The reason for this is that this password file
is stored in plain text,
so anybody can read it and see it
and that'd be really bad if your password was there.
Now, the user ID is our next field.
This contains a unique number
that represents the user to that system
and we're also going to have a group ID
that contains a unique number
that indicates the user's primary group membership.
After that, we have a comment field.
The comment typically is going to have
the full name of the user
but you can really store whatever you want in there.
Then we have the home directory
that contains the absolute path
to the home directory of that user.
Finally, we have the login shell
and this contains the path to the shell
that's going to be launched when the user logs in.
This can be /bin/bash, which is what it is by default,
or /bin/ksh or something else like that.
Now the proper way to edit the /etc/passwd file
is to do this through the useradd,
usermod, or userdel commands.
Manual editing of this file may result in mistakes
that could render the system unstable.
The /etc/passwd file was once used to store
the cryptographically hash version of the password.
But as I said, that is no longer done
because it's a poor security practice.
This is because any user can actually see the hash version
of that user's password
if they were logged in and looked at the /etc/passwd file.
Then by entering that hash password
into a password cracking program,
you could discover another user's password.
So we've now moved those passwords
into a different file known as /etc/shadow.
The shadow file is the modern storage location
for all of our hash passwords.
And it also contains additional account information.
This additional information
includes the password requirements
and expiration information.
Only the root user
has access to the content of the /etc/shadow file.
This prevents other regular users
from attempting to crack each other's passwords.
Now this shadow file
contains seven fields of information too.
It includes the username, the password in a hash format,
the days since the password was changed,
the days before the password must be changed,
and this is normally set to one day,
days until the user is warned to change their password
and this typically has a value of 99999,
which means the password never needs to be changed.
The number of days after the password expires
that the account is disabled,
the number of days the account has been disabled
and lastly, an unused field
that is reserved for future potential use.
So as you can see, there are two main files
that may contain a lot of our user information,
the password file and the shadow file.
It's important to understand what they both look like.