1 00:00:00,240 --> 00:00:01,260 In this lesson, 2 00:00:01,260 --> 00:00:03,870 you're going to learn how to create accounts for users 3 00:00:03,870 --> 00:00:07,710 and if necessary, modify and delete user accounts as well. 4 00:00:07,710 --> 00:00:09,150 In order to create user accounts 5 00:00:09,150 --> 00:00:10,770 and configure basic settings, 6 00:00:10,770 --> 00:00:13,290 you're going to need to use the useradd command 7 00:00:13,290 --> 00:00:15,720 and you do this by entering useradd, 8 00:00:15,720 --> 00:00:18,090 the options, and then the username. 9 00:00:18,090 --> 00:00:20,190 As part of the account creation process, 10 00:00:20,190 --> 00:00:23,010 useradd is going to reference several different files. 11 00:00:23,010 --> 00:00:27,030 The account is going to be stored in the /etc/passwd file. 12 00:00:27,030 --> 00:00:29,040 It's configured according to various options 13 00:00:29,040 --> 00:00:33,240 set in the /etc/login.defs file. 14 00:00:33,240 --> 00:00:35,130 The user's home directory is going to be created 15 00:00:35,130 --> 00:00:38,070 at the /home/ account name directory 16 00:00:38,070 --> 00:00:42,150 and populate using files from the /etc/skel 17 00:00:42,150 --> 00:00:43,860 or skeleton directory. 18 00:00:43,860 --> 00:00:45,390 Note the useradd command 19 00:00:45,390 --> 00:00:47,850 does not set the password for the account, 20 00:00:47,850 --> 00:00:49,470 which means the user account exists 21 00:00:49,470 --> 00:00:51,480 but it's not usable yet. 22 00:00:51,480 --> 00:00:54,480 The useradd command is going to feature many different options 23 00:00:54,480 --> 00:00:57,120 that you can use to customize your user accounts. 24 00:00:57,120 --> 00:00:59,430 The first option is -c. 25 00:00:59,430 --> 00:01:01,770 This sets the comment field as typically used 26 00:01:01,770 --> 00:01:04,080 as the field for the full name of the user. 27 00:01:04,080 --> 00:01:07,530 The -e option is going to set the account expiration date. 28 00:01:07,530 --> 00:01:12,530 For example, if I added in useradd -e 2021/12/31, 29 00:01:14,580 --> 00:01:16,110 it's going to create a user account 30 00:01:16,110 --> 00:01:18,870 that would expire at the end of 2021. 31 00:01:18,870 --> 00:01:20,850 The -s option is going to be used 32 00:01:20,850 --> 00:01:23,250 to set the default shell of that user. 33 00:01:23,250 --> 00:01:27,750 For example, I can use useradd -s /bin/ksh 34 00:01:28,920 --> 00:01:31,590 if I wanted to set the corn shell as the user's default 35 00:01:31,590 --> 00:01:33,600 instead of using the Bash shell. 36 00:01:33,600 --> 00:01:37,290 The last option we can use is the -D option. 37 00:01:37,290 --> 00:01:38,280 And this allows you to view 38 00:01:38,280 --> 00:01:40,530 the default configurations for new users 39 00:01:40,530 --> 00:01:43,650 that would be created using the useradd command. 40 00:01:43,650 --> 00:01:46,110 After you create the account with the useradd command, 41 00:01:46,110 --> 00:01:48,900 you can set an initial password for that user. 42 00:01:48,900 --> 00:01:51,750 The passwd command is going to be used by the root user 43 00:01:51,750 --> 00:01:55,530 to set or reset a password for any user on the system. 44 00:01:55,530 --> 00:01:58,350 Now, a user can also use the passwd command themselves 45 00:01:58,350 --> 00:02:00,720 if they want to reset their own password. 46 00:02:00,720 --> 00:02:02,970 When a user sets or changes his password, 47 00:02:02,970 --> 00:02:04,710 the screen will not show any output 48 00:02:04,710 --> 00:02:06,810 because Linux is hiding the number of characters 49 00:02:06,810 --> 00:02:08,490 that are being used in the password 50 00:02:08,490 --> 00:02:10,800 as a way to add some additional security. 51 00:02:10,800 --> 00:02:13,560 Some newbie users might mistake this for a problem 52 00:02:13,560 --> 00:02:16,260 but it's actually just doing what it was designed to do. 53 00:02:16,260 --> 00:02:17,550 All the user passwords 54 00:02:17,550 --> 00:02:20,740 used to be stored in a file called /etc/passwd 55 00:02:21,780 --> 00:02:24,450 and system administrators usually will refer to this file 56 00:02:24,450 --> 00:02:26,310 when they want to learn about specific user accounts 57 00:02:26,310 --> 00:02:27,480 on a system. 58 00:02:27,480 --> 00:02:30,810 But this file doesn't actually store the passwords anymore 59 00:02:30,810 --> 00:02:32,700 because it was a security issue. 60 00:02:32,700 --> 00:02:34,020 Instead, it's going to contain 61 00:02:34,020 --> 00:02:36,120 seven fields worth of information. 62 00:02:36,120 --> 00:02:38,370 Each field is going to be separated by a colon, 63 00:02:38,370 --> 00:02:40,830 but not all fields are required to be populated. 64 00:02:40,830 --> 00:02:42,570 Several of them are optional. 65 00:02:42,570 --> 00:02:44,550 These seven fields are going to include things 66 00:02:44,550 --> 00:02:48,960 like the username, the password, user ID, group ID, 67 00:02:48,960 --> 00:02:52,380 comment, home directory, and login shell. 68 00:02:52,380 --> 00:02:53,583 The username contains the name 69 00:02:53,583 --> 00:02:56,100 that the user is going to log into the system with 70 00:02:56,100 --> 00:02:59,430 and the password contains the assigned password to that user 71 00:02:59,430 --> 00:03:01,560 and it's usually going to be represented by an X 72 00:03:01,560 --> 00:03:03,720 because again, we're not storing the password 73 00:03:03,720 --> 00:03:06,960 in this file anymore because of security reasons. 74 00:03:06,960 --> 00:03:09,090 The reason for this is that this password file 75 00:03:09,090 --> 00:03:10,590 is stored in plain text, 76 00:03:10,590 --> 00:03:12,540 so anybody can read it and see it 77 00:03:12,540 --> 00:03:14,970 and that'd be really bad if your password was there. 78 00:03:14,970 --> 00:03:17,340 Now, the user ID is our next field. 79 00:03:17,340 --> 00:03:18,780 This contains a unique number 80 00:03:18,780 --> 00:03:21,270 that represents the user to that system 81 00:03:21,270 --> 00:03:23,100 and we're also going to have a group ID 82 00:03:23,100 --> 00:03:24,450 that contains a unique number 83 00:03:24,450 --> 00:03:27,210 that indicates the user's primary group membership. 84 00:03:27,210 --> 00:03:29,280 After that, we have a comment field. 85 00:03:29,280 --> 00:03:30,690 The comment typically is going to have 86 00:03:30,690 --> 00:03:32,010 the full name of the user 87 00:03:32,010 --> 00:03:34,260 but you can really store whatever you want in there. 88 00:03:34,260 --> 00:03:35,910 Then we have the home directory 89 00:03:35,910 --> 00:03:37,230 that contains the absolute path 90 00:03:37,230 --> 00:03:39,420 to the home directory of that user. 91 00:03:39,420 --> 00:03:41,400 Finally, we have the login shell 92 00:03:41,400 --> 00:03:43,140 and this contains the path to the shell 93 00:03:43,140 --> 00:03:45,300 that's going to be launched when the user logs in. 94 00:03:45,300 --> 00:03:48,720 This can be /bin/bash, which is what it is by default, 95 00:03:48,720 --> 00:03:52,500 or /bin/ksh or something else like that. 96 00:03:52,500 --> 00:03:55,740 Now the proper way to edit the /etc/passwd file 97 00:03:55,740 --> 00:03:57,810 is to do this through the useradd, 98 00:03:57,810 --> 00:03:59,970 usermod, or userdel commands. 99 00:03:59,970 --> 00:04:02,760 Manual editing of this file may result in mistakes 100 00:04:02,760 --> 00:04:05,130 that could render the system unstable. 101 00:04:05,130 --> 00:04:08,190 The /etc/passwd file was once used to store 102 00:04:08,190 --> 00:04:10,620 the cryptographically hash version of the password. 103 00:04:10,620 --> 00:04:13,050 But as I said, that is no longer done 104 00:04:13,050 --> 00:04:15,420 because it's a poor security practice. 105 00:04:15,420 --> 00:04:18,029 This is because any user can actually see the hash version 106 00:04:18,029 --> 00:04:19,440 of that user's password 107 00:04:19,440 --> 00:04:23,430 if they were logged in and looked at the /etc/passwd file. 108 00:04:23,430 --> 00:04:25,530 Then by entering that hash password 109 00:04:25,530 --> 00:04:27,420 into a password cracking program, 110 00:04:27,420 --> 00:04:29,880 you could discover another user's password. 111 00:04:29,880 --> 00:04:31,620 So we've now moved those passwords 112 00:04:31,620 --> 00:04:35,910 into a different file known as /etc/shadow. 113 00:04:35,910 --> 00:04:38,310 The shadow file is the modern storage location 114 00:04:38,310 --> 00:04:40,200 for all of our hash passwords. 115 00:04:40,200 --> 00:04:43,320 And it also contains additional account information. 116 00:04:43,320 --> 00:04:44,760 This additional information 117 00:04:44,760 --> 00:04:46,320 includes the password requirements 118 00:04:46,320 --> 00:04:48,150 and expiration information. 119 00:04:48,150 --> 00:04:49,110 Only the root user 120 00:04:49,110 --> 00:04:53,100 has access to the content of the /etc/shadow file. 121 00:04:53,100 --> 00:04:54,930 This prevents other regular users 122 00:04:54,930 --> 00:04:57,480 from attempting to crack each other's passwords. 123 00:04:57,480 --> 00:04:58,800 Now this shadow file 124 00:04:58,800 --> 00:05:01,200 contains seven fields of information too. 125 00:05:01,200 --> 00:05:04,860 It includes the username, the password in a hash format, 126 00:05:04,860 --> 00:05:07,050 the days since the password was changed, 127 00:05:07,050 --> 00:05:09,180 the days before the password must be changed, 128 00:05:09,180 --> 00:05:11,190 and this is normally set to one day, 129 00:05:11,190 --> 00:05:13,830 days until the user is warned to change their password 130 00:05:13,830 --> 00:05:17,010 and this typically has a value of 99999, 131 00:05:17,010 --> 00:05:19,530 which means the password never needs to be changed. 132 00:05:19,530 --> 00:05:21,570 The number of days after the password expires 133 00:05:21,570 --> 00:05:23,040 that the account is disabled, 134 00:05:23,040 --> 00:05:25,440 the number of days the account has been disabled 135 00:05:25,440 --> 00:05:26,943 and lastly, an unused field 136 00:05:26,943 --> 00:05:29,730 that is reserved for future potential use. 137 00:05:29,730 --> 00:05:31,920 So as you can see, there are two main files 138 00:05:31,920 --> 00:05:34,350 that may contain a lot of our user information, 139 00:05:34,350 --> 00:05:36,570 the password file and the shadow file. 140 00:05:36,570 --> 00:05:39,263 It's important to understand what they both look like.