wA@As峹аѦB
nnJ Linux tΤ@wnbPKX~A_hnJAzOaHILA PϥΪӭn֦Pv~aHڭ٥iHzL user/group Sv]wA ӳWdXPsն}oMשOb Linux ҤUAڭ̥iHzLܦh觋ӭϥΪ̯ϥΪtθ귽A ]A bash shell `쪺 ulimit B٦SvAp umask C zLo|ʡAڭ̥iHWdXPϥΪ̪ϥθ귽Ct~AٰOotκ޲zbܡHI NO root Cаݤ@UAF root ~AO_iHLtκ޲zbH janɶqקKϥμƦrAbHpקϥΪ̬TOHoǧڭ̳onAAѪI

1. Linux bPs
@@1.1 ϥΪѧOG UID P GID
@@1.2 ϥΪ̱bG/etc/passwd, /etc/shadow
@@1.3 sG ĻPlsB groups, newgrp
2. b޲zG
@@2.1 sWPϥΪG useradd, ]w, passwd, usermod, userdel
@@2.2 ϥΪ̥\Gchsh, chfn, finger, id
@@2.3 sWPsGgroupadd, groupmod, groupdel, gpasswd, newgrp
@@2.4 KX޲zG passwd
3. ϥΪ̨G
@@3.1 su
@@3.2 sudo, visudo (/etc/sudoers)
4. ϥΪ̪S shell P PAM Ҳ
@@4.1 S shell A /sbin/nologin
@@4.2 PAM ҲաG /etc/nologin, /etc/securetty, /etc/security/*
5. Linux tΤWϥΪ̪ͻP mail ϥΡG
@@4.1 dߨϥΪ̡G w, who, last, lastlog
@@4.2 ϥΪ̹͡G talk, mesg, wall
@@4.3 ϥΪ̶lHcG mail
6. ʷsWϥΪ̡G
@@5.1 @ˬduGpwck, pwconv, pwunconv, chpasswd
@@5.2 SbAp¼ƦrbإߡG
@@5.3 }׺ݾnJb (ex>mail acccount)
@@5.4 @ӤjqظmbdҡG
7. Dm
8. w糧媺ijGhttp://phorum.vbird.org/viewtopic.php?t=23887

Linux bPs
޲zu@A۷n@NOy޲zbzաI]ӨtγOAb޲zA åBҦ@Τ᪺ӽСAnzLAU~IҥHANnAѤ@Up޲zn@Ӻb޲zաI b޲z Linux DbɡAڭ̥AѤ@U Linux 쩳OpOC@ӨϥΪ̪I


ϥΪѧOG UID P GID
Mڭ̵nJ Linux DɭԡAJOڭ̪bAOA Linux Dä|{ѧAybW١zALȻ{ ID ڡID NO@ոXա DƦrAbuOFḪeOЦӤwC ӱz ID PbNb /etc/passwd C
pGAgH tarball w˹Ln骺ܡAӤo{AbY᪺ɮסA ɮ׾֦̳MOyƦrzH_ǧaHoSn_ǪA] Linux bܡALuu{ѥNAXӤwI 쩳X ID OHٰOoڭ̦byɮݩʻPؿtmz @g峹ɭԦC@ɮ׳㦳y֦HP֦sաzݩʶܡH SաCӵnJϥΪ̦ܤֳ|o ID A@ӬOϥΪ ID (User ID A² UID)B @ӬOs ID (Group ID A² GID)C

ɮצpPOL֦̻PsթOHNOQ UID P GID աI C@ɮ׳|ҿת֦ ID P֦s ID AYO UID P GID AMtη|̾ /etc/passwd eAhNɮת֦̻PsզW١A ϥαbΦӨqXӡIڭ̥iH@ӤpAAiHH root vi /etc/passwd AMNA@먭ϥΪ̪ ID HK@ӸXA MAA@먭ؿUݬݭӱb֦ɮסAA|o{ɮת֦HܦF yƦrFzIo˥iHzѤFܡH
[root@linux ~]# vi /etc/passwd
.....(eٲ).....
dmtsai:x:501:501::/home/dmtsai:/bin/bash  <==N쥻 501:501 令 3000:501

[root@linux ~]# ls -ld /home/
drwxr-xr-x   3   501 dmtsai 4096 Aug 30 10:37 dmtsai
# @Io̴NDAɮװOO UID ա
A@wnAѪOAWҤlȬOb UID PbʡA b@`B@ Linux DҤUAWʧ@iHKiA oO]tΤWwgܦhƦbBFAHNקtΤWYDZb UID ܥi|ɭPYǵ{ǵLkiAoNɭPtεLkQB@GC ]vDڡIҥHAAѤFAл֦^ /etc/passwd ̭ANƦr^ӳI

  • pnJ Linux o UID/GID
  • nFAڭ̦Aӽͤ@͡A쩳ڭ̬O˵nJ Linux DOH]աIڭ̦bDeΪ̬OH telnet Ϊ ssh nJDɡAtη|X{@ login eAJbAoӮɭԷAJbPKXA Linux |G
    1. M /etc/passwd ̭O_oӱbHpGShXApGܫhNӱb UID ( User ID )P GID ( Group ID )ŪXӡAt~AӱbaؿP shell ]w]@ŪXF
    2. AӫhOֹKXաIo Linux |iJ /etc/shadow ̭XbP UIDAMֹ@UAJKXPYKXO_۲šH
    3. pG@ OK ܡANiJ Shell ުqoI
    jPWpNoˡAҥHOAAnnJA Linux DɭԡA /etc/passwd P /etc/shadow NntŪաA]o]Oܦh̷|NSbg /etc/passwd YhtGI^ҥHOApGAnƥ Linux tΪbܡA oɮ״N@wݭnƥ~I

    ϥΪ̱bG/etc/passwd, /etc/shadow
    ѤWzjwgDAKKIb޲z̭nɮ״NOy /etc/passwd P /etc/shadow zFIoɮץiHO Linux Y̭nɮפ@FI pGSoɮתܡAIziOLknJ Linux IҥHAUڭ̥woɮרӶi满C MoAԲӪƱziHۦ man 5 passwd man 5 shadow ա


  • /etc/passwd
  • oɮתcyOo˪GC@泣N@ӱbA XNNXӱbbAtΤILݭnSOdNOA YܦhbӴNOtΤnAڭ̥iH²٥LtαbA Ҧp bin, daemon, adm, nobody AoDZbOtΥ`B@ɩһݭnAФnHNLOI oɮתeIoˡG
    root:x:0:0:root:/root:/bin/bash
    bin:x:1:1:bin:/bin:/sbin/nologin
    daemon:x:2:2:daemon:/sbin:/sbin/nologin
    adm:x:3:4:adm:/var/adm:/sbin/nologin
    
    ڭ̥Ӭݤ@UC Linux tγ|Ĥ@ANO root oӨtκ޲z@nFA AiH㪺ݥXӡAC@ϥΡy:zj}A@CөNNAOOG
    1. bWGNObWٰաI UID ΪIҦp root NOw]tκ޲zbW١F

    2. KXG Unix tΪKXOboɮפA O]oɮתSʬOҦ{dzŪAҥHAoˤ@ӫܮeyƪQѨA ]ӴNNo쪺KXƵL /etc/shadow FA /etc/shadow o@@UACӳo̧A|ݨ@ x AIOߡAoܱKXwgQʨ shadow oӥ[KL᪺ɮoF

    3. UIDGoӴNOϥΪѧOX (ID) oIq` Linux UID XӭݭnzAѤ@UG
    4. id d ID ϥΪ̯S
      0 UID O 0 ɡANoӱbOytκ޲zzIҥHAn@t@Өtκ޲zbɡA AiHNӱb UID 令 0 YiFo]NOA@tΤWtκ޲zou root I LAܫijhӱb UID O 0 ա
      1~499OdtΨϥΪ IDA 1~65534 bèSPA ]NOF 0 ~AL UID èS@Aw] 500 HUtΧ@OdbuO@ӲߺDCo˪nBOAHW DNS AҰʪAȡy named zҡAoӵ{w]ҦH named b UID O 25 ALbPˬO 25 ɡAܥi|ytΪ@ǤpDIFo˪DAijOd 500 He UID tΧaI
      LA@ӻA 1~99 |Odtιw]bAt~ 100~499 hOd@ǪAȨӨϥΡC
      500~65535@ϥΪ̥ΪCƹWAثe linux ֤ (2.6.x )wgiH䴩 4294967295 (2^32-1) oj UID XI

      Wo˻iHAѤFܡHOA UID 0 ɭԡANO root IҥHЯSOdN@UA /etc/passwd ɮסI

    5. GIDGoӻP /etc/group I /etc/group [P /etc/passwd thAuOLOΨӳWd group ӤwI

    6. ϥΪ̸TGo򥻤WèS򭫭nγ~A uOΨӸoӱbNqӤwILApGzѨϥ finger \ɡA oiHѫܦhTOIU chfn iH@UoI

    7. aؿGoOϥΪ̪aؿAHWҡA root aؿb /root AҥH root nJAN|ߨ] /root YաII pGAӱbϥΪŶSOjAAQnNӱbaؿʨLwХhA SIiHbo̶iקIw]ϥΪ̮aؿb /home/yourIDname

    8. ShellGҿת shell OΨӷqHUFOPw𫗪uʧ@ɭIڭ̳q`ϥ /bin/bash o shell ӶiOUFIKKIo{FaHڭ̦b bash `̭ܦhAnJ Linux ɬw]O bash OHNOo̳]wա o̤ݭn`NOA@ shell iHΨӴNbLknJOINO /sbin/nologin oӪFIo]iHΨӻs@ pop lb̪ƩOI

  • /etc/shadow
  • WAѩCӵ{dzݭno uid P gid ӧP_vDAҥHA /etc/passwd vn]w -rw-r--r-- o˪vAbo˪pUA ϥΪ̪KXNHiHݨܡHYϳoɮפKXO[KA a߸zBͤ]iQμɤO}Ѫkh try and error XzKX......

    ]o˪YAҥHӵoiXNKXʨ /etc/shadow oɮפj}Ӫ޳NA ӥB٥[JܦhKXѼƦb /etc/shadow YOIڭ̥AѤ@UoɮתcyaI ڪ /etc/shadow ɮצIoˡG
    root:$1$i9Ejldjfjio389u9sjl$jljsoi45QE/:12959:0:99999:7:::
    bin:*:12959:0:99999:7:::
    daemon:*:12959:0:99999:7:::
    adm:*:12959:0:99999:7:::
    
    򥻤WA shadow P˥Hy:z@jŸApGƤ@ơA|o{@EڡA oE쪺γ~Oo˪G
    1. bWGѩKX]ݭnPbڡ]A oɮתĤ@NObAnP /etc/passwd ۦP~I

    2. KXGoӤ~OuKXAӥBO gLsXLKXաI Au|ݨ즳@ǯSŸrNOFIݭnSOdNOA Moǥ[KLKXQѥXӡAOyzy|zAҥHA oɮתw]ݩʬOy-rw-------zΪ̬Oy-r--------zAYu root ~iHŪgNOFIAoHɪ`NAnpߧʤFoɮתݩʩOIt~A pGObKX檺Ĥ@Ӧry * zΪ̬Oy ! zAܳoӱbä|QΨӵnJNC ҥHU@@ѧAYӨϥΪ̤ĮɡAiHboɮפANLKX쪺̫eh[@ * IKKILNLkϥθӱboILܨĤFAALҥΰڡI

    3. ̪ʱKXGoOFyʱKX@ѡzA LAܩ_ǧrIbڪҤl|O 12959 OHAoӬO]p Linux ɶOH 1970 ~ 1 1 @ 1 A 1971 ~ 1 1 h 366 աI ҥHoӤO֥[OIo`N@UoӸI̪ 2005 ~ 1 1 NO 12784 աAAѤFܡH

    4. KXiQʪѼG ĥ|OFoӱbKXݭngLXѤ~iHQܧIpGO 0 ܡA ܱKXHɥiHʪNCoOFȱKXQYǤH@Aӳ]pIpG]w 20 ѪܡAA]wFKXA 20 ѤLkܳoӱKXI

    5. KXݭnsܧ󪺤ѼG ѩ`ȱKXQYǡyߤHhzѨӦM`ӨtΪwAҥHFo쪺]pC AnboӮɶs]wAKXA_hoӱbN|ȮɥC ӦpGW 99999 ܡANܡAAKXݭnsJաI LApGOFwʡA̦niH]w@qɶAYnDϥΪܧKXOI

    6. KXݭnܧeĵiGbKXĴ֭n쪺ɭԡA NOWӡyܧKXzӮɶɡA tη|̾ڳo쪺]wAoXyĵiz׵oӱbALyAL n ѧAKXNnĤFAкɧ֭s]wAKXIzApWҤlAhOKXe 7 ѤAtη|ĵiӥΤC

    7. KXLɶGpGΤLFĵiSsJKXA ϱoKXĤFA]NOAAbyܧKXeAèSܧAKXIz ӲձKXN٬yĪKXzoHSYA٦o쪺ѼƳ]pڡ NNOAKXīAA٥iHγoӱKXb n ѤinJNC ӦpGboӤѼƫ٬OSܧKXAIzbNĤFILknJI

    8. GoӤĤT@ˡAOϥ 1970 ~HӪ`Ƴ]wCoܡG oӱbbWwANLkAϥC o|Qϥγq`ӬObyOAȡztΤA AiHWw@ӤӱbAϥΰաI

    9. OdG̫@OOdAݥHᦳSs\[JC
    |ӨҤlӻnFApڪ dmtsai oӨϥΪ̪KXpUҥܡG
    dmtsai:$1$8zdAKdfC$XDa8eSus2I7nQL7UjRsIy/:13025:5:60:7:2:13125:
    
    oܤOHn`NOA 13025 O 2005/08/30 AҥHA dmtsai oӨϥΪ̥LKXNqOG
    • ̪@ʱKXO 2005/08/30 (13025)F
    • קKXɶO 5 ѥHA]NO 2005/09/04 He dmtsai קۤvKXF pGϥΪ٬OխnʦۤvKXAtδN|X{o˪TG
      You must wait longer to change your password
      passwd: Authentication token manipulation error
      
    • ϥΪ̥nb 2005/09/04 2005/10/29 60 ѭhקۤvKXAY 2005/10/29 ٬OSܧKXɡAӱbN|ŧiġF
    • pGϥΪ̤@SKXAb 2005/10/29 e 7 ѤAtη|ĵi dmtsai ӭקKXTFҦp dmtsai nJɡAtη|DʴܦpUTG
      Warning: your password will expire in 5 days
      
    • pGӱb@ 2005/10/29 SKXAѩ٦ѪɶA]A dmtsai ٬OiHb 2005/10/31 He~nJF
    • pGϥΪ̦b 2005/10/29 HeܧLKXA򨺭 13025 N|ۧܡA]A Ҧ]|۬۹ܰʳI^_^
    • LרϥΪ̦pʧ@AF 13125 AjO 2005/12/8 kAӱbNĤF
    zLo˪Azӷ|ezѤFaHI ^_^ ``ťGڪKXѰOΪ̳QʤFHH

    ɭԷ|oͳo˪pANOAA root KXѰOFInHsw˶ܡHt~A ɭԬOQJIFA root KXQʹLAӦpOnH

    oӮɭԴNnϥΨ /etc/shadow oӸƤFIڭ̭訚DKXOsboɮפA ҥHunAHUإi檺k}iJ Linux AҦpH@ҦAΪ̬OH live CD (KNOPPIX) ӶiJ Linux tΡCANwжQAMiJ /etc/shadow oɮפAN root KXo@MšIMAnJ Linux @AoӮɭ root NݭnKX (ɭԻݭnJťզr) NiHnJFIoӮɭԽл֥H passwd ]w root KXYiC

    sաG ĻPlsաBgroups, newgrp
    {ѤFbɮ /etc/passwd P /etc/shadow Azγ\٬O|ıo_ǡA sժ]wɦb̡H٦Ab /etc/passwd ĥ|椣Oҿת GID ܡHSOԣH 㦹ɴNݭnA /etc/group P /etc/gshadow o


  • /etc/group
  • oɮ״NObO GID PsզW٪Fڪ /etc/group eIoˡG
    root:x:0:root
    bin:x:1:root,bin,daemon
    daemon:x:2:root,bin,daemon
    sys:x:3:root,bin,adm
    
    ]OH_y:z@쪺jŸA@|AC@쪺NqOG
    1. sզWGNOsզWٰաI

    2. sձKXGq`ݭn]wA]ڭ̫ܤ֨ϥΨsյnJI LAP˪AKX]OQb /etc/gshadow oI

    3. GIDGNOsժ ID ڡ

    4. 䴩bWG[JoӸsո̭ҦbA ڭ̪DA@ӨϥΪ̬OiH[JhӸsժC|ҨӻApGڷQn dmtsai ][J root oӸsաAbĤ@檺̫᭱[Wy,dmtsaizA`NnŮA Ϧy root:x:0:root,dmtsaizNiHo
    nSbĥ|աA]CӨϥΪ̳iH֦hӤ䴩sաA oNnbǮհѪɭԡAڭ̥iH[JhӪΤ@ˡI ^_^C Lo̱zγ\|ıo_ǪANOGypڦPɥ[JhӸsաA ڦb@~ɭԡA쩳OHӸsլǡHzUڭ̴Nӽͤ@ͳoӡyĸsաzC


  • ĸs(effective group)Pls(initial group)
  • ٰOoCӨϥΪ̦bL /etc/passwd ̭ĥ|榳ҿת GID aH GID NOҿתyls ( initial group ) zFI]NOAϥΪ̤@nJtΡAߨN֦oӸsժvNC |ҨӻAڭ̤W dmtsai oӨϥΪ̪ /etc/passwd P /etc/group ٦ /etc/gshadow epUG
    [root@linux ~]# grep dmtsai /etc/passwd /etc/group /etc/gshadow
    /etc/passwd:dmtsai:x:501:501::/home/dmtsai:/bin/bash
    /etc/group:users:x:100:dmtsai
    /etc/group:dmtsai:x:501:
    /etc/gshadow:users:::dmtsai
    /etc/gshadow:dmtsai:!::
    
    JӬݨWoӪAb /etc/passwd ̭Admtsai oӨϥΪ̩ݪsլ GID=501 A ]NO /etc/group Y dmtsai Ӹsհա]oO initial group AҥHA ϥΪ̤@nJN|DʨoAݭnb /etc/group ĥ|gJӱbI

    OD initial group LsեiNPFC|WoӨҤlӻAڱN dmtsai [J users oӸsշAѩ users oӸsըëDO dmtsai lsաA]A ڥnb /etc/group oɮפA users @AåBN dmtsai oӱb[Jĥ|A o dmtsai ~䴩 users oӸsհڡC

    boӨҤlA]ڪ dmtsai oӱbPɤ䴩 dmtsai P users oӸsաA ]AbŪ/gJ/ɮ׮ɡAwsճAunO users P dmtsai oӸsվ֦\A dmtsai oӨϥΪ̳֦IoAIHLAoOwwgsbɮצӨA pGѧڭnإߤ@ӷsɮשΪ̬OsؿAаݤ@UAsɮתsլO dmtsai ٬O users H IoNonˬd@UɪĸsդF (effective group)C

    pGڥH dmtsai oӨϥΪ̪nJAӦp󪾹DکҦ䴩sթOH ²ڡAJ groups NiHFI`NAO groups [ s OIGoˡG
    [dmtsai@linux ~]$ groups
    dmtsai users
    
    boӿXTAڪDڦPݩ dmtsai users oӨӸsաAӥBA Ĥ@ӿXsէYĸs (effective group) FC ]NOAڪĸsլ dmtsai ա㦹ɡApGڥH touch hإߤ@ӷsɡAҦpG touch test Aoɮת֦̬ dmtsai AӥBsդ]O dmtsai աC oˬO_iHAѤOĸsդFH

    pܧ󦳮ĸsթOHoӦӤkA׬OӤkAOH newgrp FI HWoӨҤlӻA]ڪ dmtsai ϥΪ̦Pɾ֦ dmtsai P users ӸsաA]A dmtsai MiHHɤ dmtsai/users ĸsoCҥHAڥiHUFG
    [dmtsai@linux ~]$ newgrp users
    [dmtsai@linux ~]$ groups
    users dmtsai
    
    ɡAڪĸsմN users FCMAnQĸsժܡAٻݭn /etc/gshadow U~oӵ@Uڭ̷|CnFApGA}lb /home/dmtsai oӮaؿUիإߤ@ɮסAҦpy touch test2 znFA|oͤ򪬺AOH IɮתsճMܦ users FIo˧MĸsժNqFaHI

    ڭB~ӰQפ@U newgrp oӫOAoӫOiHܧثeϥΪ̪ĸsաA ӥBOt~H@ shell ӴѵnJAҥHAHWҤlӻA dmtsai oӨϥΪ̥ثeOHt@ shell nJAӥBs shell dmtsai GID users NOFCy newgrp groupname zɡAϥΪ̪ĸsշ| groupname A MϥΪ̪ҳ]w(ҦpܼƵL)|vTAOϥΪ̪yvzN|sQpC |ҨӻA dmtsai ɫإߪsɮ׸sլO users F

    oӨҤlAn`NOA dmtsai oӨϥΪ̥ӴNݩ users P dmtsai oӸsաA ҥHLiHϥ newgrp ӤĸsաAӭn}sĸsծɡAJy exit zYiC ]ڪ Linux tη٦t@ӸsաAW٬ vbirdA dmtsai O_iHnJ vbird oӸsաH bYǫeUOiHG
    • vbird oӸsզb /etc/gshadow KX欰Xk(㦳 ! }YI)F
    • dmtsai root θsպ޲z (group administrator) [J vbird sդC
    oӤjeʤ@iInFA]ڤwgϥ gpasswd إߤF vbird oӸsժKXA dmtsai ]Q[JsզFA dmtsai J ynewgrp vbirdzɡA KKI dmtsai oӨϥΪ̪ĸsմNܦ vbird o

  • /etc/gshadow
  • FܦhyĸsաzAt~A] newgrp oӫOΪkA OApG /etc/gshadow oӳ]wSdoܡA newgrp OLkʧ@OI ڪ /etc/gshadow eIoˡG
    root:::root
    bin:::root,bin,daemon
    daemon:::root,bin,daemon
    sys:::root,bin,adm
    
    P٬OϥΫ_y:zӧ@쪺jrAӥBA|o{Aoɮ״XGP /etc/group @Ҥ@˰ڡIOo˨S㤣LAn`NjNOĤGaĤGOKXA pGKXWOy!zɡAܸӸsդϥαKXӵnJOI ܩĥ|]NO䴩bWo
    1. sզW
    2. KXAP˪A}Y ! ܵLknJF
    3. sպ޲zb (Tb򤶲)
    4. Ӹsժݱb (P /etc/group eۦPI)
    LANHtΪާ@ӻAƹWAo /etc/gshadow KXѡA̤j\Oby ǤbsդA{ɥ[JӸsեΪC z ڤWϥΪpOܤ֪ӦpGunާ@o˪ҡANonx newgrp ΪkoI ӥB٭nѬYӸsժKXXӡAuOn޲zCҥHAYuQnYӨϥΪ̧QθӸsժ\ɡA ٬ON[Jsժ䴩NnFIٱo·С

    b޲z
    nաIJMn޲zbAMOѷsWPϥΪ̶}lo㧐Uڭ̴NOӽͤ@ͦpsWB PϥΪ̪Ta


    sWPϥΪ̡G useradd, ]w, passwd, usermod, userdel
    npb Linux tηsW@ӨϥΪ̰ڡHuO²F㪽Q useradd oӫOYiI LOUFkpUG


  • useradd
  • [root@linux ~]# useradd [-u UID] [-g initial_group] [-G other_group] \
    >  -[Mm] [-c ] [-d home] [-s shell] username
    ѼơG
    -u  G᭱O UID AO@ռƦrCw@ӯSw UID oӱbF
    -g  G᭱ӸsզWٴNOڭ̤W쪺 initial group ա
           group ID (GID) |Qm /etc/passwd ĥ|줺C
    -G  G᭱sզW٫hOoӱb٥iH䴩sաC
          oӰѼƷ|ק /etc/group ƳI
    -M  GjInإߨϥΪ̮aؿ
    -m  GjInإߨϥΪ̮aؿI
    -c  GoӴNO /etc/passwd Ĥ檺eաiHHKڭ̳]wա
    -d  GwYӥؿaؿAӤnϥιw]ȡF
    -r  Gإߤ@ӨtΪbAoӱb UID | (/etc/login.defs)
    -s  G᭱@ shell Aw]O /bin/bash ա
    dҡG
    
    dҤ@GѦҹw]ȫإߤ@ӨϥΪ̡AW٬ vbird1
    [root@linux ~]# useradd vbird1
    [root@linux ~]# ls -l /home
    drwxr-xr-x   3 vbird1 vbird1 4096 Aug 30 17:33 vbird1
    [root@linux ~]# grep vbird1 /etc/passwd /etc/shadow /etc/group
    /etc/passwd:vbird1:x:502:502::/home/vbird1:/bin/bash
    /etc/shadow:vbird1:!!:13025:0:99999:7:::
    /etc/group:vbird1:x:502:
    # oӽdҥuOQnzAѡAtΤwgWdnF@ǷsWϥΪ̮ɪѼƤFI
    # ]Aڭ̨ϥ useradd ɡAtη|Dʪhק /etc/passwd P /etc/shadowA
    # ӳoɮפѦҭȡAh|H@dz]wɪeӳWdI
    # Pɤ]n`NAϥ useradd sWϥΪ̮ɡAoӨϥΪ̪ /etc/shadow
    # KX|OinJ (H !! }Y)A]ٻݭnϥ passwd 
    # ӵ vbird1 KXA~sWI
    
    dҤGGڪDڪtηӸsզW٬ users AB UID 700 äsbA
            ХγoӰѼƵ vbird2 إߤ@ӱbI
    [root@linux ~]# useradd -u 700 -g users vbird2
    [root@linux ~]# ls -l /home
    drwxr-xr-x   3 vbird2 users  4096 Aug 30 17:43 vbird2
    [root@linux ~]# grep vbird2 /etc/passwd /etc/shadow /etc/group
    /etc/passwd:vbird2:x:700:100::/home/vbird2:/bin/bash
    /etc/shadow:vbird2:!!:13025:0:99999:7:::
    # ݤ@UAUID P initial group Tܦڭ̻ݭnFI
    
    dҤTGإߤ@ӨtαbAW٬ vbird3
    [root@linux ~]# useradd -r vbird3
    [root@linux ~]# grep vbird3 /etc/passwd /etc/shadow /etc/group
    /etc/passwd:vbird3:x:101:102::/home/vbird3:/bin/bash
    /etc/shadow:vbird3:!!:13025::::::
    /etc/group:vbird3:x:102:
    # ܭnIz|o{A UID MO 101 A GID |O 102A
    # åBP /etc/group YIS[ -r tܦhI
    
    ڪѧoIoӫOʪɮ׫hڡHڡIA~Dڡ o]Oԣڭ̻b޲zOܽաӥBLѦҪ]wɤ~hI oӫOܤ֥i|ʨ쪺a観G
    • /etc/passwd
    • /etc/shadow
    • /etc/group
    • /etc/gshadow
    • /home/username
    бФ@UAzSQLAHWzĤ@ӽdҤ@nFA useradd vbird1 L|Dʦb /home/vbird1 إ߰_ϥΪ̪aؿHaؿƥBӦ̡ۭH w]ϥΪO /bin/bash o shell HIoNon@U useradd ҨϥΪѦɮoI


  • ]w
  • ڭ̨ϥ useradd hsWϥΪ̮ɡA@Ǧb /etc/passwd ȷ|hѦҡy /etc/default/useradd z AoɮתeIoˡG
    GROUP=100		<==w]s
    HOME=/home		<==w]aؿҦbؿ
    INACTIVE=-1		<==b /etc/shadow  7 
    EXPIRE=			<==b /etc/shadow  8 
    SHELL=/bin/bash		<==w] shell
    SKEL=/etc/skel		<==ϥΪ̮aؿeưѦҥؿ
    

    sժإ߾G

    ڭ̪ϥ useradd ӷsWbɡAbw]pUATOѦ /etc/default/useradd oɮפe]wCLAϥΪ̸sժإ߾A hؤ@˪sbG
    • H FC4 NAsبϥΪ̮ɡAYLw initial group A htη|Dʫإߤ@ӻPbۦPsզW١AHӸsէ@ϥΪ̪ initial groupF

    • H SuSE 9 NAsبϥΪ̮ɡAw]|إ߷ssաAӥH /etc/default/useradd GROUP ]wȧ@ϥΪ̪ initial group C
    oӬOܮezѤ~OpGݤAЦ^he@p`d\@U /etc/passwd, /etc/shadow e[cC

    ϥΪ̮aؿѦҡG/etc/skel/*

    boɮ׷A_ǪO SKEL oӪNFALOԣH AoөNNNOϥΪ̮aؿѦҥؿo|ڭ̪dҤ@ҡAڧQ useradd vbird1 ɡALb /home/vbird1 oӨϥΪ̮aؿUơAO /etc/skel ҽƻsLhҥHOAӦpGڷQnsWϥΪ̮ɡAӨϥΪ̪ܼ ~/.bashrc N]wܡAziH /etc/skel/.bashrc hs@UA]iHإ /etc/skel/public_html oӥؿA򥼨ӷsWϥΪ̫AbLaؿUN| public_html ӥؿFIoAIH

    ϥΪ UID/GID ]wG

    t~APKX٦ UID/GID ]wɫhOb /etc/login.defs ̭A oɮצIoˡG
    MAIL_DIR        /var/spool/mail	<==ϥΪ̹w]lHcmؿ
    
    PASS_MAX_DAYS   99999		<==/etc/shadow  5 
    PASS_MIN_DAYS   0		<==/etc/shadow  4 
    PASS_MIN_LEN    5		<==KX̵urסAijiH 6 HW
    PASS_WARN_AGE   7		<==/etc/shadow  6 
    
    UID_MIN         500	<==ϥΪ̳̤p UIDANYp 500  UID tΫOd
    UID_MAX       60000	<==ϥΪ̯Ϊ̤j UID
    GID_MIN         500	<==ϥΪ̦ۭqsժ̤p GIDAp 500 tΫOd
    GID_MAX       60000	<==ϥΪ̦ۭqsժ̤j GID
    
    CREATE_HOME     yes	<==b[ -M  -m ɡAO_DʫإߨϥΪ̮aؿH
    
    ݨoɮ׫AzӾoOAsتϥΪ̪ UID |j 500 FaH ӥBYǪ distributions (Ҧp SuSE server 9) hON UID_MIN ]w 1000 A ҥHAL@먭ϥΪ̪ UID N|q 1000 _ooAѶܡHI

    pGڲ{bsW@ӨϥΪ̡AoӨϥΪ̪ UID |Oh֡H׬OGy pG /etc/passwd ̭bݪ UID Sj /etc/login.defs Y UID_MIN (bҤO 500)ɡAhH UID 500 ӧ@@ӷsb UIDC pG /etc/passwd wj 500 HW UID ɡAh /etc/passwd ̤j UID + 1 @s]b UIDCzӦpGڬOQnإߨtΥΪbAҥHϥ useradd -r sysaccount o -r ѼƮɡAN|y 500 p̤j UID + 1 zNOFC ^_^

    aؿw]O_إߡG

    t~]n`N CREATE_HOME ]wȡAoӳ]wȤ]ܭnC@ӻAb FC4 ҤUA ڭ̨ϥ useradd useraccount ɡAw]O|Dʪإ߮aؿADϥ -M oӰѼơ ܩ SuSE server 9 oӪӻAKKILw]Oإ߮aؿADϥ -m oӰѼƩOI ]Abo̳]nijzApG֩wnإ߮aؿܡAצbӪA A̦n٬O[W -m oӰѼƨӱjإ߮aؿaI ^_^

    zNાDoA useradd o{bإ Linux WbɡAܤַ|ѦҡG
    • /etc/default/useradd
    • /etc/login.defs
    • /etc/skel/*
    oɮסALA̭nOإ /etc/passwd, /etc/shadow, /etc/group, /etc/gshadow ٦ϥΪ̮aؿNOFҥHApGzAѾӨtιB@AA ]OiHʪקoXɮ״NOFC


  • passwd
  • ڭFAϥ useradd إߤFbAbw]pUAӱbOȮɳQꪺA ]NOAӱbOLknJAAiHh@@@ /etc/shadow ĤGNoo ӦpOnHȤHL]wsKXNnFIa]wKXNϥ passwd oI
    [root@linux ~]# passwd [useraccount]
    
    dҤ@GpG root n dmtsai קKXɡH
    [root@linux ~]# passwd dmtsai
    Changing password for user dmtsai.
    New UNIX password:  <==o̪JsKXAù|
    BAD PASSWORD: it is based on a dictionary word  <==KX²ɪ~I
    Retype new UNIX password:  <==AJ@P˪KX
    passwd: all authentication tokens updated successfully.  <==M٬O\קFI
    
    dҤGG dmtsai oӨϥΪ̷QnקۤvKX
    [dmtsai@linux ~]$ passwd
    Changing password for user dmtsai.
    Changing password for dmtsai
    (current) UNIX password: <==o̿Jy즳±KXz
    New password: <==o̿JsKX
    BAD PASSWORD: it is based on your username <==KXWdOY檺
    New password:
    BAD PASSWORD: it is based on your username
    New password:
    BAD PASSWORD: it is based on a dictionary word
    passwd: Authentication token manipulation error
    
    ӽͤ@ͤWӽdҡCn`NOA passwd oӫOѩϥΪ̪ӦإΪkA pGO root Aѩ root 㦳ܰLWvOAҥH root iHQ passwd [username] ϥΪ̭קL̪KXI]AypGϥΪ̪KXFA root OiHL̶iKXקAӤݭnD±KXCzt~A]u root iHHK]wKXAYϸӱKXäŦXtΪKXҭnD @_@CҦpWdҤ@A dmtsai إߪKX²AҥHtάOyĵizL root C bƿJ⦸KXAKKIz٬O|ݨ successfully oӦ\r˩OI

    pGO@먭ϥΪ̡AΪ̬O root QnקۤvKXɡAJy passwd zA NקۤvKXFC@먭ϥΪ̿JKX|gLtΪҡA ҪF /etc/login.defs YWw̤pKXrƤ~Aٷ| /etc/pam.d/passwd o PAM ҲժOI@ӻAzJKX̦nnŦXUnDG
    • KXPbۦPF
    • KXɶqnΦr̭|X{rF
    • KXݭnWL 8 ӦrF
    pGLkgLҡAӱKXNQAM٬Ouϥ±KXoI ~Aȯ౵TKXJApGJKXQAun....s@ passwd ڡIӡA gLo passwd [username] ʧ@AzbN|KXoAɡA pGݤ@U /etc/shadow AAN|DKXeQLo ^_^


  • usermod
  • ҿ׳oyHAÿzAzOaHҥHoAMɭԷ|ypߡzb useradd ɭԥ[JF~]wơCΪ̬OAbϥ useradd Ao{YǦa٥iHiӳקC ɡAMڭ̥iH /etc/passwd /etc/shadow hק۹쪺ơA LALinux ]ѬOjaӶibƪLթO㨺NO usermod o
    [root@linux ~]# usermod [-cdegGlsuLU] username
    ѼơG
    -c  G᭱bAY /etc/passwd Ĥ檺AiH[J@DZbC
    -d  G᭱baؿAYק /etc/passwd ĤF
    -e  G᭱A榡O YYYY-MM-DD ]NOb /etc/shadow ĤKưաI
    -g  G᭱ group nameAק /etc/passwd ĥ|AYO GID I
    -G  G᭱ group nameAקoӨϥΪ̯䴩sաAק諸O /etc/group o
    -l  G᭱bW١CYOקbW١A /etc/passwd Ĥ@I
    -s  G᭱ Shell ɮסAҦp /bin/bash  /bin/csh C
    -u  G᭱ UID ƦrաIY /etc/passwd ĤT檺ơF
    -L  GȮɱNϥΪ̪KXᵲALLknJCȧ /etc/shadow KXC
    -U  GN /etc/shadow KX檺 ! AѭաI
    dҡG
    
    dҤ@GקϥΪ dmtsai A[WyVBird's testzC
    [root@linux ~]# usermod -c "VBird's test" dmtsai
    [root@linux ~]# grep dmtsai /etc/passwd
    dmtsai:x:501:501:VBird's test:/home/dmtsai:/bin/bash
    
    dҤGGϥΪ dmtsai KXb 2006/01/01 ġC
    [root@linux ~]# usermod -e "2006-01-01" dmtsai
    [root@linux ~]# grep dmtsai /etc/shadow
    dmtsai:$1$24ISJM4K$bbdijdreoieaVaBMAHsm6.:13026:0:99999:7::13149:
    
    dҤTGȮɭᵲ dmtsai KXI
    [root@linux ~]# usermod -L dmtsai
    [root@linux ~]# grep dmtsai /etc/shadow
    dmtsai:!$1$24ISJM4K$bbdijdreoieaVaBMAHsm6.:13026:0:99999:7::13149:
    # `NAKX(ĤG)hF@ ! Iĸ|KXLijI
    [root@linux ~]# usermod -U dmtsai  <==o˴NѶ}FI
    
    dҥ|GU@ dmtsai oӳåQإ߮ɧѰOإ߮aؿAӦpOnH
    [root@linux ~]# usermod -d /home/dmtsai2 -m dmtsai
    # pGȬO -d /home/dmtsai2 ܶȭק /etc/passwd Ĥ檺eӤwA
    # pG[W -m oӰѼơAhܷsؤ@ӮaؿNI
    # t~ApG쥻aؿO /home/dmtsai A -d /home/dmtsai2 -m
    # |N쥻 /home/dmtsai W /home/dmtsai2 I
    
    usermod Otκ޲z root ΨӺ޲zbƪALAo usermod {\]QܦhLOҨNIҦp chfn P chsh LALצpAz٬OiH usermod ӷLըϥΪ̱bưաI


  • userdel
  • oӥ\N²FتbRϥΪ̰աPLɮצG
    • /etc/passwd
    • /etc/shadow
    • /home/username
    ӫOykOG
    [root@linux ~]# userdel [-r] username
    ѼơG
    -r  GsPϥΪ̪aؿ]@_R
    dҡG
    
    dҤ@GR vbird2 AsPaؿ@_R
    [root@linux ~]# userdel -r vbird2
    
    oӫOUFɭԭnpߤFIq`ڭ̭n@ӱbɭԡAAiHʪN /etc/passwd P /etc/shadow YӱbYiI@ӨApGӱbuOy ȮɤҥzܡAN /etc/shadow Y̫˼Ƥ@]w 0 NiHӱbLkϥΡAOҦӱbƳ|dUӡI ϥ userdel ɾq`Oy AuTwnӥΤbDWϥΥƤFIz

    t~AϥΪ̦pGbtΤWާ@L@}lFAӨϥΪ̨btΤi|tLɮתC |ҨӻALlHc (mail box) Ϊ̬OҦʩRO (crontab) ɮסC ҥHApGQn㪺NYӱb㪺A̦niHbUF userdel -r username eA Hy find / -user username zdXӨtΤݩ username ɮסA MA[HRaI

    ϥΪ̥\Gchfn, chsh
    ׬O useradd/usermod/userdel AOtκ޲zүϥΪOA pGڬO@먭ϥΪ̡AڬO_FKX~ANLkLƩOH MOաIo̧ڭ̤ШӤ@먭ϥΪ̱`ΪbܧOoI


  • chsh
  • [dmtsai@linux ~]$ chsh [-ls]
    ѼơG
    -l  GCXثetΤWiΪ shell ANO /etc/shells eI
    -s  G]wקۤv Shell o
    dҡG
    
    dҤ@GCXثetΤWҥH shell AåBw csh ۤv shell
    [dmtsai@linux ~]$ chsh -l
    /bin/sh
    /bin/bash
    /sbin/nologin
    /bin/ksh
    /bin/tcsh
    /bin/csh
    /bin/zsh
    [dmtsai@linux ~]$ chsh -s /bin/csh; grep dmtsai /etc/passwd
    Password:  <==FbQ÷dҥHݭnJ dmtsai KXT{I
    Shell changed.
    dmtsai:x:501:501::/home/dmtsai:/bin/csh
    
    oӫOINObϥΪ̪ shell opWҭzAڴNiH׭qn dmtsai shell աI


  • chfn
  • [root@linux ~]# chfn [-foph] 
    ѼơG
    -f  G᭱㪺jWF
    -o  Gz줽ǪжXF
    -p  G줽ǪqܸXF
    -h  Ga̪qܸXI
    dҡG
    
    dҤ@Gڥ dmtsai oӨϥΪ̨ӧ@UۤvTI
    [dmtsai@linux ~]$ chfn
    Changing finger information for dmtsai.
    Password: <==FbQ÷dҥHݭnJ dmtsai KXT{I
    Name []: VBird' Test account
    Office []: Tainan office 1
    Office Phone []: 06-1234567
    Home Phone []: 06-7654321
    
    Finger information changed.
    [dmtsai@linux ~]$ grep dmtsai /etc/passwd
    dmtsai:x:501:501:VBird' Test account,Tainan office 1,06-1234567,06-7654321:
    /home/dmtsai:/bin/bash
    
    oӫObADOADܦhΤA_h˯uOΤ۳oӵ{IoNIO bbs YAyӤHݩʡz@ӸưաIoӵ{DnOft finger o{bB@ILAѩ finger o{OܦwAҥHw]OSw˥LI pGzQn@U finger ܡAХѦ RPM MwˤeAbw finger RPM ɮסAMAӪaIUo̳٬O²檺Ф@UNnFI

    ϥ chfn oӫOA{|nDzJ\hTA]tFG
    • KX
    • ʺ
    • 줽ǸX
    • 줽ǹq
    • a̹q
    LAoǸT諸O쥻 /etc/passwd ̭Ĥ满ưաI CӸTHry,zj}ӦӤwCpWҥܡA dmtsai ϳQʹLoI ^_^


  • finger
  • finger rNqOGyzAKKIo finger iHd\ƥiNhFI ڭ̤Oϥ chfn ӭק dmtsai oӨϥΪ̪TܡHǭӬTNiHQ finger Ӭd\XӪILdߤkpUG
    [root@linux ~]# finger [-s] username
    ѼơG
    -s  GϥΪƿX榡C
    dҡG
    
    dҤ@GN dmtsai إߪ@ǨϥΪ̸TIsXӵI
    [root@linux ~]# finger dmtsai
    Login: dmtsai                           Name: VBird's Test account
    Directory: /home/dmtsai                 Shell: /bin/bash
    Office: Tainan office 1, 06-1234567     Home Phone: 06-7654321
    Last login Tue Aug 30 15:01 (CST) on tty1 from localhost
    No mail.
    No Plan.
    
    aIo finger ٥iHΨӬdߧODbOILAثeq`ΦbbdߡC ] finger OMIOAҥHA linux distributions w]Ow˥LA LApGzӳ觋ӧw FC4 ܡANSDաIiHާ@C

    LAAγ\|ıo쪺OA finger G̩UܡyNo mail. No Plan.zOH I finger |Dʥh /var/spool/mail d߬ݬݦSӱblHc (mailbox)A ӥBٷ|hd ~/.plan ɮסANOpeɰաpAڦb dmtsai aؿUإ .plan oɮסALeOyDmTsai will write something....zAGϥ finger ɡA KKIziHۦݬݵG|˰ڡI ^_^


  • id
  • id oӫOhiHd߬YHΦۤv UID/GID TALѼƤ]֡ALA ݭnOϥϥ id NCXo ^_^
    [root@linux ~]# id [username]
    
    dҤ@Gd\ۤvTI
    [root@linux ~]# id
    uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),10(wheel)
    
    dҤGGd\@U dmtsai a
    [root@linux ~]# id dmtsai
    uid=501(dmtsai) gid=501(dmtsai) groups=501(dmtsai),100(users)
    
    Ajդ@UA groups OثeӨϥΪ̩ݪҦsաAOznAѤOy lsջPĸs ztI

    sWPs
    OKIAѤFbsWBRBʻPd߫AAӧڭ̥iH@sժeFC 򥻤WAsժePoɮצG sժe²AOWɮתsWBקPӤwA LApGA[WĸsժA newgrp P gpasswd hiOI


  • groupadd
  • [root@linux ~]# groupadd [-g gid] [-r]
    ѼơG
    -g  G᭱YӯSw GID AΨӪY GID 
    -r  GإߨtθsհաIP /etc/login.defs  GID_MIN C
    dҡG
    
    dҤ@Gsؤ@ӸsաAW٬ group1
    [root@linux ~]# groupadd group1
    [root@linux ~]# grep group1 /etc/group /etc/gshadow
    /etc/group:group1:x:502:
    /etc/gshadow:group1:!::
    # `N`NIb /etc/gshadow ̭iHo{AKXO\nJI
    
    dҤGGsؤ@ӨtθsաAW٬ group2
    [root@linux ~]# groupadd -r group2
    [root@linux ~]# grep group2 /etc/group /etc/gshadow
    /etc/group:group2:x:101:
    /etc/gshadow:group2:!::
    
    A -r StFܡHIO㵲G| /etc/login.defs ̭]wI ӥBH groupadd sWbAw]ϥαKX觋nJ ]NOAw]OpsաAõLkϥ newgrp ӵnJOI


  • groupmod
  • usermod AoӫOȬObi group ѼƪקӤwC
    [root@linux ~]# groupmod [-g gid] [-n group_name]
    ѼơG
    -g  GקJ GID ƦrF
    -n  GקJsզW
    dҡG
    
    dҤ@GNWӫOإߪ group2 W٧אּ groupname A GID  103
    [root@linux ~]# groupmod -g 103 -n groupname group2
    [root@linux ~]# grep groupname /etc/group /etc/gshadow
    /etc/group:groupname:x:103:
    /etc/gshadow:groupname:!::
    
    LA٬OyѸܡAnHN GID Aeytθ귽óI


  • groupdel
  • III groupdel ۵MNObRsժoΪk²G
    [root@linux ~]# groupdel [groupname]
    
    dҤ@GN𫍧 groupname RI
    [root@linux ~]# groupdel groupname
    
    dҤGGYnR dmtsai oӸsժܡHH
    [root@linux ~]# groupdel dmtsai
    groupdel: cannot remove user's primary group.
    
    groupname iHRAO dmtsai NROH]²A yYӱb (/etc/passwd) initial group ϥθӸsաIz pGd\@UAA|o{b /etc/passwd dmtsai ĥ|檺 GID NO /etc/group dmtsai Ӹsժ GID AҥHoAMLkR_h dmtsai oӨϥΪ̵nJtΫA N|䤣 GID AiO|yܤjxZIpGnR dmtsai oӸsթOH AynT{ /etc/passwd bSHϥθӸsէ@ initial group z~IҥHAAiHG
    • ק dmtsai GID AΪ̬OG
    • R dmtsai oӨϥΪ̡C

  • gpasswd
  • F]wsդ~Aڭ٥iHwtΤWsնi@ǡyKXzI oӱKXAӸsմNYǤHnJĸsթOI쪺C t~ApGtκ޲zӦFALkwCӸsըӺ޲zAy tκ޲z٥iHNYϥΪ̳]wӸsժΪIz ܦaMثe֤Ho򪱤FALAbo٬OjaФЧaI
    tκ޲z(root)ʧ@G
    [root@linux ~]# gpasswd groupname
    [root@linux ~]# gpasswd [-A user1,...] [-M user3,user4...] groupname
    [root@linux ~]# gpasswd [-rR] groupname
    ѼơG
        GYSѼƮɡAܵ groupname @ӱKX(/etc/gshadow)
    -A  GN groupname Dvѫ᭱ϥΪ̺޲z(Ӹsժ޲z)
    -M  GNYDZb[JoӸsշI
    -r  GN groupname KX
    -R  G groupname KX楢ġAҥH newgrp NϥΤFI
    
    sպ޲z(Group administrator)ʧ@G
    [someone@linux ~]$ gpasswd [-ad] user groupname
    ѼơG
    -a  GNYϥΪ̥[J groupname oӸsշI
    -d  GNYϥΪ̲X groupname oӸsշC
    
    dҤ@Gإߤ@ӷssաAW٬ testgroup Bsե dmtsai ޲zG
    [root@linux ~]# groupadd testgroup
    [root@linux ~]# gpasswd testgroup
    Changing the password for group testgroup
    New Password:
    Re-enter new password:
    # J⦸KXNFI
    [root@linux ~]# gpasswd -A dmtsai -M dmtsai,vbird testgroup
    [root@linux ~]# grep testgroup /etc/group /etc/gshadow
    /etc/group:testgroup:x:502:dmtsai,vbird
    /etc/gshadow:testgroup:1CEVbrcjxO6Ps:dmtsai:dmtsai,vbird
    # ܦaI dmtsai h֦ testgroup DvIYHڭ̰Qװ (
    # http://phorum.vbird.org ӻAsպ޲zIyDzաI
    
    dҤGGH dmtsai nJtΡAåBL[J vbird1  testgroup @G
    [dmtsai@linux ~]$ gpasswd -a vbird1 testgroup
    Adding user vbird1 to group testgroup
    
    ܦ쪺@ӤpaIڭ̥iH testgroup @ӥiH}sաA Mإ߰_sպ޲zAsպ޲ziHhӡCboӮרҤA ڱNL]w dmtsai AҥHA dmtsai NiHۦW[sզo IIIMAӸsզNϥ newgrp o


  • newgrp
  • ٦LHܡHڭ̫eͨ /etc/gshadow ɴNLoӫOFI ynewgrp |B~Ht@ login ӴѨϥΪ̵nJt@ shell A åBNĸsէאּ newgrp ᭱ӸsաAYSsաAhw]sլ initial group z

    KX޲zG passwd
    AӸja@ӭnKXIzonSOdNOAѡAzDYODJIA 𫍧Ĥ@ӤJII۵MNOzDWbyKXzFAҥHA pGzKXwqY檺ܡA۵MNeqAKXA۵MN|OٰաI

    ثe@ Cracker `ϥΪKX}ѳnAjOyrkz ΩҿתyɤO}ѪkzANrWNqӻA yrkzONr̭Ҭd쪺rΤyJ{A Mϥθӵ{@Ӥ@Ӫhկ}ѧAKXAnıoo˪tצGܺCAڤWA {qBtפӰFArkާ@IJv򥻤WOܰIt@ӡy ɤO}ѪkzNOϥLWiHϥΪAM̷ӲզXAH 1 , 2 , 3 ӡK. KXզX觋h}ѧAKXIoӤ觋NuC@IApGAKXզXO 6~8 ӦrHWAɤOk٬Oݭnn@qɶ~}ѪFI

    ѤWyrkzPyɤO}ѪkzqAKX觋ӻAzDp]w@ӦnKXFܡH OAzKX̦nݭnUXӯSʡG oرKXuܤeQ}ѡAOܤA]ܮeQAڧѰOI^_^CҥHOA ijz``ϥΤ@ǹOHӻOSNqAOzTS[NrI Ҧp``쪺AڷRڦѱCIy I&Mywife*^zKXIeQqA]eQAۤvOI 򦳨SyܭnRKXzOHAUXرKXNܭnRG VBird gLHbKXpIuOnRӦnqFI

    nFIDFKXnʡAP򥻪]wAۤUӧڭ̽ͤ@ͦpʳ]wKXaI򥻤WA root iH]wy˦KXzAӥBA root ]iHU user qwL̪KXIܩ user ȯקۤvKXIקKXϥΤROHNO passwd oөROաIxIo̬MLQXӭnTAjaƲߤ@UG oǫOPNqpG٨SѰOI߱zFIuOInFAٰOoڭ̱KXb̶ܡHաINO /etc/shadow ̭AɮתvO -rw------- ҥHu root iHקA]A passwd ݭn㦳 SUID ~@ϥΪ̭קL̪KXoI passwd ΪkA ڭ̫ewgyLL@oAbUڭ̫hw root ͤ@U passwd ٦n\HH


  • passwd
  • [root@linux ~]# passwd [-lunxwS] username
    ѼơG
    -l  GN username oӱbKX (lock)Ab /etc/shadow KX׭q
    -u  GN -l  lock Ѷ}I
    -n  G᭱Ѽ (Ʀr) A̵uѼơFYO /etc/shadow ĥ|F
    -x  G᭱Ѽ (Ʀr) A̪ѼơFYO /etc/shadow ĤF
    -w  G᭱Ѽ (Ʀr) AĵiѼơFYO /etc/shadow ĤF
    -S  Gܥثeo username TC
    dҡG
    
    dҤ@GN dmtsai oӨϥΪ̪KXᵲA[LI
    [root@linux ~]# passwd -l dmtsai
    Locking password for user dmtsai.
    passwd: Success
    [root@linux ~]# passwd -S dmtsai
    Password locked.
    [root@linux ~]# grep dmtsai /etc/shadow
    dmtsai:!!$1$TDy6D7eg$jVJV/FMaQn14v5Kl7sqw6/:13026:0:99999:7::13149:
    
    dҤGGNWzKXᵲѶ}
    [root@linux ~]# passwd -u dmtsai
    
    o passwd OٮhΪרܦh\Ȧ root ~C ziHϥ passwd -l passwd -u ӱj@ӨϥΪ̡yȮɡzLkϥθӱbA ܤKաI ^_^

    ϥΪ̨G
    Hb Linux tη٭n@ܴHoOԣH OܴrH򻡩OHNOA@ӨAڭ̳ƱH root nJDAHקKQǫȤJIFIO@DSi৹i׸ɩΪ̬O]wʧ@I oӮɭԭnpN@ϥΪ̪ܦ root OHDnؤ觋AOOG Uڭ̴Nӻ@ su sudo ΪkաI


    su
    [root@linux ~]# su [-lcm] [username]
    ѼơG
    -   GpG su - ɡAܸӨϥΪ̷Qnܴ root ABϥ root 
          ҳ]wѼɡAp /root/.bash_profile C
    -l  G᭱iHϥΪ̡AҦp su -l dmtsai Ao -l nBOAiϥαܴ
          LҦҳ]wɡC
    -m  G-m P -p O@˪AܡyϥΥثeҳ]wAӤsŪsϥΪ̪]wɡCz
    -c  Gȶi@OAҥH -c ᭱iH[WOI
    dҡG
    
    dҤ@Gѭ쥻 dmtsai oӨϥΪ̡Aܴ root C
    [dmtsai@linux ~]$ su
    Password: <==o̿J root KXI
    [root@linux ~]# env
    USER=dmtsai
    USERNAME=root
    MAIL=/var/spool/mail/dmtsai
    LOGNAME=dmtsai
    # `NFܡHpGϥ su S[W - ܡAܦh쥻ϥΪ̪]w|~sbA
    # o]|yӪ root bɪxZC̱`NO PATH oܼƪDI
    
    [root@linux ~]# exit  <==o˥iH} su ҡI
    [dmtsai@linux ~]$ su -
    Password: <==o̿J root KXI
    [root@linux ~]# env
    USER=root
    MAIL=/var/spool/mail/root
    LOGNAME=root
    # AѮtFaHIҥHAUbܴ root ɡAOo̦nϥ su - I
    
    dҤGGϥ root A head -n 3 /etc/shadow
    [dmtsai@linux ~]$ su - -c "head -n 3 /etc/shadow"
    Password: <==o̿J root KXI
    root:$1$jaldj9843u29jlj9u839jljlcghjlE/:12959:0:99999:7:::
    bin:*:12959:0:99999:7:::
    daemon:*:12959:0:99999:7:::
    
    dҤTG쥻O dmtsai oӨϥΪ̡AQnܴ vbird ɡH
    [dmtsai@linux ~]$ su -l vbird
    Password: <==o̿J vbird KXI
    
    o su OiHAbPϥΪ̤A su ᭱S[WϥΪ̱bɡA w]NOH root @AӨաIAoӫO̤jγ~]Obo̡I NO@ϥΪܦ root աIӭnSOdNhO su ϥΤ觋WA ѩyO_ŪJ̪ҰѼɮzPA ҥHzndNI Mϥ su ܤKա㤣LAIOڦܦh޲zɡAO_CӤHݭnD root KXH o˫ܦMII root KXi|~yHSYAڭ̥iHϥ sudo ӨN su C


    sudo
    ϥ su uO²ա㤣LA su o@ӫYDA NO.....ڭ̥nDQnܦӤHnJKX |ҨӻApGڷQnܦ root ANnD root KX~A pGڷQnܦ dmtsai Ӥu@A򰣫DڬO root A_hNnD dmtsai oӨϥΪ̪KX~ӲҬҪApGhH޲z@DܡA jaD root KXA......MIAOܡHI

    oӮɭԡA sudo NWγo㨺 sudo Oˤu@OH n`NOAϥΪ̡yJOۤvKXAӤOLӨKXIz |ҨӻA] dmtsai 㦳 sudo vALH sudo root u@ɡA LݭnJO dmtsai ۤvKXAӤO root KXIKKIܴΧaI ^_^ p@ӡAjaiHϥΦۤvKX root u@AӤD root KXAwhFC ~AϥΪ̯檺OOiHQI ҥHAڭ̥iH]w dmtsai ȯi shutdown u@AΪ̬OL@²檺OA KKIO_ܴΰڡI

    LAѤWAz]|AѡAO_㦳 sudo vOܭnA sudo vP /etc/sudoers oɮצCbw]pUAu root ~ϥ sudo OIܩs /etc/sudoers hݭn visudo oӫOCnFA Uڭ̴NӬݤ@ sudo ykC
    [root@linux ~]# sudo [-u [username|#uid]] command
    ѼơG
    -u  G᭱iHϥΪ̱bW١AΪ̬O UIDCҦp UID O 500 AiHG
          -u #500 ӧ@ UID  500 ϥΪ̡C
    dҡG
    
    dҤ@G@먭ϥΪ̨ϥ sudo b /root UإߥؿG
    [dmtsai@linux ~]$ sudo mkdir /root/testing
    We trust you have received the usual lecture from the local System
    Administrator. It usually boils down to these three things:
    
        #1) Respect the privacy of others.
        #2) Think before you type.
        #3) With great power comes great responsibility.
    
    Password: <==o̿J dmtsai ۤvKX
    dmtsai is not in the sudoers file.  This incident will be reported.
    # @I] dmtsai b /etc/sudoers AҥHLNLk sudo I
    
    dҤGG] dmtsai wg㦳 sudo vApb /root UإߥؿH
    [dmtsai@linux ~]$ sudo mkdir /root/testing
    Password: <==o̿J dmtsai ۤvKX
    
    dҤTGpN sudo P su ftϥΡH
    [dmtsai@linux ~]$ sudo su -
    
    dҥ|Gdmtsai Qn vbird Ӷi touch ɡH
    [dmtsai@linux ~]$ sudo -u vbird touch /home/vbird/test
    
    WڶiF|ӽdҡALAn`NOAYڬOH dmtsai Ӷi檺A bUӪApGAϥ sudo Ӥu@ɡANݭnAJKXC oO]tά۫HAb|}ӦĤGӤH]Ӿާ@tΰڡI IIIuOܤHʤƪ]pڡ ^_^CLpG⦸ sudo ާ@jWL 5 ANonsJ@AKXFC ӥBn`NOA]ϥΤ@bɡAzפW|ϥΨ /sbin, /usr/sbin ؿOA ҥH $PATH ܼƤ|toǥؿA]ܦh޲zOݭnϥε|ӤUFI Ϊ̪קzۤv PATH ܼƧaI

    Wo|ӽdҧڳOH dmtsai oӨϥΪ̨Ӷi檺AOAbw]pA zϥΪӬOϥ sudo oO]ڭ̤W쪺ڡA٨Sh]w /etc/sudoers I ҥHoApGznդWdҤeAOݭnN /etc/sudoers ʰʤ}C LA] /etc/sudoers ݭn@ǤSOykA]ApGAH vi hsLɡA pGJry~Ai|yLkҥ sudo xZA]Aijz@wnϥ visudo hs /etc/sudoers I(G visudo nϥ root ӰI)
    [root@linux ~]# visudo
    # sudoers file.
    # This file MUST be edited with the 'visudo' command as root.
    # See the sudoers man page for the details on how to write a sudoers file.
    #
    # Host alias specification
    # User alias specification
    # Cmnd alias specification
    # Defaults specification
    # Runas alias specification
    # User privilege specification
    root    ALL=(ALL) ALL
    dmtsai  ALL=(ALL) ALL   <==o̱N dmtsai s@iΡI
    
    # Uncomment to allow people in group wheel to run all commands
    # %wheel        ALL=(ALL)       ALL
    # Same thing without a password
    # %wheel        ALL=(ALL)       NOPASSWD: ALL
    # Samples
    # %users  ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
    # %users  localhost=/sbin/shutdown -h now
    
    ϥ visudo AN|X{@ vi eաILNOH vi Ӷ} /etc/sudoers A LAڭxs}ɡA visudo |B~hˬd /etc/sudoers ykA HקKϥΪ̿J~TFCڤWu[J@ANO dmtsai iHHNϥ sudo ӤwC򥻤WA /etc/sudoers cziHϥ man sudoers hd\A ӻeܲMAӥB٦@ǽdҩOIbo̶ȧ@@²檺NOFC @y dmtsai ALL=(ALL) ALL zNNqOG ]AڤWo@檺NqOGy dmtsai oӨϥΪ̡AרӦۦA LiHܴ Linux WҦbAðҦOzNաI pztθ̭A Web nOH www oӨϥΪ̨Ӷis𫍧A zQn vbird2 oӨϥΪ̥iH www oӱbisANӼgG pGgG YS[WŧiܡAyw]Oȯi root zӤwI ^_^ oiOܭn@[OIt~ApGQnHϥΪ̪sըӶiWdܡAb yϥΪ̱bzAe[Wy % zɡANNOs (group) FC |ҨӻAڷQntθ̭Ҧݩ wheel oӸsժϥΪ̳i sudo ɡAiHo˼gG ӦpGAٷQnoӸsդϥΪ̦bϥ sudo ɡAݭnJKXA iHbyiHUFOz줺h[J@ӰѼơAWyNOPASSWD:zYiAYG t~AF@ӤHγ@sդ~Aڭ٥iHB~w@ǡybOWBDOWBOOWz ƨӬۤMγIuOnΰڡILAOWϥΤWAynϥΤjgrz~I nFAڭ̨Ӱ@ǽmߡAziHܲMDpi visudo ]waI

    DGڷQnإߤ@ӥiHtκ޲zܧϥΪ̱KXsաAW٬ ADMPW ( `NAb sudoers AoӧOWW٤@wnOjgr~I)OoӸsդק root KXI BL̰ sudo ɡAݭnKXҡC
    G
      ڥH root ϥ visudo AiJseAh]wUҼˡG
      User_Alias ADMPW = vbird, dmtsai, vbird1, vbird3
      ADMPW ALL = NOPASSWD: !/usr/bin/passwd, /usr/bin/passwd [A-Za-z]*, \
                            !/usr/bin/passwd root
      
      WNOAڪtΤW|ӱbAOO vbird, vbird1, vbird3 P dmtsai o|ӱb[J sudo ADMPW sդAo|ӱbiHϥ sudo iy /usr/bin/passwd * z KXʧ@AO (bOe[J ! Ni) ϥ /usr/bin/passwd /usr/bin/passwd root Ap@ӡAN ADMPW iHϥΪ̪KXAOܧ root KXoI ^_^

    b /etc/sudoers Y[JOWܦhnBA|ҨӻAHWҤlA ]ӧڦLϥΪ̭n[JӱKX޲zsծɡANb[J ADMPW ӸsդNnFA²檺ϥΧaI ^_^CAݬݤU@DG

    DGڪtΤ DNS AȡALҰʫOb /etc/init.d/named ApGڷQnإߤ@ DNSMASTER sըӺ޲zLɡHpOnH
    G
      ڥH root ϥ visudo AiJseAh]wUҼˡG
      User_Alias DNSMASTER = vbird, dmtsai
      Cmnd_Alias DNSCMD = /etc/init.d/named, /usr/bin/vim /var/named/*
      DNSMASTER ALL = DNSCMD
      
      ݪܡHKKI] DNS ]wɤjhb /var/named ̭AҥHAڤ]\b vi hBz DNS ]wɰաI²aI ^_^

    nFAڭ̪D sudo iHft su Ӷi@tΪu@aI ] sudo ȯi@OAܳ·СApGگN sudo P su ftb@_ANܴΤFܡH oӮɭԡAڥiHQΤWwgإߦn ADMPW sըӷsWo@G p@ӡAb ADMPW ϥΪ̡ANiHQΡy sudo su - zӤ root o uOαooFڡI ^_^

    ϥΪ̪S shell P PAM Ҳ
    ڭ̫e@ͨ쪺jhO@먭ϥΪ̻Ptκ޲z (root) ާ@A ӥBjhOQinJtΪbӻC򴫭Ө׷QApGڤѷQnإߪA O@ӡyȯϥ mail server lAȪbAӸӱbänJ Linux DzOH pG൹ӱb@ӱKXAӱbNLkϥΨtΪU귽AM]]A mail 귽A ӦpG@ӱKXAӱbNiiHnJ Linux DڡI˸a ҥHAUڭ̨ӽͤ@ͳoǦ쪺DoI


    S shell, /sbin/nologin
    pGAgJӪݹL /etc/shells oӨtΥiΪ shell ɮסAH /etc/passwd oɮתeɡAAӷ|o{AKKI򦳭өǩǪ /sbin/nologin ڡI oO shell OHIQ man nologin NiHDա

    Ao shell q`OtαbϥΪA]o /sbin/nologin ƹWõLkbڵnJA pGAQ usermod קF dmtsai oӨϥΪ̪ shell /sbin/nologin A AQnH dmtsai snJtήɡALbùW|X{o˪TG
    This account is currently not available.
    
    KKIOyoӱbäQ\nJաIzLAoӱboiHiLu@I |ҨӻAUӨtαbACLu@ lp oӱbb޲zA WWW Aȥ apache oӱbb޲zA L̳iHitε{Ǫu@AOyNOLknJDzӤwաI^_^

    ӨרӷQApGڪ Linux DѪOlAȡAҥHAbo Linux DWbA jOΨӦDHӤwAäݭnnJDOI oӮɭԡAڭ̴NiHҼ{¨ϥ mail bH /sbin/nologin L̪ shell A oˡA̰_XڪDQշQnnJtήɡAiHڵӱbOI

    t~ApGڷQnYӨ㦳 /sbin/nologin ϥΪ̪DAL̤nJDɡA ڥiHإߡy /etc/nologin.txt zoɮסA åBboɮפnJ]AUoӨϥΪ̷QnnJtήɡA ùWX{N|O /etc/nologin.txt oɮתeAӤOw]eFI


    PAM ҲաG/etc/nologin, /etc/securetty
    @ӨϥΪ̷QnnJ Linux DɡAL줰򭭨OHڭ̻A LFnqL /etc/passwd /etc/shadow ҨèovơA ̫o@ shell ~AƹWALbnJtΤeANonqL PAM (Pluggable Authentication Modules, OJҲ) Ҥ~C

    PAM Ҳժγ~D`hAFiHbϥΪ̵nJɶi樭Ҥ~A ]iHU@ε{ҤγI|ҨӻAڭ̫e쪺KXק{y passwd z Aڭ̰KX׭qɭԡAoӵ{O|iDڭ̱zJKXO_XWdܡH pGOObrKXAΪ̬OPbۦPKXAN|Q PAM Ҳե^A ]NLkqLҤFI

    PAM B@OHڭ̦P˥H /usr/bin/passwd o{ӧ@²檺nFG
    1. ϥΪ̶}l /usr/bin/passwd o{AÿJKXF
    2. passwd }lIs PAM ҲաAPAM Ҳշ|jM passwd { PAM ]wɮסA oӳ]wɤ@Ob /etc/pam.d/ ̭P{PWɮסAҥHAbҤA PAM |hjM /etc/pam.d/passwd oӳ]wɡF
    3. g /etc/pam.d/passwd ]wɪơA PAM ҴѪҲըӶiҡF
    4. NҵG^ǵ passwd o{A passwd o{|ھ PAM ^ǪGMwU@Ӱʧ@ (sJsKXΪ̳qLҡI)
    oӹL{ѧڭ̴XӭnTG ܩ PAM ҲժB@A쪺ܡAziHez Linux DG /usr/share/doc/pam* ؿh@@@A̭۷h״ITiHѵAѦҡC ڭ̳o̶ȴNϥΪ̵nJҲըӶi@²檺ӤwC


  • PAM ]wɳ]wdҡG
  • ϥ PAM ҲմNO{IsΪAӷ{IsɡA PAM N|Qά۹]wɨӶi@ҴNOFCڭ٬O| passwd ҦnFA pGAh[@U /etc/pam.d/passwd eɡALOo˪G
    [root@linux ~]# cat /etc/pam.d/passwd
    #%PAM-1.0
    auth       required     pam_stack.so service=system-auth
    account    required     pam_stack.so service=system-auth
    password   required     pam_stack.so service=system-auth
    
    򥻤WAboɮפAC@泣O@Ӱʧ@AӨCӰʧ@|AOOG
      ҪO @ Ҫз @ ϥΪPAMҲ @ ӼҲժϥΪѼ
    ҪO (Module type) @|AOG
    • auth
      oODnΨϥΪ̪ҡAҥHoOq`OݭnKX窥C

    • account
      oOhDnbϥΪ̬O_㦳TϥvA|ҨӻAAϥΤ@ӹLKXӵnJɡA MNLkTnJFC

    • session
      oODnb޲zϥΪ̥Tϥθӵ{ɪҳ]wC|ҨӻAڭ̵nJ Linux ϥΪO /bin/login oӵ{\઺AҥHAڵnJAbާ@ shell L{AO session oO]wұIt~ApGϥ session oOɡA hӵ{bϥΤePϥεA|QOnɷI

    • password
      ܩoOAhDnbҪ׭qu@A|ҨӻANOק/ܧKXաI
    yҪз(control flag)zSOH²檺ALNOyҳqLзǡzաI `@]|ؤ觋AOOG
    • required
      Ҳճ]woرзǮɡAӼҲժҥn\A_hN|^Ǥ@ failure TC LAצ@ʧ@ҲլO_\AUhҲճٷ|~ʧ@I ӭY failure TɡA]|b򪺰ʧ@i槹A~|^ǵ{C 񩳤U requisite ٭nuqaAbӼҲթUʧ@i㦳nɬ (log) |ʡAh~T~|Q_ӳI

    • requisite
      Ҳճ]w requisite ɡAӼҲժ{ҭnDP˪ݭn\~C LApGӼҲըSqLҡA PAM |yߨz^{@ failure ȡA ]NOAYӦʧ@Ҳի٦LҲծɡALҲժʧ@N|QҥΡC

    • optional
      oӼҲձؤjhObܰTӤwAäOΦbҤ譱C

    • sufficient
      oӼҲձзǤ]쪺A۹ requisite OyoͿ~ɡAߨ^{ failure A åB_ PAM B@zA sufficient hOyQqLҮɡAߨ^{qLTA åB_ PAM B@zCIۤϳI
    ܩ PAM Ҳդ譱Aثeڭ̪ FC4 Ѫ PAM ҲկuhFA oǼҲչڤWmb /lib/security/ ؿAFC4 PAM hmb /usr/share/doc/pam-*/* ̭AziHھڨCӤPҲեhQץLγ~A bo̶Ȱwڭ̵nJɩҨϥΪ login oӵ{ PAM ]wɡA]NO /etc/pam.d/login oɮתeӵyG
    [root@linux ~]# cat /etc/pam.d/login
    #%PAM-1.0
    auth       required	pam_securetty.so
    auth       required	pam_stack.so service=system-auth
    auth       required	pam_nologin.so
    account    required	pam_stack.so service=system-auth
    password   required	pam_stack.so service=system-auth
    # pam_selinux.so close should be the first session rule
    session    required	pam_selinux.so close
    session    required	pam_stack.so service=system-auth
    session    optional	pam_console.so
    # pam_selinux.so open should be the last session rule
    session    required	pam_selinux.so multiple open
    
    bڭ̵nJ Linux ɭԡAϥΨ쪺 login oӵ{ɡALϥΪ PAM ]wɤjhO required зǡAҥHnqLWzX PAM ҲժҫA~PwO_nJ Linux C ݭndNOAڭ̷|ݨ session ҲAoܧڭ̦bڨϥ Linux 귽eAHεnX Linux DAƳ|QnɷC KKIҥHoApGzJӪݹL /var/log/messages P /var/log/secure A No{A@|@ʨOQUӪI ^_^

    t~AbWҲդA쪺OQSr骺A oӼҲաG pam_securetty.so pam_nologin O쪺I ڭ̴NB~ӽͤ@ͳonJҪҼҲէaI


  • /etc/securetty
  • o pam_securetty ҲլOFΪHL̥Dn\NObwwnJҰաI ӥBDnOw root oӨϥΪ̪I oӼҲզbQҥήɡA|hŪ /etc/securetty oɮסA ڭ̡yiHNQ{wOw׺ݾ (terminal) ҼgJoɮפA h root ȥiHbXӲ׺ݾҤUnJzաI

    @ӻAڭ̷|{wbDeҬOwAӨϥκnJҫhMIC ]A@ /etc/securetty ejhOoˡG
    tty1
    tty2
    tty3
    tty4
    ...
    
    ӨS pts/0 onJ׺ݤCo]NOA root ȯg tty1 oز׺ݾnJաI䴩 login {n驰 telnet AȻPe tty1~tty6 loginA o]Oڭ̴쪺AϥζDzΪ telnet suDsu Linux ɡAw]Lkϥ root nJDn]oC

    pJAOH]²աANNoӼҲժҲYiI Dnؤ觋G
    • N /etc/pam.d/login A pam_securetty.so Ҳժ@ѱF
    • N /etc/securetty oɮײC
    p@ӡAڭ̨ϥ telnet su Linux DɡANϥ root nJFC LAijo򰵳ILγ\zS|ݰաAڨϥ ssh suɡA NiHϥ root nJOHIoO] ssh SΨoӼҲգvI ۫HܡHJӦۤvhd\@U /etc/pam.d/sshd NDաI ^_^C


  • /etc/nologin
  • pam_nologin SObdNNڡHAoӼҲդ]ObϥΪ̵nJΪC LAoӼҲեuw@먭ϥΪ̦ġA root OSĪGCoӼҲեnP /etc/nologin ftϥΡA`NAO /etc/nologin AӤO /etc/nologin.txt A oɮתγ~OۦPI ^_^C

    /etc/nologin ɮצsbɡAh@Ӥ@먭bbյnJɡA ȷ|o /etc/nologin eTAӵLknJDC|ҨӻAګإ /etc/nologin AåBe]wyThis Linux server is maintaining....zA HյnJɡAȷ|ݨW쪺oqTAӥBLknJI @n /etc/nologin QA@먭ϥΪ̤~AnJڡI


  • /etc/security/*
  • ƹWAh PAM Ҳճ]wTziHѦ /etc/security/* ̭ɮ׳]wA רOwϥΪ̧Q Linux tθ귽 limits.conf Hήɶ time.conf C ڭ̪DϥΪ̧QΨtθ귽OO ulimit A򰲦pڷQn dmtsai ȯs 10MBytes (10240KBytes) ɮפjpAڥiHo˰G
    [root@linux ~]# vi /etc/security/limits.conf
    # sWo
    dmtsai          hard    fsize   10240
    @users          hard    fsize   10240
    # `NAbe[W @ ܬysաIz
    
    U dmtsai Ϊ̬Oݩ users sժϥΪ̵nJo Linux DɡA AiHQ ulimit -a hݤ@UAKKIL̯Ϊ귽NpܦhFI hΪkziHۦѦҤ@UɮפڡI ^_^ (OoէnNƧ^ӡ_h....HN·ФFI)

    Linux tΤWϥΪ̪ͻP mail ϥΡG
    ͤFohtαbDA`Oӭnͤ@͡ApwtΤWϥΪ̶idߧaHI QXӪAApGAb Linux Wާ@ɡAnLϥΪ̤]nJDAAQnL͡AӦpOnH AQnDYӱbTAӦpd\HIIIUڭ̴NӲ@


    dߨϥΪ̡G w, who, last, lastlog
    pdߤ@ӨϥΪ̪ƩOHo٤²Aڭ̤eNLF w, who, finger OFA iHzAѨ@ӨϥΪ̪TաIQnDϥΪ̨쩳ԣɭԵnJOH ²iHϥ last ˬdڡIoӪNڭ̤]b bash shell ӳ`LFA ziHۦeѦҰڡI²檺ܡCLA last ȦCXoӤƦӤwC

    t~ApGzQnDCӱb̪nJɶAhiHϥ lastlog oӫOI lastlog |hŪ /var/log/lastlog ɮסAGNƿXApUG
    [root@linux ~]# lastlog
    Username         Port     From             Latest
    root             tty1                      Tue Aug 16 18:06:20 +0800 2005
    bin                                        **Never logged in**
    daemon                                     **Never logged in**
    ....HUٲ.....
    
    o˴NDCӱb̪nJɶo ^_^


    ϥΪ̹͡G talk, mesg, wall
    ڬO_iHtΤWϥΪ̽ͤѻaOHMiHաI Q talk oӫOYiILA talk ݭnB~Ұʤ@ǺAȡA ثe Linux distribution HκҡAKKI٬OnoӪFա pGzTwQnoӪNAЦۦ man talk A PɦҼ{Ұ ntalk oӪAȬݬo

    FuW (talk) ~ASLTǰe\ڡH ڡIQ write O觋աILiHNTǵoI |ҨӻAڭ̪ Linux ثe vbird P dmtsai ӤHbuWG
    [vbird@linux ~]$ w
     16:50:39  up  1:58,  2 users,  load average: 0.00, 0.00, 0.00
    USER     TTY      FROM      LOGIN@   IDLE   JCPU   PCPU  WHAT
    vbird    pts/0    vbird     4:37pm  0.00s  0.06s  0.01s  w
    dmtsai   pts/1    dmtsai    4:38pm  1:51   0.07s  0.01s  man write
    
    ڥH vbird ǰe@ӰT dmtsai ɡAiHo˰G
    [vbird@linux ~]$ write dmtsai
    Hi, How are you doing today....
    Nothing.... just say hello to you!
    <==o̫U [ctrl]+d
    
    ɡAt@ݪ dmtsai bL׺ݤWN|X{pUҥܡG
    [dmtsai@linux ~]$ 
    Hi, How are you doing today....
    Nothing.... just say hello to you!
    EOF
    
    ǩǡߨ|T^ dmtsai IL...... dmtsai bdơAzI oǰT|ߨ襕_ dmtsai 쥻u@IҥHApG dmtsai oӤHQnTA UFoӰʧ@G
    [dmtsai@linux ~]$ mesg n
    
    ҥHA vbird AUF write ɡAN|X{G
    [vbird@linux ~]$ write dmtsai
    write: dmtsai has messages disabled
    
    IIIAѥGHӦpGQnѶ}ܡAAUFy mesg y zNnաIQnDثe mesg AAUFy mesg zYiIAIH

    ۹ write OȰw@ӨϥΪ̨Ӷǡy²TzAڭ٥iHyҦtΤWϥΪ̶ǰe²Tz pUFHIII wall YiڡILyk]O²檺I
    [root@linux ~]# wall "I will shutdown the linux server about 5m later.
    > If you still have to login, please tell me.
    > Or I will do it....."
    
    򰣫Dz mesg AO n A_hAKKINoӼsToI ^_^


    ϥΪ̶lHcG mail
    ϥ wall, write nϥΪ̦buW~iASL觋pڡH OC Linux DWϥΪ̳㦳@ mailbox ܡH ڭ̥i_HHϥΪ̰ڡIIMiHڡIڭ̥iHHB mailbox HOI @ӻA mailbox |mb /var/spool/mail ̭A@ӱb@ mailbox (ɮ)C |ҨӻAڪ dmtsai N㦳 /var/spool/mail/dmtsai o mailbox I

    ڸӦpHXHOHINϥ mail oӫOYiI oӫOΪk²檺AoˤUFGy mail username@localhost -s "lD" zYiI @ӻApGOHWϥΪ̡A򥻤WAsy @localhost zμgաI |ҨӻAڥH vbird HH dmtsai AHDOy nice to meet you zAhG
    [vbird@linux ~]$ mail dmtsai -s "nice to meet you"
    Hello, D.M. Tsai
    Nice to meet you in the network.
    You are so nice.  byebye!
    .   <==o̫ܭnAɡA̫@JpI . YiI
    Cc:  <==o̬OҿתyƥzAݭnHLHAҥH [Enter]
    [vbird@linux ~]$  <==X{ܦrAܿJFI
    
    IIIp@ӡAANwgHX@ʫH dmtsai oϥΪoAӥBAӫHDG nice to meet youAH󤺮eNpPW쪺CLAAγ\|ıo mail oӵ{nΡ ]bHsgL{ApGgrӫU Enter iJAe@檺ƫRI HSYաIڭ̨ϥθƬyɦVڡIIQΨӤp󪺲Ÿ ( < ) NiHFNLJnDFC]NOAAiH vi NH󤺮esnA MAH mail dmtsai -s "nice to meet you" < filename ӱNɮפeǿYiC

    DGбNAaؿUܼ (~/.bashrc) HۤvI
    G
      mail -s "bashrc file content" vbird < ~/.bashrc

    W쪺OyHHzDApGOnHOHIP˪ϥ mail ڡI ]ڥH dmtsai nJDAMJ mail A|o줰H
    [dmtsai@linux ~]$ mail
    Mail version 8.1 6/6/93.  Type ? for help.
    "/var/spool/mail/dmtsai": 1 message 1 new
    >N  1 vbird@linux.site  Fri Sep  2 23:53  16/552   "nice to meet you"
    &  <==o̥iHJܦhOApGnd\AJ ? YiI
    
    b mail ܦrO & ŸAOdFJ mail AڥiHݨڦ@ʫHA oʫH󪺫e > NثeBzHAӦbjŸ䨺 N NӫʫH|ŪLA pGڷQnDo mail OǡAiHb & Jy ? zANiHݨpUeG
    & ?
        Mail   Commands
    t <message list>                type messages
    n                               goto and type next message
    e <message list>                edit messages
    f <message list>                give head lines of messages
    d <message list>                delete messages
    s <message list> file           append messages to file
    u <message list>                undelete messages
    R <message list>                reply to message senders
    r <message list>                reply to message senders and all recipients
    pre <message list>              make messages go back to /usr/spool/mail
    m <user list>                   mail to specific users
    q                               quit, saving unresolved messages in mbox
    x                               quit, do not remove system mailbox
    h                               print out active message headers
    !                               shell escape
    cd [directory]                  chdir to directory or home if none given
    
    <message list> OCʶl󪺥䨺ӼƦrաIӴXӤ`OOG

    ONq
    hNH󪺼DCXӡCpGQnd\ 40 ʫH󥪥kBҦHYAiHJy h 40 z
    dRա㰲]ڭnR10ʫHAiHy d10 zApڷQnR 20-40 ʫHAiHy d20-40 zA LAoӰʧ@nͮĪܡAntX q oӫO~(ѦҩU)I
    sNHxsɮסC|ҨӻAڭnN 5 ʫH󪺤es ~/mail.file ܡAiHG y s 5 ~/mail.file zI
    xΪ̿J exit iHCoӬOy@ʧ@} mail {zNC קARFHAΪŪLAϥ exit |} mailAҥHi檺RP\Ūu@|LġC pGzuOd\@UlӤwܡA@ӻAijϥγo}աIDAunRYǫHC
    q۹ exit Oʧ@}A q h|iⶵʧ@G 1. NRH󲾥X mailbox ~F 2. N観\ŪLHsJ ~/mbox ABX mailbox ~Cq`ܳwϥ q }A ]AܮeѰOŪLNNɭPH󵹥LX mailbox

    mail oӫOe٦ܦhiHALAڭ̳o̶ȬOеzp@먭ϥΪ̨Өϥ mail ӤwAҥHNШ즹o ^_^

    ʼW[ϥΪ̡G
    @ӻAڭ̤ܫijjaϥΤʪ觋ӷsWϥΪ̡AOH ]ϥΪ̪إ߯AΨ GID/UID vYAӥBAPɮ/ؿv]YA ϥ useradd iHڭ̦۰ʳ]wn UID/GID aؿHήaؿv]wA OAʨӼW[ɭԡAi|ѪFѦAGɭP@ǧxZo͡C

    LAnAѾӨtΡA̦n٬OʨӭקLnAܤ֧ڭ̪bDiH̷ӦۤvNh׭qA ӤENtΪw]ȰڡIOA٬Oni|@UB̡ͭAnʳ]wbɡA znuAѦۤvb@AרOPv]w譱I naIUNڭ̨Ӫ@o ^_^


    @ˬdu
    JMnʭקb]wɡA@ˬdsաBbONiDڡ רOӱKXഫ pwconv pwuconv oӪNinܩOI Uڭ̵yLФ@UoǫOaI


  • pwck
  • pwck oӫObˬd /etc/passwd oӱb]wɤTAPڪaؿO_sbTA ٥iH /etc/passwd /etc/shadow TO_@PAt~A pG /etc/passwd ~ɡA|ܨϥΪ̭׭qC @ӻAڥuOQγoӪNˬdڪJO_TNOFC
    [root@linux ~]# pwck
    user adm: directory /var/adm does not exist
    user news: directory /etc/news does not exist
    user uucp: directory /var/spool/uucp does not exist
    
    @IWȬOiڡAoDZbèSaؿAѩ󨺨DZbjOtαbA T]ݭnaؿAҥHAOy`~IzIzLC ^_^C ۹sˬdiHϥ grpck oӫOաI


  • pwconv
  • oӫODnتObyN /etc/passwd bPKXAʨ /etc/shadow Iz Unix tηèS /etc/shadow OAҥHAϥΪ̪nJKXOb /etc/passwd ĤGAӬFtΦwA~NKXƲʨ /etc/shadow C ϥ pwconv AiHG
    • /etc/passwd /etc/shadow AY /etc/passwd sbbèS /etc/shadow KXɡAh pwconv |h /etc/login.defs άKXơAëإ߸ӱb /etc/shadow ơF
    • Y /etc/passwd sb[K᪺KXƮɡAh pwconv |NӱKX沾ʨ /etc/shadow AñN쥻 /etc/passwd ۹KXܦ x I
    @ӻApGz`ϥ useradd W[ϥΪ̮ɡAϥ pwconv ä|󪺰ʧ@A] /etc/passwd P /etc/shadow ä|WzIDڡI ^_^C LApGʳ]wbAo pwconv NܭnoI


  • pwunconv
  • ۹ pwconv A pwunconv hOyN /etc/shadow KXƼg^ /etc/passwd A åBR /etc/shadow ɮסCzoӫObA̦nnϥΰաI ]L|NA /etc/shadow RIpGAѰOƥAS|ϥ pwconv ܡA YOI


  • chpasswd
  • chpasswd OӮ쪺OALiHyŪJ[KeKXAåBgL[KA N[K᪺KXgJ /etc/shadow CzoӫOܱ`QϥΦbjqظmbpI LiH Standard input ŪJơACƪ榡Oy username:password zC |ҨӻAڪtηӨϥΪ̱b dmtsai AڷQnsLKX (update) A pLKXO abcdefg ܡAڥiHo˰G
    [root@linux ~]# echo "dmtsai:abcdefg" | chpasswd
    
    _aIo˴NiHsFOIbw]pA chpasswd ϥΪO DES [Kkӥ[KA ڭ̥iHϥ chpasswd -m Өϥ FC4 w] MD5 [KkALA FC4 GǩǪAڦѬOLkϥ -m ӹFoӫOCLצpA ٬OiHϥ chpasswd DES [KI ϥ DES k[KAb /etc/shadow KX椺ALKXƬ 13 A AGHH

    SbAp¼Ʀrbإ
    bڭAѤF UID/GID PbYA򥻤WAzAѤFAԣڭ̤ijϥί¼ƦrbFI ]ܦhɭԡAtη|dMռƦrOybz٬OyUIDzAoOܦnա ]]AbYǪUAOSkϥμƦrӫإ߱bCҦpb Red Hat 9 ҤA ϥΡy useradd 1234 zL|ܡy useradd: invalid user name '1234' zIIIAѤFܡHI (LAoӰDb FC4 osbI] FC4 iHإ߯¼Ʀrb)

    LAɭԡAxROڡ㦳٬Oonإ߳o譱bAӦpOnH IMiHʨӫإ߳o˪bաILAFtΦw_A٬Oijϥί¼ƦrbաI ]AUdҷAڭ̨ϥΤʪ觋ӫإߤ@ӦW normaluser bA ӥBoӱbݩ normalgroup oӸsաCOKIӨBJӦpOnOH ѫeӬݡAzAѤFbPsլOP /etc/group, /etc/shadow, /etc/passwd, /etc/gshadow A]AӰʧ@Oo˪G
    1. إߩһݭns ( vi /etc/group )F
    2. N /etc/group P /etc/gshadow PB ( grpconv )F
    3. إ߱bUݩ ( vi /etc/passwd )F
    4. N /etc/passwd P /etc/shadow PB ( pwconv )F
    5. إ߸ӱbKX ( passwd accountname )F
    6. إߨϥΪ̮aؿ ( cp -a /etc/skel /home/accountname )F
    7. ϥΪ̮aؿݩ ( chown -R accountname.group /home/accountname )C
    ²檺aIڭ̨Ӫ@o
    1. إ߸s normalgroup A] 520 o GID SQϥΡIåBPB gshadow
    [root@linux ~]# vi /etc/group
    # b̫@[JUo@I
    normalgroup:x:520:
    [root@linux ~]# grpconv
    [root@linux ~]# grep 'normalgroup' /etc/group /etc/gshadow
    /etc/group:normalgroup:x:520:
    /etc/gshadow:normalgroup:x::
    # ²IdwsoI ^_^
    
    2. إ normaluser oӱbA] UID 700 SQϥαI
    [root@linux ~]# vi /etc/passwd
    # b̫@[JUo@I
    normaluser:x:700:520::/home/normaluser:/bin/bash
    
    3. PBƱKXAåBإ߸ӨϥΪ̪KX
    [root@linux ~]# pwconv
    [root@linux ~]# grep 'normaluser' /etc/passwd /etc/shadow
    /etc/passwd:normaluser:x:700:520::/home/normaluser:/bin/bash
    /etc/shadow:normaluser:x:13030:0:99999:7:::
    # ISSIwgإߧoOKX٤
    [root@linux ~]# passwd normaluser
    Changing password for user normaluser.
    New UNIX password:
    Retype new UNIX password:
    passwd: all authentication tokens updated successfully.
    
    4. إߨϥΪ̮aؿAåB׭qvI
    [root@linux ~]# cp -a /etc/skel /home/normaluser
    [root@linux ~]# chown -R normaluser:normalgroup /home/normaluser
    
    OháIo˴NdwF@ӱb]wFI qHAAiHإߥW٪bo㤣LA٬Oijz]w@ǫܩǫܩǪbWٰաI


    }׺ݾnJb (ex>mail acccount)
    ڭ̤WإߪoӱbOyiHnJtΪbzApGQnإߤ@ӤnJtΪbA Ҧp¨ϥζl󦬵oHӤwbASӦp]wOH²ա AiHo˷QG ]NOAҦBJPWY쪺ʧ@@ˡALAֱFܦhPaؿ]w欰NOFC Uڰ]ڪtθ̭ӥs mail s (/etc/group) AL GID O 12 (H FC4 )A t~AoӨϥΪ̪b popuser A] UID 720 AӦpإߩOH
    1. קbݩ
    [root@linux ~]# vi /etc/passwd
    popuser:x:720:12::/home/popuser:/sbin/nologin
    
    2. KXPBAåBKXI
    [root@linux ~]# pwconv
    [root@linux ~]# passwd popuser
    
    o˴NS OK FzIuO²FǧJ....

    SӦpRoDZbOHڡI٬OijQ userdel ա²㰮ܤSW pGQnȮɲӤwܡAQ passwd -l passwd -u aI ^_^C pGuQnʨӲoӱbܡANo˰G
    1. H find / -user account XҦbɮסAñNLRF
    2. N /etc/passwd P /etc/shadow ƧRF
    3. N /etc/group /etc/gshadow ƧRF
    4. N /home UӱbؿRF
    5. /var/spool/mail H /var/spool/cron ̭NϥΪɮקRC
    o˴NʧRա


    @Ӥjqظmbd
    nháAܦhɭԡAڭ̳iݭnjqظmbA |ҨӻAǮխnPǫإߥL̪bANܥiݭnա @ӻAإ߱bni檺esu@ܦhA]Anإ߱bWٻPӱbKX oӬO̰QաӥB٭nMwݭnϥέ@ӸsաIInQPı

    ثeܦhѤjqإ߱buAҦpxnߪsjvG ѪnΪ cmpwd {A LAڭ̤]iHQ²檺 script ڭ̹FIҦpUo{A L浲GPsjvѪ{thա O]ڬOH useradd ӷsWA ҥHAYϤA UID A]OiHAΪա

    {SOG k]²檺nRЦۦѦҪաIAh ϥήɽЪ`NAnbaϥΪDWiաA]..... o{|jqإ߱bI^_^
    #!/bin/bash
    #
    # o{DnbzإߤjqbΡA
    # hϥΤkаѦҡG
    # http://vbird.org.cn/linux_basic/0410accountmanager.php#manual_amount
    #
    # {ۦ}oAb FC4 WϥΨSDA
    # Oҵ|oͿ~IϥήɡAЦۦt᭷I
    #
    # History:
    # 2005/09/05    VBird   ~gAϥάݬݥ
    PATH=/sbin:/usr/sbin:/bin:/usr/bin; export PATH
    accountfile="user.passwd"
    
    # 1. ibJI
    read -p "b}YNX ( Input title name, ex> std )======> " username_start
    read -p "bhũΦ~ ( Input degree, ex> 1 or enter )=> " username_degree
    read -p "_lX ( Input start number, ex> 520 )========> " nu_start
    read -p "bƶq ( Input amount of users, ex> 100 )=====> " nu_amount
    read -p "KXз 1) PbۦP 2)üƦۭq ==============> " pwm
    if [ "$username_start" == "" ]; then
            echo "SJ}YNXAAI" ; exit 1
    fi
    testing1=`echo $nu_amount | grep '[^0-9]' `
    testing2=`echo $nu_start  | grep '[^0-9]' `
    if [ "$testing1" != "" ] || [ "$testing2" != "" ]; then
            echo "JXաIDƦreI" ; exit 1
    fi
    if [ "$pwm" != "1" ]; then
            pwm="2"
    fi
    
    # 2. }lXbPKXɮסI
    [ -f "$accountfile" ] && mv $accountfile "$accountfile"`date +%Y%m%d`
    nu_end=$(($nu_start+$nu_amount-1))
    for (( i=$nu_start; i<=$nu_end; i++ ))
    do
            account=$username_start$username_degree$i
            if [ "$pwm" == "1" ]; then
                    password="$account"
            else
                    password=""
                    test_nu=0
                    until [ "$test_nu" == "8" ]
                    do
                            temp_nu=$(($RANDOM*50/32767+30))
                            until [ "$temp_nu" != "60" ]
                            do
                                    temp_nu=$(($RANDOM*50/32767+30))
                            done
                            test_nu=$(($test_nu+1))
                            temp_ch=`printf "\x$temp_nu"`
                            password=$password$temp_ch
                    done
            fi
            echo "$account":"$password" | tee -a "$accountfile"
    done
    
    # 3. }lإ߱bPKXI
            cat "$accountfile" | cut -d':' -f1 | xargs -n 1 useradd -m
            chpasswd < "$accountfile"
            pwconv
    	echo "OKIإߧI"
    
    o{iHbUsUG

    Dm
    ( nݵ׽бNƹʨyGzUťճBAUťճBYi )

    2002/05/15GĤ@
    2003/02/10GssƻP[J FAQ
    2005/08/25G[J@ӤjqظmbҡA²满@UӤwI
    2005/08/29GN쥻¤m B
    2005/08/31G] userconf wgAonΤFAϥΫOҦ²AҥHANLF
    2005/09/05GשNjqظmb{gFuOڡI
    2006/03/02GsϥΪ UID XA 65535 ɯŨ 2^32-1 ojI
    2007/04/15G쥻g /etc/pam.d/limits.conf FIӬO /etc/security/limits.conf ~I
    2008/04/28Gsudo KXsJgFIwgsAbod\ݬݡCPº superpmo iI
    hintGХ[J ACL AñNgWאּyLinux b޲zPiv]wzt SELinux P ACL BzaI