Password aging policy for individual users can be set using the command choose two

Table 1. Command line utilities for managing users and groups

Adding a New User

To add a new user to the system, type the following at a shell prompt as root:

…where options are command-line options as described in Common useradd command-line options. By default, the useradd command creates a locked user account. To unlock the account, run the following command as root to assign a password:

Optionally, you can set a password aging policy. See Enabling Password Aging for information on how to enable password aging.

The command-line options associated with the usermod command are essentially the same. Note that if you want to add a user to another supplementary group, you need to use the -a, --append option with the -G option. Otherwise the list of supplementary groups for the user will be overwritten by those specified with the usermod -G command.

Explaining the Process

The following steps illustrate what happens if the command useradd juan is issued on a system that has shadow passwords enabled:

1. A new line for juan is created in /etc/passwd:

   juan:x:1001:1001::/home/juan:/bin/bash

   The line has the following characteristics:

   • It begins with the user name juan.

   • There is an x for the password field indicating that the system is using shadow passwords.

   • A UID greater than 999 is created. Under Fedora, UIDs below 1000 are reserved for system use and should not be assigned to users.

   • A GID greater than 999 is created. Under Fedora, GIDs below 1000 are reserved for system use and should not be assigned to users.

   • The optional GECOS information is left blank. The GECOS field can be used to provide additional information about the user, such as their full name or phone number.

   • The home directory for juan is set to /home/juan/.

   • The default shell is set to /bin/bash.

2. A new line for juan is created in /etc/shadow:

   juan:!!:14798:0:99999:7:::

   The line has the following characteristics:

   • It begins with the username juan.

   • Two exclamation marks (!!) appear in the password field of the /etc/shadow file, which locks the account.

     Note If an encrypted password is passed using the -p flag, it is placed in the /etc/shadow file on the new line for the user.

   • The password is set to never expire.

3. A new line for a group named juan is created in /etc/group:

   A group with the same name as a user is called a user private group. For more information on user private groups, see User Private Groups.

   The line created in /etc/group has the following characteristics:

   • It begins with the group name juan.

   • An x appears in the password field indicating that the system is using shadow group passwords.

   • The GID matches the one listed for juan's primary group in /etc/passwd.

4. A new line for a group named juan is created in /etc/gshadow:

   The line has the following characteristics:

   • It begins with the group name juan.

   • An exclamation mark (!) appears in the password field of the /etc/gshadow file, which locks the group.

   • All other fields are blank.

5. A directory for user juan is created in the /home/ directory:

   ~]# ls -ld /home/juan
   drwx------. 4 juan juan 4096 Mar  3 18:23 /home/juan

   This directory is owned by user juan and group juan. It has read, write, and execute privileges only for the user juan. All other permissions are denied.

6. The files within the /etc/skel/ directory (which contain default user settings) are copied into the new /home/juan/ directory. The contents of /etc/skel/ may vary depending on installed applications:

   ~]# ls -la /home/juan
   total 24
   drwx------. 4 juan juan 4096 Mar  3 18:23 .
   drwxr-xr-x. 5 root root 4096 Mar  3 18:23 ..
   -rw-r--r--. 1 juan juan   18 Jul 09 08:43 .bash_logout
   -rw-r--r--. 1 juan juan  176 Jul 09 08:43 .bash_profile
   -rw-r--r--. 1 juan juan  124 Jul 09 08:43 .bashrc
   drwxr-xr-x. 4 juan juan 4096 Jul 09 08:43 .mozilla

At this point, a locked account called juan exists on the system. To activate it, the administrator must next assign a password to the account using the passwd command and, optionally, set password aging guidelines.

Adding a New Group

To add a new group to the system, type the following at a shell prompt as root:

groupadd options group_name

Enabling Password Aging

For security reasons, it is advisable to require users to change their passwords periodically. This can be done by using the chage command.

To configure password expiration for a user from a shell prompt, run the following command as root:

…where options are command line options as described in chage command line options. When the chage command is followed directly by a username (that is, when no command line options are specified), it displays the specified users current password aging values and allows you to change these values interactively.

You can configure a password to expire the first time a user logs in. This forces users to change passwords immediately.

1. Set up an initial password. There are two common approaches to this step: you can either assign a default password, or you can use a null password.

   To assign a default password, type the following at a shell prompt as root:

   To assign a null password instead, use the following command:

   Avoid using null passwords whenever possible Using a null password, while convenient, is a highly insecure practice, as any third party can log in first and access the system using the insecure username. Always make sure that the user is ready to log in before unlocking an account with a null password.

2. Force immediate password expiration by running the following command as root:

   This command sets the value for the date the password was last changed to the epoch (January 1, 1970). This value forces immediate password expiration no matter what password aging policy, if any, is in place.

Upon the initial log in, the user is now prompted for a new password.

Enabling Automatic Logouts

Especially when the user is logged in as root, an unattended login session may pose a significant security risk. To reduce this risk, you can configure the system to automatically log out idle users after a fixed period of time:

1. Make sure the screen package is installed. You can do so by running the following command as root:

   For more information on how to install packages in Fedora, refer to Installing Packages.

2. As root, add the following line at the beginning of the /etc/profile file to make sure the processing of this file cannot be interrupted:

3. Add the following lines at the end of the /etc/profile file to start a screen session each time a user logs in to a virtual console or remotely:

   SCREENEXEC="screen"
   if [ -w $(tty) ]; then
     trap "exec $SCREENEXEC" 1 2 3 15
     echo -n 'Starting session in 10 seconds'
     sleep 10
     exec $SCREENEXEC
   fi

   Note that each time a new session starts, a message will be displayed and the user will have to wait ten seconds. To adjust the time to wait before starting a session, change the value after the sleep command.

4. Add the following lines to the /etc/screenrc configuration file to close the screen session after a given period of inactivity:

   idle 120 quit
   autodetach off

   This will set the time limit to 120 seconds. To adjust this limit, change the value after the idle directive.

   Alternatively, you can configure the system to only lock the session by using the following lines instead:

   idle 120 lockscreen
   autodetach off

   This way, a password will be required to unlock the session.

The changes take effect the next time a user logs in to the system.

Creating Group Directories

System administrators usually like to create a group for each major project and assign people to the group when they need to access that project’s files. With this traditional scheme, file management is difficult; when someone creates a file, it is associated with the primary group to which they belong. When a single person works on multiple projects, it becomes difficult to associate the right files with the right group. However, with the UPG scheme, groups are automatically assigned to files created within a directory with the setgid bit set. The setgid bit makes managing group projects that share a common directory very simple because any files a user creates within the directory are owned by the group that owns the directory.

For example, a group of people need to work on files in the /opt/myproject/ directory. Some people are trusted to modify the contents of this directory, but not everyone.

1. As root, create the /opt/myproject/ directory by typing the following at a shell prompt:

2. Add the myproject group to the system:

3. Associate the contents of the /opt/myproject/ directory with the myproject group:

   chown root:myproject /opt/myproject

4. Allow users in the group to create files within the directory and set the setgid bit:

   chmod 2775 /opt/myproject

   At this point, all members of the myproject group can create and edit files in the /opt/myproject/ directory without the administrator having to change file permissions every time users write new files. To verify that the permissions have been set correctly, run the following command:

   ~]# ls -ld /opt/myproject
   drwxrwsr-x. 3 root myproject 4096 Mar  3 18:31 /opt/myproject

5. Add users to the myproject group:

   usermod -aG myproject username

Which command is used to for password aging policy?

Which command enables you to change password aging for a user?

Which command is used to set up passwords for users?

Which command is used to list the aging information for a user?