第 10 堂課：使用者管理與 ACL 權限設定

[root@localhost ~]# authconfig --test | grep password
 shadow passwords are enabled
 password hashing algorithm is sha512

[root@localhost ~]# cat /etc/sysconfig/authconfig | grep -i passwd
PASSWDALGORITHM=sha512
USEPASSWDQC=no

[root@local ~]# useradd testuser1
[root@local ~]# passwd testuser1
Changing password for user testuser1.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

[root@local ~]# id testuser1
uid=1002(testuser1) gid=1002(testuser1) groups=1002(testuser1)

[root@local ~]# grep testuser1 /etc/passwd /etc/group /etc/shadow
/etc/passwd:testuser1:x:1002:1002::/home/testuser1:/bin/bash
/etc/group:testuser1:x:1002:
/etc/shadow:testuser1:$6$bgAJnRxx$lvgO10GAMg1aoHSzm/cR.GcW..:16924:0:99999:7:::

[root@localhost ~]# chage -l testuser1
Last password change                               : May 03, 2016
Password expires                                   : never
Password inactive                                  : never
Account expires                                    : never
Minimum number of days between password change     : 0
Maximum number of days between password change     : 99999
Number of days of warning before password expires  : 7

[root@localhost ~]# cat /etc/default/useradd
# useradd defaults file
GROUP=100               <==若為公開群組，使用 GID 100 的群組名稱
HOME=/home              <==預設使用者家目錄位置
INACTIVE=-1             <==密碼是否失效，預設不會失效！
EXPIRE=                 <==帳號是否需要失效 (shadow 第 8 欄位)
SHELL=/bin/bash         <==預設使用的 shell
SKEL=/etc/skel          <==預設使用者家目錄的參考依據
CREATE_MAIL_SPOOL=yes   <==是否要建立使用者郵件信箱

[root@localhost ~]# grep -v '#' /etc/login.defs | grep -v '^$'
MAIL_DIR        /var/spool/mail  <==使用者預設郵件信箱放置目錄

PASS_MAX_DAYS   99999    <==/etc/shadow 內的第 5 欄，多久需變更密碼日數
PASS_MIN_DAYS   0        <==/etc/shadow 內的第 4 欄，多久不可重新設定密碼日數
PASS_MIN_LEN    5        <==密碼最短的字元長度，已被 pam 模組取代，失去效用！
PASS_WARN_AGE   7        <==/etc/shadow 內的第 6 欄，過期前會警告的日數

UID_MIN          1000    <==使用者最小的 UID，意即小於 1000 的 UID 為系統保留
UID_MAX         60000    <==使用者能夠用的最大 UID
SYS_UID_MIN       201    <==保留給使用者自行設定的系統帳號最小值 UID
SYS_UID_MAX       999    <==保留給使用者自行設定的系統帳號最大值 UID
GID_MIN          1000    <==使用者自訂群組的最小 GID，小於 1000 為系統保留
GID_MAX         60000    <==使用者自訂群組的最大 GID
SYS_GID_MIN       201    <==保留給使用者自行設定的系統帳號最小值 GID
SYS_GID_MAX       999    <==保留給使用者自行設定的系統帳號最大值 GID

CREATE_HOME     yes      <==在不加 -M 及 -m 時，是否主動建立使用者家目錄？
UMASK           077      <==使用者家目錄建立的 umask ，因此權限會是 700
USERGROUPS_ENAB yes      <==使用 userdel 刪除時，是否會刪除初始群組
ENCRYPT_METHOD SHA512    <==密碼加密的機制使用的是 sha512 這一個機制！

[root@localhost ~]# userdel testuser1
[root@localhost ~]# ll -d /home/testuser1 /var/spool/mail/testuser1
drwx------. 3 1002 1002 74 May  3 18:26 /home/testuser1
-rw-rw----. 1 1002 mail  0 May  3 18:26 /var/spool/mail/testuser1
[root@localhost ~]# find / -nouser
/home/testuser1
/home/testuser1/.mozilla
/home/testuser1/.mozilla/extensions
/home/testuser1/.mozilla/plugins
/home/testuser1/.bash_logout
/home/testuser1/.bash_profile
/home/testuser1/.bashrc
/var/spool/mail/testuser1

for 變數名 in 內容1 內容2 內容3 ...
do
	執行的指令碼
done

[root@localhost ~]# mkdir bin; cd bin
[root@localhost bin]# vim allid.sh
#!/bin/bash
# This script will show all users id
# VBird 2016/05/03
users=$( cut -d ':' -f 1 /etc/passwd)
for username in ${users}
do
        id ${username}
done

[root@localhost bin]# chmod a+x allid.sh
[root@localhost bin]# allid.sh
uid=0(root) gid=0(root) groups=0(root)
uid=1(bin) gid=1(bin) groups=1(bin)
uid=2(daemon) gid=2(daemon) groups=2(daemon)
.......

[student@localhost ~]$ umask
0002

[root@localhost ~]# umask
0022

[root@localhost ~]# su - linuxuser1
[linuxuser1@localhost ~]$ umask 007
[linuxuser1@localhost ~]$ mkdir newdir
[linuxuser1@localhost ~]$ touch newfile
[linuxuser1@localhost ~]$ ll -d new*
drwxrwx---. 2 linuxuser1 linuxuser1 6 May  3 23:54 newdir
-rw-rw----. 1 linuxuser1 linuxuser1 0 May  3 23:54 newfil

[root@localhost ~]# cd /etc/skel
[root@localhost skel]# mkdir bin
[root@localhost skel]# vim .bashrc
# User specific aliases and functions
HISTSIZE=10000
HISTFILESIZE=10000
alias cp="cp -i"
alias mv="mv -i"
alias rm="rm -i"

[root@localhost skel]# useradd testuser2
[root@localhost skel]# ll /home/testuser2; tail -n 4 /home/testuser2/.bashrc
drwxr-xr-x. 2 testuser2 testuser2 6 May  3 19:56 bin
HISTFILESIZE=10000
alias cp="cp -i"
alias mv="mv -i"
alias rm="rm -i"

[root@localhost skel]# userdel -r testuser2

[root@localhost ~]# cd bin
[root@localhost bin]# vim mailuser.sh
#!/bin/bash
# This program will create mail users
# VBird 2016/05/03

for user in $(seq 1 5)
do
        username="mailuser${user}"
        userpass=$(openssl rand -base64 6)
        useradd -s /sbin/nologin ${username}
        echo ${userpass} | passwd --stdin ${username}
        echo "${username} ${userpass}" >> mailuserpw.txt
done

[root@localhost bin]# sh mailuser.sh
[root@localhost bin]# cat mailuserpw.txt
mailuser1 M8pk6GEt
mailuser2 HznQI88d
mailuser3 zKpg4eg/
mailuser4 aakuwjo/
mailuser5 VrJtokaT

[root@localhost bin]# grep mailuser /etc/passwd
mailuser1:x:1006:1006::/home/mailuser1:/sbin/nologin
mailuser2:x:1007:1007::/home/mailuser2:/sbin/nologin
mailuser3:x:1008:1008::/home/mailuser3:/sbin/nologin
mailuser4:x:1009:1009::/home/mailuser4:/sbin/nologin
mailuser5:x:1010:1010::/home/mailuser5:/sbin/nologin

[root@localhost ~]# useradd -u 399 -g users sysuser1
[root@localhost ~]# echo centos | passwd --stdin sysuser1
[root@localhost ~]# id sysuser1
uid=399(sysuser1) gid=100(users) groups=100(users)

[root@localhost ~]# groupadd project
[root@localhost ~]# useradd -G project pro1
[root@localhost ~]# useradd -G project pro2
[root@localhost ~]# useradd -G project pro3
[root@localhost ~]# echo password | passwd --stdin pro1
[root@localhost ~]# echo password | passwd --stdin pro2
[root@localhost ~]# echo password | passwd --stdin pro3
[root@localhost ~]# mkdir /srv/projecta
[root@localhost ~]# chgrp project /srv/projecta
[root@localhost ~]# chmod 2770 /srv/projecta
[root@localhost ~]# ll -d /srv/projecta
drwxrws---. 2 root project 6 May  3 21:43 /srv/projecta

[root@localhost ~]# dmesg | grep -i acl
[    0.609488] systemd[1]: systemd 219 running in system mode. (+PAM +AUDIT 
 +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS 
 +ACL +XZ -LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
[    1.763620] SGI XFS with ACLs, security attributes, no debug enabled

[root@localhost ~]# ll -d /srv/projecta
drwxrws---. 2 root project 6 May  3 21:43 /srv/projecta

[root@localhost ~]# setfacl -m u:student:rx /srv/projecta
[root@localhost ~]# ll -d /srv/projecta
drwxrws---+ 2 root project 6 May  3 21:43 /srv/projecta

[root@localhost ~]# getfacl /srv/projecta
# file: srv/projecta
# owner: root
# group: project
# flags: -s-
user::rwx          <==預設的擁有者權限
user:student:r-x   <==針對 student 的權限
group::rwx         <==預設的群組權限
mask::rwx          <==預設的 mask 權限
other::---

[root@localhost ~]# setfacl -m m::x /srv/projecta
[root@localhost ~]# getfacl /srv/projecta
# file: srv/projecta
# owner: root
# group: project
# flags: -s-
user::rwx
user:student:r-x                #effective:--x
group::rwx                      #effective:--x
mask::--x
other::---

[root@localhost ~]# setfacl -m m::rwx /srv/projecta
[root@localhost ~]# getfacl /srv/projecta

[root@localhost ~]# su - pro1
[pro1@localhost ~]$ cd /srv/projecta
[pro1@localhost projecta]$ mkdir newdir
[pro1@localhost projecta]$ touch newfile
[pro1@localhost projecta]$ ll -d new*
drwxrwsr-x. 2 pro1 project 6 May  4 00:37 newdir
-rw-rw-r--. 1 pro1 project 0 May  4 00:37 newfile

[root@localhost ~]# setfacl -m d:u:student:rx /srv/projecta
[root@localhost ~]# getfacl /srv/projecta
# file: srv/projecta
# owner: root
# group: project
# flags: -s-
user::rwx
user:student:r-x
group::rwx
mask::rwx
other::---
default:user::rwx
default:user:student:r-x
default:group::rwx
default:mask::rwx
default:other::---

[root@localhost ~]# setfacl -x u:student /srv/projecta

[root@localhost ~]# setfacl -b /srv/projecta
[root@localhost ~]# ll -d /srv/projecta/
drwxrws---. 3 root project 33 May  4 00:37 /srv/projecta/