15.2. User and Group Management Tools

Managing users and groups can be tiresome; this is why Red Hat Enterprise Linux provides tools and conventions to make this task easier to manage.

The easiest way to manage users and groups is through the graphical application, User Manager (system-config-users). For more information on User Manager, refer to Section 15.1, “User and Group Configuration”.

The following command line tools can also be used to manage users and groups:

useradd, usermod, and userdel — Industry-standard methods of adding, deleting and modifying user accounts
groupadd, groupmod, and groupdel — Industry-standard methods of adding, deleting, and modifying user groups
gpasswd — Industry-standard method of administering the /etc/group file
pwck, grpck — Tools used for the verification of the password, group, and associated shadow files
pwconv, pwunconv — Tools used for the conversion of passwords to shadow passwords and back to standard passwords

15.2.1. Command Line Configuration

If you prefer command line tools or do not have the X Window System installed, use following to configure users and groups.

Adding a User

To add a user to the system:

Issue the useradd command to create a locked user account:
```
useradd <username> 
```
Unlock the account by issuing the passwd command to assign a password and set password aging guidelines:
```
passwd <username> 
```

Command line options for useradd are detailed in Table 15.1, “ useradd Command Line Options”.

Table 15.1. `useradd` Command Line Options

Option	Description
`-c` '`<comment>`'	`<comment>` can be replaced with any string. This option is generally used to specify the full name of a user.
`-d` `<home-dir>`	Home directory to be used instead of default `/home/<username>/`
`-e` `<date>`	Date for the account to be disabled in the format YYYY-MM-DD
`-f` `<days>`	Number of days after the password expires until the account is disabled. If `0` is specified, the account is disabled immediately after the password expires. If `-1` is specified, the account is not be disabled after the password expires.
`-g` `<group-name>`	Group name or group number for the user's default group. The group must exist prior to being specified here.
`-G` `<group-list>`	List of additional (other than default) group names or group numbers, separated by commas, of which the user is a member. The groups must exist prior to being specified here.
`-m`	Create the home directory if it does not exist.
`-M`	Do not create the home directory.
`-N`	Do not create a user private group for the user.
`-p` `<password>`	The password encrypted with `crypt`
`-r`	Create a system account with a UID less than 500 and without a home directory
`-s`	User's login shell, which defaults to `/bin/bash`
`-u` `<uid>`	User ID for the user, which must be unique and greater than 499

Adding a Group

To add a group to the system, use the command groupadd:

groupadd <group-name>

Command line options for groupadd are detailed in Table 15.2, “ groupadd Command Line Options”.

Table 15.2. `groupadd` Command Line Options

Option	Description
-f, --force	When used with `-g` `<gid>` and `<gid>` already exists, `groupadd` will choose another unique `<gid>` for the group.
`-g` `<gid>`	Group ID for the group, which must be unique and greater than 499
`-K, --key KEY=VALUE`	override `/etc/login.defs` defaults
`-o`, `--non-unique`	allow to create groups with duplicate
`-p`, `--password` `PASSWORD`	use this encrypted password for the new group
`-r`	Create a system group with a GID less than 500

Password Aging

For security reasons, it is advisable to require users to change their passwords periodically. This can be done when adding or editing a user on the Password Info tab of the User Manager.

To configure password expiration for a user from a shell prompt, use the chage command with an option from Table 15.3, “ chage Command Line Options”, followed by the username.

Important

Shadow passwords must be enabled to use the chage command. For more information, see Section 15.6, “Shadow Passwords”.

Table 15.3. `chage` Command Line Options

Option	Description
`-d` `<days>`	Specifies the number of days since January 1, 1970 the password was changed
`-E` `<date>`	Specifies the date on which the account is locked, in the format YYYY-MM-DD. Instead of the date, the number of days since January 1, 1970 can also be used.
`-I` `<days>`	Specifies the number of inactive days after the password expiration before locking the account. If the value is 0, the account is not locked after the password expires.
`-l`	Lists current account aging settings.
`-m` `<days>`	Specify the minimum number of days after which the user must change passwords. If the value is 0, the password does not expire.
`-M` `<days>`	Specify the maximum number of days for which the password is valid. When the number of days specified by this option plus the number of days specified with the `-d` option is less than the current day, the user must change passwords before using the account.
`-W` `<days>`	Specifies the number of days before the password expiration date to warn the user.

Tip

If the chage command is followed directly by a username (with no options), it displays the current password aging values and allows them to be changed interactively.

You can configure a password to expire the first time a user logs in. This forces users to change passwords immediately.

Set up an initial password — There are two common approaches to this step. The administrator can assign a default password or assign a null password.
To assign a default password, use the following steps:
- Start the command line Python interpreter with the python command. It displays the following:
```
Python 2.4.3 (#1, Jul 21 2006, 08:46:09)
[GCC 4.1.1 20060718 (Application Stack 4.1.1-9)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>>
```
- At the prompt, type the following commands. Replace <password> with the password to encrypt and <salt> with a random combination of at least 2 of the following: any alphanumeric character, the slash (/) character or a dot (.):
```
import crypt; print crypt.crypt("<password>","<salt>")
```
  The output is the encrypted password, similar to '12CsGd8FRcMSM'.
- Press Ctrl-D to exit the Python interpreter.
- At the shell, enter the following command (replacing <encrypted-password> with the encrypted output of the Python interpreter):
```
usermod -p "<encrypted-password>" <username>
```
Alternatively, you can assign a null password instead of an initial password. To do this, use the following command:
```
usermod -p "" username
```
Caution
Using a null password, while convenient, is a highly unsecure practice, as any third party can log in first and access the system using the unsecure username. Always make sure that the user is ready to log in before unlocking an account with a null password.
Force immediate password expiration — Type the following command:
```
chage -d 0 username
```
This command sets the value for the date the password was last changed to the epoch (January 1, 1970). This value forces immediate password expiration no matter what password aging policy, if any, is in place.

Upon the initial log in, the user is now prompted for a new password.