In AIX user account is created using smitty and/or command line. This process is influenced by contents of files located in directories
The
example, if your users “home” directories will not be located in the
/etc, /etc/security and /usr/lib/security.The
/usr/lib/security/mkuser.default defines the basics defaults like group membership, home directory and shell. If you do not supply this information during user creation, it will be resolved using the contents of this file. So forexample, if your users “home” directories will not be located in the
/home but in /ClusterHome, and they belong to the group called myGroup then you should modify the “user” stanza in the/usr/lib/security/mkuser.default as follows:user:pgrp = myGroupgroups = staffshell = /usr/bin/kshhome = /CluserHome/$USER/usr/lib/security/mkuser.sys sets attributes of user home directory and the contents of its startup script (~/.profile in the case of ksh/sh). This file also creates the users “.profile” using the file /etc/security/.profile as the template.
As its name implies the
/etc/security/limits sets the limits on the amount of various system resources user is allowed to use. For example, here you set the maximum size of user created files (fsize), CPU (cpu), number of files (nofiles) or the core size (core). The value of “-1” indicated the “unlimited”. For example, the “default” stanza of this file may show the following values:default:fsize = -1core = 2097151cpu = -1data = -1rss = -1stack = -1nofiles = -1
The above restricts only the core size to 2097151 blocks, all the remaining parameters are set to “unlimited”. Please note, that each user may have his/hers stanza, which values are different then the ones contains in the “default” stanza. In such case, the user values take precedence.
User passwords used to be stored in the
/etc/passwd. After a while, “UNIXEs” removed the encrypted password field from the /etc/password and placed it in the special file called/etc/shadow which is readable only by root. AIX went one-step further; all “sensitive” user information is kept in files in directory /etc/security. Password details, like the password itself, the time of its last change, need to change it at the next login, etc are stored in file/etc/security/passwd. Details controlling aspect of password management like for example, frequency of password change, the password length, the minimum number of digits and so forth are defined in /etc/security/user. This file just like /etc/security/limitshas the default stanza that contains definition of attributes that apply to users for which these attributes were not individually set, for example:default:admin = false No administrative privilegeslogin = true Yes, user can login directlysu = true Yes, user can ‘su’ to another accountdaemon = true Yes, user can execute programs via SRCrlogin = true Yes, user can login remotelysugroups = ALL Any groups can ‘su’ to this accountadmgroups = User administers no other groupsttys = ALL Which terminals can access the user accountauth1 = SYSTEM The first authentication methodauth2 = NONE The second authentication methodtpath = nosak Defines the user’s trusted path characteristicsumask = 022 Definition of permissions for the created objectsexpires = 0 Date of account expiration (0 = never expires)SYSTEM = "compat" Authentication methodslogintimes = Times the user can loginpwdwarntime = 14 The number of days, user will be forced to change passwordaccount_locked = false Can user login or not?loginretries = 5 How many invalid login attempts will lock out the accounthistexpire = 0 The number of weeks, user will not be able to reuse the passwordhistsize = 5 The number of previous passwords that cannot be reusedminage = 1 The minimum number of weeks between password changesmaxage = 13 The maximum age of password in weeksmaxexpired = 1 The number of weeks after maxage that user can still change his/her passwordLiczba tygodni po maxage w której użytkownik może zmienić hasłominalpha = 1 The minimum number of alpha charactersminother = 1 The minimum number of no alpha charactersminlen = 8 The minimum length of a passwordmindiff = 3 The minimum number of different characters in the new passwordMinimalnej ilości różnych charakterów pomiędzy hasłamimaxrepeats = 8 The maximum number of times a character can be repeated ( 8 = unlimited) Charakter nie może się powtarzać więcej niż ta wartośćdictionlist = The path to the dictionary filespwdchecks = Location of external password validation engine
The file
/etc/security/passwd has stanza for every user defined on the system. Its entries include the encrypted password, time of its last change, and flags. The content of the flags filed may for example indicate that the user will have to change it at the next login (flags = ADMCHG).
The Files Controlling User Environment and his Experience:
/etc/security/environ Contains the environment attributes for users./etc/security/lastlog Contains the last login attributes for users./etc/security/limits Contains process resource limits for users./etc/security/user Contains extended attributes for users./usr/lib/security/mkuser.default Contains the default attributes for new users./usr/lib/security/mkuser.sys Customizes new user accounts./etc/passwd Contains the basic attributes of users./etc/security/passwd Contains password information./etc/security/login.cfg Contains system default login parameters./etc/utmp Contains a record of users logged into the system./var/adm/wtmp Contains connect-time accounting records./etc/security/failedlogin Records all failed login attempts./etc/motd Contains the message to be displayed every time a user logs in to the system./etc/environment Specifies the basic environment for all processes./etc/profile Specifies additional environment settings for all users.$HOME/.profile Specifies environment settings for a specific user./etc/group Contains the basic attributes of groups./etc/security/group Contains the extended attributes of groups.
All user related activities (create/edit/delete) can be performed using “smitt/smitty” or via a command line.
Commands to Administer Users:
mkuser Creates a new user account.
passwd Creates or changes the password of a user.
chuser Changes user attributes.
lsuser Displays user account attributes. Wyświetla cechy użytkownika
rmuser Removes a user account. Usuwa użytkownika
chsec Changes the attributes in the security stanza files.
login Initiates a user session.
who Identifies the users currently logged in.
dtconfig Enables or disables the desktop autostart feature.
passwd Creates or changes the password of a user.
chuser Changes user attributes.
lsuser Displays user account attributes. Wyświetla cechy użytkownika
rmuser Removes a user account. Usuwa użytkownika
chsec Changes the attributes in the security stanza files.
login Initiates a user session.
who Identifies the users currently logged in.
dtconfig Enables or disables the desktop autostart feature.
User creation
Before you create the first user, modify at least these three files:
Before you create the first user, modify at least these three files:
/etc/security/.profile,/usr/lib/security/mkuser.default and /usr/lib/security/mkuser.sys. Now, you will not need to specify location of user’s home directory, his shell, .profile, etc. All these values will be taken from the entries in these files. Next, create the required group or groups. To create user account with a command study the following example :mkuser id=30189 pgrp=secret gecos='Unix Admin' surya
The last command will create a user named ‘surya’ with its numerical identification (UID) defined as 20189. This user is the member of the ‘secret’ group. The gecos field describes the account in more memorable details. Note, that the shell and the location of the user home directory has not been given – these values will be provided from the file mentioned above. If the UID was not given it will be automatically calculated using the first not assigned value. Creating a user account, you should always specify its UID. Many administrators do not start general UID’s bellow 3000 – this is a good practice, which helps to distinguish between the ‘system’ and the ‘general’ accounts.
Few things happen as the result of the last command. First, the user definition will be added to the
/etc/passwd, the user list associated with his group will be modified in the/etc/group, /etc/security/user will be modified to include a short stanza:surya:admin = false
If you look at the user entry in
/etc/passwd you will notice the ‘*’ in it second field indicating that the password has not been set – user will not be allowed to login!surya:*:30189:3333:Unix Admin:/home/surya:/usr/bin/ksh
Each line of
/etc/passwd describes a single user. The order in which this information is presented is always the same: login:uid:gid:gecos:home:shell, where ‘gid’ is the group identification number from the /etc/group.
To assign a password to the ‘surya’ account execute as root:
Unixmantra:/root>passwd suryaChanging password for "surya"surya's New password: Enter the new password again:
You will have to enter the password two times – to make sure you remember it well. As the result of your action the
* will be replaced by the ! [lang-en]and the user stanza in the/etc/security/passwd will be created:UnixMantra:/root> grep -wp surya /etc/security/passwdsurya: password = V20k5RyLcrXmIlastupdate = 1249390681flags = ADMCHG
The ‘ADMCHG’ indicates that the user will be required to change his/her password at the first login attempt.
If you do not want a user to be required to change password at the first login then you have to reset the user
This is done executing the command
flags attribute in /etc/security/passwd.This is done executing the command
pwdadmin –c login_name.UnixMantra:/root> pwdamd –c suryaUnixMantra:/root> grep -wp surya /etc/security/passwdsurya: password = V20k5RyLcrXmIlastupdate = 1249390681flags =
To list the attributes of a user account execute the [lang-en]
lsuser user_name.UnixMantra:/root> lsuser surya
surya id=30189 pgrp=secret groups=secret home=/home/surya shell=/usr/bin/ksh gecos=Unix Admin login=true su=true rlogin=true daemon=true admin=false sugroups=ALL admgroups= tpath=nosak ttys=ALL expires=0 auth1=SYSTEM auth2=NONE umask=22 registry=files SYSTEM=compat logintimes= loginretries=5 pwdwarntime=14 account_locked=false minage=1 maxage=13 maxexpired=1 minalpha=1 minother=1 mindiff=3 maxrepeats=8 minlen=8 histexpire=0 histsize=5 pwdchecks= dictionlist= fsize=-1 cpu=-1 data=262144 stack=65536 core=2097151 rss=65536 nofiles=2000 roles=
To change user attributes:
Each user environment consists of three elements: general information, access security elements and the password. The output of the
Each user environment consists of three elements: general information, access security elements and the password. The output of the
lsuser command starts with the general information like uid, group membership, home directory, shell and gecos. The ‘login’ field marks the start of the access security elements. These are the attributes delivered mostly from the file /etc/security/user. Finally, there is the password associated with the user account. The values of the general attributes can be changed executing the chusercommand. The security attributes are manipulated with the chsec command but most administrators will use the chuser command for this purpose as it requires less typing and no file names.
Changing user attributes can be demonstrated with the case when user is not longer allowed to login into a host because he exceeded the number of the allowed failed login attempts (
unsuccessful_login_count). Let list our userUnixMantra:/root>lsuser surya
surya id=30189 pgrp=staff groups=staff home=/home/surya shell=/usr/bin/ksh gecos=Unix Admin login=true su=true rlogin=true daemon=true admin=false sugroups=ALL admgroups= tpath=nosak ttys=ALL expires=0 auth1=SYSTEM auth2=NONE umask=22 registry=files SYSTEM=compat logintimes= loginretries=5 pwdwarntime=14 account_locked=false minage=1 maxage=13 maxexpired=1 minalpha=1 minother=1 mindiff=3 maxrepeats=8 minlen=8 histexpire=0 histsize=5 pwdchecks= dictionlist= fsize=-1 cpu=-1 data=262144 stack=65536 core=2097151 rss=65536 nofiles=2000 time_last_login=1249392187 time_last_unsuccessful_login=1249392203 tty_last_login=/dev/pts/30 tty_last_unsuccessful_login=ssh host_last_login=000e7f6d9087.um.com host_last_unsuccessful_login=000e7f6d9087.um.com unsuccessful_login_count=6 roles=
Look at
loginretries=5 and unsuccessful_login_count=6. The second number exceeds the first one – the user is allowed five logins and if one by one they are not correct the user is locked out and he will not be able to login until you set theunsuccessful_login_count=0 and reset his password executing the passwd command.UnixMantra:/root>chuser unsuccessful_login_count=0 surya
Be aware, that changing an individual user attributes modifies his stanzas in appropriate files in
/etc and /etc/security. [lang-en]In the last case, the loginretries = 5 value is set in the default stanza of the /etc/security/user. After you, execute:UnixMantra:/root>chuser loginretries=15 suryaUnixMantra:/root>grep -wp surya /etc/security/usersurya:admin = falseloginretries = 15epctrns1:/root>
The attribute entry in the user stanza replaces the value of the corresponding attribute set in the
default stanza.
I recommend that you do not make a habit and manually changing user attributes editing the appropriate files.
Login issues
Occasionally, a user or users will experience difficulties trying to login into a host. Rarely, it could mean that too many users belongs to a single group (I have heard about but I have never experienced it). Usually it is the result of a discrepancy between the contents of the files in
Occasionally, a user or users will experience difficulties trying to login into a host. Rarely, it could mean that too many users belongs to a single group (I have heard about but I have never experienced it). Usually it is the result of a discrepancy between the contents of the files in
/etc /etc/security. The command pwdck can be executed against a single or all users. This command can fix and resolve all discrepancies or it can just report their nature.
[/alng_en]So far, we have discussed the parameters controlling access and login experience of an individual user. Of course, for some machines the
default stanza in one or more files in /etc/security can do it for all users. There are other aspects of user login sessions that cannot be treated individually. They are the “legal” shells, the allowed number of simultaneous logins, the length of time the system will wait for the password entry, the type of the authorization method (PAM or the Standard Unix one) and a quite of few more. Study the contents of the file /etc/security/login.cfg. It may help you secure your system.
0 blogger-disqus:
Post a Comment