Users and Groups

• You should read chapter 8.
• The basic user system on Linux/Unix consists of several files.
  • /etc/passwd
  • /etc/shadow
  • /etc/group
  • /etc/gshadow
• Two of these files are public read, two are not.
• All are colon delimited.
• /etc/passwd
  • login name
    • used frequently to show ownership (ls, who, ...)
  • Encrypted password
    • 13 character one way hash
    • Blank -> no password is required to log in.
    • other than 13 characters -> no long.
    • Mostly ignored if shadow passwords are in effect.
  • userid
    • Integer between 0 and 65,535
  • Default group id
  • gecos field
    • Full name
    • Office number
    • Office phone
    • Home phone
    • Other information
  • Home Directory
  • Login Shell
• /etc/passwd can be altered by normal users with
  • chfn
  • chsh
  • passwd
• Reading/changing the password file.
  • getpwnam, getpwuid
    • #include <sys/types.h>
    • #include <pwd.h>
    • struct passwd *getpwnam(const char *name);
    • struct passwd *getpwuid(uid_t uid);

    • struct passwd {
             char   *pw_name;       /* username */
             char   *pw_passwd;     /* user password */
             uid_t   pw_uid;        /* user ID */
             gid_t   pw_gid;        /* group ID */
             char   *pw_gecos;      /* user information */
             char   *pw_dir;        /* home directory */
             char   *pw_shell;      /* shell program */
      };
      	     

    • for use with things such as getuid, stat( man 2 stat)
    • Return a pointer to the field or NULL
    • Do not mess with the structure returned.

      
             The  return value may point to a static area, and may be overwritten by
             subsequent calls to getpwent(3), getpwnam(), or  getpwuid().   (Do  not
             pass the returned pointer to free(3).)
      
      	     

  • Look at pwGet.C
• There is another set
  • struct passwd *getpwent(void);
  • void setpwent(void);
  • void endpwent(void);
  • struct passwd *fgetpwent(FILE *stream);
  • int putpwent(const struct passwd *p, FILE *stream);
  • These will allow you to step through the ENTIRE password file
  • Look at pwUsers.C
• The shadow password file.
  • man 5 shadow
  • /etc/shadow
  • Usually no one has read access to this file
  • 9 fields
    • login name, must exist in /etc/passwd
    • Encrypted password, more on this to come.
    • Date of last password change. (More on this later)
      • If set to 0, the user must change their password on next login.
      • Empty means password aging is disabled.
    • minimum password age
      • Days until the password can be changed again.
      • 0 means no minimum.
    • maximum password age
      • days until the user MUST change their password.
      • After this has elapsed, the user must change their password on next login
      • Blank means no maximum age.
      • If this is lower than the minimum age, the user can not change their password.
    • Password warning period
      • days before the the password expires when the user should be warned.
    • password inactivity period
      • number of days after the password has expired in which the user can still login.
      • Empty means the policy will not be enforced
    • account expiration date
      • After this date the user is not permitted to log in.
    • reserved field
  • Processing the shadow password.
  • #include <shadow.h>
  • struct spwd *getspnam(const char *name);
  • struct spwd *getspent(void);
  • void setspent(void);
  • void endspent(void);
  • struct spwd *fgetspent(FILE *stream);
  • struct spwd *sgetspent(const char *s);
  • int putspent(const struct spwd *p, FILE *stream);
  • int lckpwdf(void);
  • int ulckpwdf(void);

  •            struct spwd {
                   char *sp_namp;     /* Login name */
                   char *sp_pwdp;     /* Encrypted password */
                   long  sp_lstchg;   /* Date of last change
                                         (measured in days since
                                         1970-01-01 00:00:00 +0000 (UTC)) */
                   long  sp_min;      /* Min # of days between changes */
                   long  sp_max;      /* Max # of days between changes */
                   long  sp_warn;     /* # of days before password expires
                                         to warn user to change it */
                   long  sp_inact;    /* # of days after password expires
                                         until account is disabled */
                   long  sp_expire;   /* Date when account expires
                                         (measured in days since
                                         1970-01-01 00:00:00 +0000 (UTC)) */
                   unsigned long sp_flag;  /* Reserved */
               };
    	 

  • A few comments
  • sgetspwent : given a string, it will parse it into the spwd structore
  • lckpwdf/ulckpwdf - lock and unlock the shadow password file.
    • These are advisory
    • and can fail