Users and Groups

• The password file
  • Contains most information about the users of the system.
  • This is augmented by /etc/shadow
• Note, the department systems use a distributed password file.
  • This information is still available but in a different form.
• /etc/passwd
  • 7 fields
  • Username
  • 13 character encryptd password
    • If this is not 13 characters, the account is deactivated
    • Unless a shadow password file is present
  • User id
    • Much like the inode number for a file.
    • This is the data that is kept with everything to keep track of the user.
    • see uid_t getuid(void);
    • There are actually multiple ids stored, but that is for later.
  • The group id
    • This is the default group id for a user.
  • The GECos field
    • Mostly unused
    • Was comma separated
    • Held real name, office number, home number ....
    • Currently mostly for real name of user, or comment.
  • Home directory
  • default shell.
• The shadow password file
  • /etc/shadow
  • The username
  • An encrypted password, more later
  • Account control information
    • Man 5 shadow
    • Date of last password change
    • minimum password age
    • password warning period
    • password inactivity period
    • Account expiration date
    • reserved
  • I don't expect you to know these, but know they exist.
  • Most if blank or 0 no enforcement
  • I think all are given in terms of days.
• The group file
  • /etc/group
  • Group name
  • Group password or empty
  • Group ID
  • A list of users in the group.
• The shadow group file
  • /etc/gshadow
  • man 5 gshadow
  • Group name
  • password, encrypted
  • administrators
    • comma separated list
    • who can change group password or add users
  • members
• id
  • System command to see various identities of a "process"
• newgrp
  • System command to change to a new group
    • Ok if you are listed in the group
    • Needs password if you are not listed in the group
• gpasswd
  • Cool tool for setting a group password.
• I have found groups to be less than perfectly effective over the years.
• Commands to process the user and group file.
• vipw or vigr (a symbolic link to vipw)
  • Locks the file
  • opens in $VISUAL or $EDITOR (that order)
  • On save, checks sanity
  • -s will edit shadow file.
• getpwnam, getpwuid
  • sys/types.h and pwd.h
  • struct passwd *getpwnam(const char *name)
  • struct passwd *getpwuid(uid_t uid);

  • struct passwd {
        char   *pw_name;       /* username */
        char   *pw_passwd;     /* user password */
        uid_t   pw_uid;        /* user ID */
        gid_t   pw_gid;        /* group ID */
        char   *pw_gecos;      /* user information */
        char   *pw_dir;        /* home directory */
        char   *pw_shell;      /* shell program */
    };
    
    	     

• shadow
  • shadow.h
  • struct spwd *getspnam(const char *name);

  • struct spwd {
        char *sp_namp;     /* Login name */
        char *sp_pwdp;     /* Encrypted password */
        long  sp_lstchg;   /* Date of last change
                              (measured in days since
                              1970-01-01 00:00:00 +0000 (UTC)) */
        long  sp_min;      /* Min # of days between changes */
        long  sp_max;      /* Max # of days between changes */
        long  sp_warn;     /* # of days before password expires
                              to warn user to change it */
        long  sp_inact;    /* # of days after password expires
                              until account is disabled */
        long  sp_expire;   /* Date when account expires
                              (measured in days since
                              1970-01-01 00:00:00 +0000 (UTC)) */
        unsigned long sp_flag;  /* Reserved */
    };
    

• getpwent, setpwent, endpwnt, putpwent
  • struct passwd *getpwent(void);
  • void setpwent(void);
  • void endpwent(void);
  • Get allows us to step through the password file one entry at a time.
  • set rewinds to the beginning of the password file.
  • end closes the password file.

  • while ((pwPTR = getpwent()) != nullptr) {
        process entry
    }
    endpwent();
    

• There are corresponding shadow/group/shadow-group commands.