7    Administering User Accounts and Groups

Assigning user accounts and organizing user accounts into related groups is the most common way that you provide system resources to users. This chapter describes user account and group administration, organized into the following sections:

7.1    Account Administration Options and Restrictions

Depending on your local system configuration, the user environment, and your personal preferences, there are several methods and a number of different utilities that you can use to administer user accounts . The following sections introduce and describe these options and identify any restrictions or requirements for their use.

7.1.1    Administrative Utilities

The operating system provides several different utilities that you can use to administer accounts. Not all are described in detail in this chapter. However, the principles of use are the same for all utilities. Refer to the online help and reference pages for each utility for specific information on the options available.

The utilities are listed in Table 7-1. You must be root user on UNIX, or the Windows NT domain administrator to use these utilities.

Table 7-1:  Utilities for Administering Accounts and Groups

Utility User Environment Description
SysMan Menu, Accounts options. Manage local users and groups. Manage NIS users and groups.

You can use the SysMan Menu from a wide variety of user environments (see Chapter 1). This utility provides limited administrative features, such as adding and deleting accounts and groups. It does not enable you to administer the default characteristics for UNIX accounts and groups. It does not allow you to choose the creation or deletion of associated (synchronized) Windows NT domain accounts but does this automatically, depending on how the account defaults are configured (with useradd or usermod).

The filter (search) features provided by SysMan Menu Accounts options make it the preferred method of managing a high volume of user accounts.
Account Manager (dxaccounts) Any X11-compliant user environment, such as CDE (the default UNIX environment). This is a graphical user interface that provides most user and group administrative options for both UNIX and Windows NT domain accounts.
useradd, usermod, userdel Character-cell terminal on UNIX. These are command-line options that run on the UNIX system, providing you with access to all user account administrative tasks. You can use these commands to administer both UNIX and associated (synchronized) Windows NT domain accounts. You can also use these commands to configure the default account environment.
groupadd, groupmod, groupdel Character-cell terminal on UNIX. These are command-line options that run on the UNIX system, providing you with access to all user group administrative tasks. You can use these commands to configure the default UNIX group environment.
Advanced Server for UNIX (ASU). User Manager for Domains A Microsoft Windows NT-based application for a PC system. This utility enables you to administer Windows NT domain accounts. You can use this, and other ASU utilities, to set up the default account characteristics using the policy management options. You cannot configure the default UNIX account environment.
ASU net commands Commands that can be entered at a UNIX terminal or at the DOS prompt on a system running the Windows NT server. These commands replicate the behavior of the ASU User Manager for Domains utility.

You must install and configure the Advanced Server for UNIX (ASU) software to use the Microsoft Windows-based utilities. Using the ASU utilities is not explained in detail in this chapter, but is discussed only in the context of a UNIX server running the ASU software. Refer to the ASU Installation and Administration Guide for more information on installing and using ASU.

7.1.2    Notes and Restrictions on Using the Utilities

The following restrictions apply when using account management utilities, or when certain system features are enabled:

7.1.3    Related Documentation

The following documentation contains information on administering accounts:

7.1.4    Related Utilities

The resources in the following list are also useful when administering accounts. These commands and utilities might be useful in correcting system problems when the graphical user environments are unavailable, such as after a system crash, or if you have access to only a character-cell terminal.

7.2    Account Administration - Quick Start

This section provides you with brief instructions on invoking the account administration utilities so that you can create basic accounts quickly. For example, if you have just installed and configured the system as the root user, you might want to set up a nonprivileged user account under your own name using the default account settings. At a later time you can read Section 7.3 and other sections to understand how to configure the system defaults and use the advanced features of account and group administration utilities.

7.2.1    Creating Primary Accounts During System Setup

On the first root login after a full installation of the operating system, the System Setup utility is automatically displayed to guide you through the options for configuring your system. The Account Manager (dxaccounts) icon included in System Setup enables you to configure initial accounts. This icon invokes an X11-compliant graphical interface (GUI) that you can run under the Common Desktop Environment (CDE) or other X-windowing environments. See Section 7.5.2 for full information on using the Account Manager. When the Advanced Server for UNIX (ASU) is installed and configured, you can also use the Account Manager (dxaccounts) GUI to administer Windows NT domain accounts as described in Section 7.6.

7.2.2    Using the Account Manager (dxaccounts) GUI

The Account Manager (dxaccounts) provides features supported by the CDE environment, such as drag-and-drop and cut-and-paste, to quickly clone new accounts from existing accounts. You can invoke this GUI as follows:

The dxaccounts GUI also provides options for administering Windows NT domain users when ASU is installed. These options are grayed out on the window if ASU is not installed and configured.

You can also use the Account Manager (dxaccounts) to configure default options for user accounts, such as the shell and the parent directory. See Section 7.4.2.6 for information.

7.2.3    Using the SysMan Menu Accounts Option

The SysMan Menu Accounts options provide the same functions as dxaccounts, but with limited support for the following features:

Invoke the SysMan Menu Accounts options from the CDE Applications Manager, the CDE Front Panel (SysMan Applications menu), or from the command line as follows: 

# sysman accounts

The Accounts options also let you add and modify accounts in NIS (Network Information Service) environments. You can add local users to any system without adding them to the NIS environment. Refer to the Network Administration: Services guide for information on NIS.

To use the Accounts options from the SysMan Menu, invoke the SysMan Menu as described in Chapter 1 and expand the options as follows:

  1. Choose the Accounts option to expand the menu. The following menu options are displayed:

  2. Move the pointer (or use the Tab key) to choose an option. Click on mouse button 1 (MB1) or the Enter key to invoke the utility.

  3. The first window (or screen) of the utility is displayed, presenting you with the following options:

    Add...

    Use this option to create a new user account.

    Modify...

    Use this option to modify account details for an existing user account.

    Delete...

    Use this option to remove a user's account, and optionally to delete all their system resources.

    Filter...

    Use this option to filter (search) for a specific user or set of users. You can specify different search criteria such as the user's UID or account comment.

    Options...

    Use this option to define the number of accounts at which filtering starts automatically. You can also choose which user data is included in listings of user accounts.

Detailed use of these utilities is described in Section 7.4.1, and in the online help.

7.2.4    Using the Command-Line Utilities

The following command-line utilities are available for administering accounts and groups:

The command-line utilities also provide options for administering Windows NT domain accounts when ASU is installed.

7.2.5    Advanced Server for UNIX

Advanced Server for UNIX (ASU) is a layered application that implements Windows NT Version 4.0 server services and functions on a server running UNIX. To other computers running Windows, the UNIX system appears to be a Windows NT Version 4.0 server. Through ASU, you can share UNIX file systems and printers as shares. By default, the client Windows user must have both a Windows NT domain account and a UNIX account in order to share UNIX resources. When ASU is running, the UNIX account administrative utilities that are described in this chapter can be used to perform certain account administrative tasks, such as creating new accounts.

ASU software is located on the Associated Products Volume 2 CD-ROM and provides two free connects. See the Installation and Administration Guide provided in the software kit.

7.3    Understanding User Accounts and Groups

The administration of user accounts and groups involves managing the contents of the system's password and group files. On standalone systems, the files you manage are /etc/passwd, which is documented in passwd(1), and /etc/group, which is documented in group(4).

On networked systems, typically, the Network Information Service (NIS) is for central account and group management. NIS allows participating systems to share a common set of password and group files. See the Network Administration: Services guide for more information.

If enhanced (C2) security is enabled on your system, you need to administer more than the /etc/passwd file for security. For example, the protected password database is used for security related information such as minimum password lengths and password expiration times. These tasks are documented in the Security manual.

7.3.1    System Files

The following system files may be updated when you perform account administration tasks and should be backed up regularly:

7.3.2    Understanding Identifiers - UIDs and GIDs

Each user account is recognized by a unique number called a user identifier (UID). The system also recognizes each user group by a unique number called a group identifier (GID). The system uses these numbers to track user file access permissions and group privileges and to collect user accounting statistics and information.

The maximum number of UIDs and GIDs is 4,294,967,294 (32 bits with 2 reserved values). The maximum number of users that can be logged on is determined by the available system resources, but is of course a much smaller figure. If you intend to use the full range of UIDs and GIDs, note that some older utilities and applications do not support the maximum number and you should take the following precautions:

7.3.3    Understanding the Password File

The passwd file for a standalone system identifies each user (including root) on your system. Each passwd file entry is a single line that contains seven fields. The fields are separated by colons and the last field ends with a newline character. The syntax of each entry and the meaning of each field is as follows: 

username:password:user_id:group_id:user_info:login_directory:login_shell

username

The name for the user account. The username must be unique and consist of from one to eight alphanumeric characters.

password

You cannot enter a password directly. Enter an asterisk (*) in the passwd field to disable a login to that account. An empty password field allows anyone who knows the login name to log in to your system as that user.

user_id

The UID for this account. This number must be unique for each user on the system. Reserve the UID 0 for root. Assign each UID in ascending order beginning with 100. Lower numbers are used for pseudousers such as bin or daemon. (See also the /usr/include/limits.h) file.

group_id

The GID for this account, which is an integer. Refer to the Technical Overview for information on the limit. Reserve the GID 0 for the system group. Be sure to define the GID in the group file.

user_info (or GECOS data)

This field contains additional user information such as the full user name, office address, telephone extension, and home phone. The finger command reads the information in the user_info field. Users can change the contents of their user_info field with the chfn command. Refer the finger(1) and chfn(1) reference pages for more information.

login_directory

The absolute pathname of the directory where the user account is located immediately after login. The login program assigns this pathname to the HOME environment variable. Users can change the value of the HOME variable, but if a user changes the value, then the home directory and the login directory are two different directories. Create the login directory after adding a user account to the passwd file. Typically the user's name is used as the name of the login directory. Refer to the chown(1), mkdir(1), chmod(1), and chgrp(1) reference pages for additional information on creating a login directory.

login_shell

The absolute pathname of the program that starts after the user logs in. If you leave this field empty, the Bourne shell /bin/sh starts. Refer to the sh(1b) reference page for information on the Bourne shell. Users can change their login shell by using the chsh command. Refer to the chsh(1) reference page for more information.

In windowing (graphical) user environments, utilities such as Account Manager (dxaccounts) can be used to perform all the operations provided by commands such as passwd and mkdir.

Note that you can only set default characteristics for new accounts in some graphical utilities, while the command-line utilities enable full access to setting and changing the default characteristics. See Section 7.4.2.6 for an explanation of how to do this with Account Manager (dxaccounts).

When the /etc/passwd file is very large, a performance degradation can occur. If the number of passwd entries exceeds 30,000, mkpasswd sometimes fails to create a hashed (ndbm) database. Because the purpose of this database is to allow for efficient (fast) searches for password file information, failure to build it causes commands that rely on it to do a linear search of /etc/passwd. This results in a serious performance degradation for those commands.

If you use the mkpasswd -s option to avoid this type of failure, a potential database or binary compatibility problem might arise. If an application that accesses the password database created by mkpasswd is built statically (nonshared), that application cannot read from or write to the password database correctly. This causes the application to fail either by generating incorrect results or by possibly dumping core.

Any statically linked application can be affected if it directly or indirectly calls any of the libc ndbm routines documented in the ndbm(3) reference page and then accesses the password database. To remedy this situation, you must relink the application. To avoid this compatibility problem, do not use the mkpasswd -s option.

Note

In an NIS environment you can add a user account to either the local passwd file or the NIS distributed passwd file. Accounts added to the local passwd file are visible only to the system to which they are added. Accounts added to the NIS distributed passwd file are visible to all NIS clients that have access to the distributed file. Refer to nis_manual_setup(7) for more information on adding users in a distributed environment.

7.3.4    Understanding the Group File

All users are members of at least one group. The group file identifies the group name for a user. There are two primary reasons to group user accounts:

The group file is used for the following purposes:

Each entry in the group file is a single line that contains four fields. The fields are separated by colons, and the last field ends with a newline character. The syntax of each entry and the meaning of each field is as follows:

groupname: password: group_id: user1 [user2,...,userN]

groupname

The name of the group defined by this entry. The groupname consists of from one to eight alphanumeric characters and must be unique.

password

Place an asterisk (*) in this field. Entries for this field are currently ignored.

group_id

The group identification number (GID) for this group, which is an integer. Refer to the Technical Overview for information on the limits. Reserve the GID 0 for the system. The GID must be unique.

user

The user account belonging to this group, identified by the user name defined in the passwd file. If more than one user belongs to the group, the user accounts are separated by commas. The last user account ends with a newline character. A user can be a member of more than one group.

There is a limit to the number of groups that a user can be in, as documented in group(4). The maximum line length is LINE_MAX as defined in the /usr/include/limits.h file. User accounts should be divided into a number of manageable groups.

You can also set defaults for certain GID values using the graphical or command-line utilities. See Section 7.4.2.6 for an explanation of how to do this with Account Manager (dxaccounts).

7.4    Administering User Accounts

The following sections describe how to:

The process for using the useradd command-line utility is similar and is documented in the reference pages but does not support NIS accounts. Refer to the Network Administration: Services guide for information on NIS. Note that the SysMan Menu Accounts options can also be used from a terminal.

Note

Avoid using adduser because it does not provide all the available options and is not sensitive to security settings. To preserve the integrity of system files, avoid using manual methods of adding user accounts.

7.4.1    Using the SysMan Menu Accounts Options

The following sections describe how you create new accounts using SysMan Menu options. The following tasks are described:

For information on how you use the keyboard to enter information into fields on SysMan Menu utilities, invoke the online help.

7.4.1.1    Gathering Account Information

To prepare for administering accounts, gather the information on the worksheet provided in Table 7-2. If enhanced security is in use, the data items must comply with the minimum requirements (such as password length). Refer to the Security guide for more information. Items marked O in the table are optional.

Refer to Section 7.3.3 for an explanation of the passwd file data items.

Table 7-2:  Account Administration Worksheet

Field O Description Data Item
User Name      
Comments (gecos) O Full name  
O Location  
O Telephone  
User ID (UID)   Can be assigned automatically  
Password   Use mixed case or alphanumeric  
Primary Group   Can be assigned automatically  
Secondary Group(s) O    
Shell O Can be chosen  
Home Directory   Can be created automatically  
Lock Account O    
Local User O    
NIS User O    
Windows User O Shares needed  

An example of typical user data is provided in Table 7-3.

Table 7-3:  Account Administration Worksheet

Field O Description Data Item
User Name     carsonK
Comments (gecos) O Full name Kit Carson
O Location Office 3T-34
O Telephone 4-5132
User ID (UID)   Can be assigned automatically Use next available
Password   Use mixed case or alphanumeric Use site specific initial password
Primary Group   Can be assigned Automatically Users
Secondary Group(s) O   marsx, 25
Shell O Can be chosen ksh
Home Directory   Can be created automatically /usr/marsx/carsonK
Lock Account O   no
Local User O   no
NIS User O   yes
Windows User O   yes, share \\maul\astools

7.4.1.2    Setting Filter and Display Options

Use the SysMan Manage local users Options... button to configure filtering (described in Section 7.4.1.3) and display options. To set options, invoke the SysMan Menu and choose the Manage Local Users option as described in Section 7.2.3.

When you click on the Options... button the SysMan Account Management: Program Options window is displayed and you can configure the following settings. Note that some option names are truncated here and appear as a descriptive line in the window:

On startup....

Use this option to set a trigger value for the filter feature. The default setting is 200 user accounts.

This feature is useful if you have many hundreds or thousands of user accounts. The more accounts that you have on your system, the longer it takes any SysMan Accounts task to find and display all the accounts. Setting a trigger value causes the SysMan Accounts task to default to filter (search) mode on startup. This enables you to choose a specific account or group of accounts and to greatly reduce the search and display time.

For example, if you set a figure of 300 user accounts, SysMan Accounts defaults to filter mode only when you have more than 300 accounts.

UserName

This checkbox enables display of the user's account name in all account listings.

Userid (UID)

This checkbox enables display of the user identifier (UID) in all account listings.

Comments

This checkbox enables display of any account comments (such as location and telephone number) in all account listings.

Note that selecting checkboxes affects your filter options. You can filter accounts based only on the data displayed.

7.4.1.3    Using Filter Options

If you have a large number of accounts you can use the Filter... option to quickly find a particular account or group of accounts. You can invoke the filter automatically, depending on the settings in Options... (described in Section 7.4.1.2). Automatic invocation enables you to avoid a delay while the Account Manager finds and loads all the user account data. You can filter both local and NIS accounts using this feature.

To use the search and filter option, invoke the SysMan Menu and choose the Manage Local Users option as described in Section 7.2.3. Click on the Filter... option button to display a dialog window titled: Manage Local Users: Show. Using this window, you can perform simple and advanced searches.

To perform a simple search:

Enter a filter (a search string) or a set of filters. All simple searches are based on account names entered as follows:

Any accounts matching the filter specification are listed in the Manage Local Users window, with the original filter string identified at the top of the window.

To perform and advanced search:

Click on the Advanced button to display the additional filter options. Activate a search option by clicking on the checkbox.

The filter options are:

User name or filter...

Enter a filter as described for the Simple Search option.

User ID range...

Enter a restricted range of UIDs such as 1-100 or an open-ended range such as 100- to find all accounts with a UID greater than 100.

Pattern in the "comments"...

Enter a search pattern to search on data entered in the Comment (GECOS data) field when the user's account was created.

This might be a telephone number, a physical location, or other user-specific information. You can use the asterisk (*) or question mark (?) wildcards to define a pattern. For example; *string*, such as: *Sub*.

LOCKED or UNLOCKED search criteria...

This option enables you to include (or exclude) locked or unlocked accounts. You can use this option to identify all currently locked accounts.

A warning dialog is displayed if you do not clear the contents of the Simple Search before invoking an Advanced Search. If you see this warning dialog, click on OK to accept the Advanced Search. This action supersedes any search criteria that you specified in the Simple Search.

7.4.1.4    Creating or Modifying Local Accounts

To create a new account, invoke the SysMan Menu and choose the Manage local users option as described in Section 7.2.3. A table users is displayed, listing all the existing local user accounts. Use the following procedure to add a local user:

  1. Choose the Add... option to display the Manage Local Users: Add a User window.

  2. Complete the data fields using the information from the worksheet in Table 7-2.

  3. If additional NIS options are required, choose Options and enter the appropriate NIS values. Then click on the OK button to return to the Add a User window.

  4. click on the OK button to add the new user. You are prompted to correct any errors, such as mistyped password confirmations.

  5. The Local Users window is displayed, showing a confirmation message. Click on the OK button to return to the SysMan Menu.

To modify an existing account, invoke the SysMan Menu and choose the Users option as described in Section 7.2.3. The Local Users table is displayed, listing all the existing local user accounts. Use the following procedure to modify a user entry:

  1. Scroll through the list of users and choose the entry you want to modify.

  2. Choose the Modify... option to display the Account Manager: Modify a User window.

  3. Change the contents of data fields as required.

  4. If additional NIS changes are required, choose Options and enter the appropriate NIS values. Then click on the OK button to return to the Add a User window.

    To add or modify more than one account, click on the Apply button instead of the OK button. (All changes are deferred until you click on the OK button to exit.)

  5. Click on the OK button to confirm the changes. You are prompted to correct any errors, such as mistyped password confirmations.

  6. The Local Users window is displayed, showing a confirmation message. Click on the OK button to return to the SysMan Menu.

Online help provides explanations for the fields, and defines valid data.

7.4.1.5    Deleting Local Accounts

Before deleting accounts consider the following:

To delete an account, choose the Manager Local Users option as described in Section 7.2.3. The Local Users table is displayed, listing all the existing accounts. Use the following process to delete a user:

  1. Scroll through the list of users and choose the user account that you want to delete.

  2. Choose the Delete... option to display the Account Manager: Delete a User window.

  3. Optionally, choose Delete User's Directory and Files if you want to remove the user's resources and recover the disk space.

  4. Click on the OK button to delete the account. The list of local users is updated immediately.

7.4.1.6    Creating or Modifying NIS Accounts

To create a new NIS account, invoke the SysMan Menu and chooser the Manage NIS Users option as described in Section 7.2.3. The NIS Users table is displayed, listing all the existing local user accounts. Use the following procedure to create an account for a local user:

  1. Choose the Add... option to display the Manage NIS Users: Add a User window.

  2. Complete the data fields using the information from the worksheet described in Table 7-2.

  3. Click on the OK button to add the new user. You are prompted to correct any errors, such as mistyped password confirmations.

  4. The Manager NIS Users window is displayed, showing a message confirming the successful addition. Click on the OK button to return to the SysMan Menu.

To modify an existing account, invoke the SysMan Menu and choose the Manage NIS Users option as described in Section 7.2.3. The NIS Users table is displayed, listing all the existing local user accounts. Use the following procedure to modify a user entry:

  1. Scroll through the list of NIS users and choose the user account that you want to modify.

  2. Choose the Modify... option to display the Manage NIS Users: Modify a User window.

  3. Change the contents of data fields as required.

  4. Click on the OK button to confirm the changes. You are prompted to correct any errors, such as mistyped password confirmations.

    To add more than one account, click on the Apply button instead of the OK button. All changes are deferred until you choose the OK button to exit.

  5. The Local Users window is displayed, with a message confirming the successful addition. Click on the OK button to return to the SysMan Menu.

Online help provides explanations for the fields, and defines valid data.

7.4.1.7    Deleting NIS Accounts

To delete NIS accounts, choose the Manage NIS Users option as described in Section 7.2.3. The NIS Users table is displayed, listing all the existing accounts. Use the following process to delete a user:

  1. Scroll through the list of users and choose the account that you want to delete.

  2. Choose the Delete... option to display the Manage NIS Users: Delete a User window.

  3. Optionally, choose Delete User's Directory and Files if you want to remove the user's resources and recover the disk space.

  4. Click on the OK button to delete the account. The list of NIS users is updated immediately.

7.4.2    Using the Account Manager (dxaccounts)

Invoke the Account Manager (dxaccounts) as described in the quick start instructions in Section 7.2.2. The Account Manager on <host> window is displayed first. Use the following procedure to administer accounts, using the data gathered in the Table 7-2 worksheet.

Use the following procedures to add, modify and delete accounts when using dxaccounts. The processes are identical for administering NIS users, except that you must also be authorized to make changes to the NIS databases. (Refer to the Network Administration: Services guide for more information on NIS.)

Most options require root privilege because they impact the user account databases. Options that do not affect the databases are available to all users. An example of such an option is Find, which you use to locate accounts.

When ASU is installed, additional options are displayed in the dxaccounts windows that enable you to administer accounts in Windows NT domains and create associated UNIX accounts simultaneously. Refer to the Installation and Administration Guide for more information on ASU.

If Enhanced (C2) security is enabled, additional options enable you to retire and disable accounts according to the security settings in force. Refer to the Security guide for more information.

7.4.2.1    Adding and Modifying Accounts

You use the Account Manager on <host> dialog window to add or modify user accounts as follows:

Use the following procedure to add or modify accounts:

  1. If the current view is not Local Users, pull down the View menu and choose the Local Users option.

  2. Click on the Add button to display the Add/Modify Local User window and click on the Add button.

    (To modify an existing account, double-click on the user's icon.)

  3. Enter the new user name in the Username field.

  4. Choose the next available UID, or enter a new UID.

    If you modify a user's UID with the Account Manager (dxaccounts), the ownership of the user's files and subdirectories does not change and, under certain circumstances, the home directory ownership might not change either. For example, if you change the UID of user johndoe from 200 to 201, the files and subdirectories under his home directory still belong to UID 200. Furthermore, if johndoe does not own his home directory, the ownership of that directory does not change either. To avoid this problem, use the chown command to change the directory and files, if applicable.

  5. Use the pull-down menu to choose the primary group, or clear the box and type a group name.

    If secondary groups are required, click on the Secondary Groups... button. In the Secondary Groups window, double-click on any required local or NIS (if available) groups.

  6. Choose the preferred shell from the pull-down menu.

  7. The home directory is created at the default location of /usr/users/<username>. Enter an alternative path if required.

  8. Click on Password.... to enter an initial password. Use a mixed case or alphanumeric string of length determined by local security settings.

  9. Enter any user information (GECOS field data) in the comments fields.

  10. You can optionally check the following boxes:

  11. Click on the OK button to create the account and return to the Account Manager main window. You are prompted to correct any errors. The Current View is updated with an icon for the new user.

7.4.2.2    Deleting Accounts

Invoke the dxaccounts utility as described in Section 7.2.2. The Account Manager on <host> window is displayed first.

  1. Double-click on the icon of the account that you want to delete. If there are many accounts, use the options described in Section 7.4.2.3 to find accounts.

  2. Click on the delete button. The Delete Local UNIX User window is displayed. You can remove the user's files and directories at this time. (You may want to archive these. See the dxarchiver option.)

  3. Click on the OK button to confirm the deletion and return to the Account Manager on <host> window. This window is immediately updated, removing the deleted user account.

7.4.2.3    Finding and Selecting Accounts

The dxaccounts utility provides a useful search feature that you can use to locate user accounts. You can also use this feature to choose groups of users to which you want to apply global changes, such as modifying the user shell or password.

Invoke the dxaccounts utility as described in Section 7.2.2. The Account Manager on <host> window is displayed first.

  1. Click on the Find button.

  2. Enter a search string (a text string) in one of the fields and click on the OK button.

The Find option enables you to locate and display all accounts where the data in the search field contains the search string. For example:

  1. Enter the string ad in the Username field and click on the OK button.

  2. The Selected Users window is displayed, stating that the following users matched the search criteria.

  3. The matched users include adm, admin, adamK, and wadmanB. These user accounts are highlighted in the Current View.

After you select a group of user accounts, you can choose the modify (or delete) option to perform global operations on the selected users.

7.4.2.4    Copying Accounts

You can use existing accounts as templates to create new accounts, enabling you to clone the account properties. You can create an exact duplicate of one or more accounts using the following procedure:

  1. Click on an the icon for an existing user account to highlight it, or use the mouse to select a group of accounts.

  2. Click on the Copy button to copy the account.

  3. Click on the Paste button to create a clone account. The new icon label has the original name, appended with the string _copyn, where n represents the sequential number of the copy. You can make as many copies as required.

  4. Choose each duplicate account in turn to rename it and to modify its properties as described in Section 7.4.2.1.

  5. Make the minimum required modifications to the account as follows:

    1. Enter the new user name

    2. Change the UID or choose the next available UID

    3. Change the password

  6. Click on the OK button to add the modified account and return to the Account Manager on <host> window. This window is immediately updated with an icon for the new account.

You can use the same procedure to clone groups.

When copying user accounts using cut and paste or drag and drop, the Allow Duplicate UIDs option in the General Preferences dialog box is honored. For example, when making a copy of user account that has a UID of 200, if the Allow Duplicate UIDs check box is off (the default), a unique UID is automatically generated for the resulting copy. If the Allow Duplicate UIDs check box is on, then the copy has an identical UID. The same rule applies to copying groups.

Using MB1 to drag and drop user accounts, groups, or templates it results in a copy operation, not a move operation. This is different from the default CDE behavior, where using MB1 performs a drag and drop move operation and Shift-MB1 performs a copy operation. For example, if you use MB1 to drag a user account from the Local Users view and drop it in the NIS Users view, you create a copy of that user account in NIS. To avoid this problem, delete the original icon after the copy is complete.

7.4.2.5    Using the Password Option

The dxaccounts utility provides a password option enabling you to change or remove passwords for a single user or a group of users. Use this option as follows:

  1. Choose the user or users whose passwords you want to change. The Find option may be useful in selecting groups of users.

  2. From the Edit menu, choose Password.

  3. In the New Password window, enter and confirm the new password.

    You can click on the No Password button to remove the current passwords. (There are important system security implications when you choose this option.)

  4. Click on the OK button to confirm the change and return to the Account Manager main window.

7.4.2.6    Account Manager (dxaccounts) General Options

The Account Manager (dxaccounts) enables you to easily set defaults for newly created user accounts. You can also set account defaults using the command line (useradd) but you cannot use SysMan Menu Accounts options to set defaults. Use the following procedure to add or modify defaults:

  1. From the Options menu, choose General..... The General Options window is displayed, enabling you to set the following defaults:

  2. After you make the required changes, click on the OK button to update the defaults and return to the Account Manager main window.

7.5    Administering Groups

The following sections describe how to:

You can also use the groupadd, groupmod, and groupdel command-line interfaces to administer groups. Refer to the documentation specified in Section 7.1.3 for more information on command-line options.

Note

Avoid using the addgroup utility as it does not provide all the available options and is not sensitive to security settings.

To preserve system file integrity, avoid using manual methods of adding user accounts.

7.5.1    Using the SysMan Menu Accounts Group Options

The following sections describe how to administer groups using SysMan Menu options. The following tasks are described in this section:

For information on how to use the keyboard to enter information into fields on SysMan Menu screens, invoke the online help.

7.5.1.1    Gathering Group Information

To prepare for administering groups, gather the information in the worksheet provided in Table 7-4. Note that if enhanced security is in use, the data items must comply with the minimum requirements. Refer to the Security guide for more information.

Refer to Section 7.3.4 for an explanation of the group file data items. In the SysMan Menu options, you can also specify default values for NIS groups. Refer to the Network Administration: Services guide for information on configuring NIS.

In Table 7-4 the data items marked O are optional. You must specify at least one user account.

Table 7-4:  Group Administration Worksheet

Field O Description Data Item
Group Name      
Password   Not currently used.  
Group Identifier (GID)   If unused, the next number is assigned automatically  
User      
User O    
User O    
User O    
User O    
User O    

7.5.1.2    Creating or Modifying Groups

To create a new group, invoke the SysMan Menu and choose the Manage local groups option as described in Section 7.2.3. The Local Groups table is displayed, listing all the existing local groups. The process for adding NIS groups is identical, except that you choose the Manage NIS groups option.

Use the following procedure to create a group:

  1. Choose the Add... option to display the Manage local groups: Add a Group window.

  2. Complete the data fields using the information from the worksheet in Table 7-4.

  3. On the Members panel, highlight the names of users who are the initial members of the new group. This action is optional.

  4. Click on the OK button to add the new user. You are prompted to correct any errors.

  5. The Local Groups table window is displayed, with a message confirming the successful addition. Click on the OK button to return to the SysMan Menu.

To modify an existing group, invoke the SysMan Menu and choose the Manage local groups option as described in Section 7.2.3. The Local Groups table is displayed, listing all the existing local groups. Use the following procedure to modify a group entry:

  1. Scroll through the list of groups and choose the group that you want to modify.

  2. Choose the Modify... option to display the Manage Local Groups: Modify a Group window.

  3. Change the contents of data fields as required. For example, you can scroll through the list of users and add new users to the group.

  4. Click on the OK button to confirm the changes.

    To modify more than one group, click on the Apply button instead of the OK button. (All changes are deferred until you click on the OK button to exit.)

  5. The Local Groups window is displayed, with a message confirming the successful modification. Click on the OK button to return to the SysMan Menu.

Online help provides explanations for the fields, and defines valid data.

7.5.2    Using the Account Manager (dxaccounts)

Invoke the Account Manager (dxaccounts) utility as described in Section 7.2.2. The Account Manager on <host> window is displayed first. Using the data from the worksheet in Table 7-4, use the procedures in the following sections to add, modify, and delete groups when using dxaccounts. The process for administering NIS groups is identical to the process for administering Local Groups, except that you must be authorized to change the NIS databases. You can still use any options, such as Find, that do not change the databases.

If there are many groups on your system, use the Find option described in Section 7.5.2.4 to locate groups that you want to modify or delete.

7.5.2.1    Adding Groups

Add group as follows:

  1. Pull down the View menu and choose the Local Groups option.

  2. Choose the Add button to display the Add/Modify Local UNIX group window.

  3. Enter the new group name in the Name field.

  4. Choose the next available GID or enter a new GID.

  5. Double click on any user name to add that user to the group. This action is optional.

  6. Click on the OK button to add the group and return to the Account Manager on <host> window. This window is immediately updated with an icon for the new group.

An alternative method of adding a new group is to clone it from an existing group as follows:

  1. Click on an existing group icon to highlight it.

  2. Choose the Copy button to copy the group.

  3. Choose the Paste button to create a new version of the group. The new icon label has the original name, appended with the string _copyn, where n represents the sequential number of the copy. You can make as many copies as required.

  4. Double click on the newly copied icon to highlight it and display the Add/Modify Local UNIX group window. The Modify button is selected automatically.

  5. Make any required modifications to the group as follows:

    1. Enter the new group name

    2. Change the GID, or choose the next available GID

    3. Add or delete members

  6. Click on the OK button to add the group and return to the Account Manager on <host> window. This window is immediately updated with an icon for the new group.

7.5.2.2    Modifying Groups

Invoke the dxaccounts utility as described in Section 7.2.2. The Account Manager on <host> window is displayed first. Use the following procedure to modify a group:

  1. Double-click on the group that you want to modify. The Add/Modify Local UNIX group window is displayed.

  2. Make any required modifications to the group. For example:

  3. Click on the OK button to confirm the changes and return to the Account Manager on <host> window. This window is immediately updated with any changes for the group.

7.5.2.3    Deleting Groups

Invoke the dxaccounts utility as described in Section 7.2.2. The Account Manager on <host> window is displayed first. Use the following procedure to delete a group:

  1. Click on the group that you want to delete.

  2. Click on the delete button. You are prompted to confirm that you want to delete this group.

  3. Click on the Yes button to confirm the deletion and return to the Account Manager on <host> window. This window is immediately updated, removing the deleted group.

7.5.2.4    Finding Groups

The Account Manager (dxaccounts) enables you to locate groups and users who are members of groups.

Invoke the dxaccounts utility as described in Section 7.2.2. The Account Manager on <host> window is displayed first. To find a group:

  1. Click on the Find button.

  2. Enter one of the following search strings:

7.6    Administering Windows Domain Accounts and Groups

When the Advanced Server for UNIX (ASU) is running, the account management utilities can be configured to support the creation and administration of Windows domain accounts. For information on installing and configuring ASU, refer to the ASU Installation and Administration Guide. When ASU is installed, you can use the account management utilities to perform certain operations on associated (synchronized) accounts. These are accounts for the same user that exist both in the Windows domain and the UNIX environment, and are referred to as synchronized accounts in the UNIX utilities. For specific information on Windows 2000, see Section 7.6.2.

To configure a UNIX system to create associated Windows NT domain and UNIX accounts, and to set the default account creation options, you must set the account environment variables using the usermod (or useradd) command as shown in Example 7-1.

Note

When ASU is installed and configured, the creation of associated Windows NT domain and UNIX accounts is enabled by default. All account management utilities have their PC support features enabled. The value of the Synchronized UNIX/PC Accts environment variable is one (1), which indicates that the setting is on.

Example 7-1:  Changing the Default Environment Variables Using usermod

# usermod -D [1]
 
Local                           = 1
Distributed                     = 0
Minimum User ID                 = 12
Next User ID                    = 200
Maximum User ID                 = 4294967293
Duplicate User ID               = 0
Use Hashed Database             = 0
Max Groups Per User             = 32
Base Home Directory             = /usr/users  [2]
Administrative Lock             = 1
Primary Group                   = users
Skeleton Directory              = /usr/skel
Shell                           = /bin/sh
Synchronized UNIX/PC Accts      = 0
PC Minimum Password Length      = 0
PC Minimum Password Age         = 0
PC Maximum Password Age         = 42
PC Password Uniqueness          = 0
PC Force Logoff After           = Never
 
# usermod -D -x pc_synchronize=1 pc_passwd_uniqueness=1 \
pc_max_passwd_age=60 [3]
 
# usermod -D
.
.
.
Synchronized UNIX/PC Accts      = 1
PC Minimum Password Length      = 0
PC Minimum Password Age         = 0   [4]
PC Maximum Password Age         = 60
PC Password Uniqueness          = 1
PC Force Logoff After           = Never
 
 

  1. This command displays the current default environment variables. [Return to example]

  2. The output from the usermod command is a list of default values for the environment variables. When you create an account, these values are assigned to the new account. For example, all new accounts are created in the base home directory of /usr/users. [Return to example]

  3. This command specifies new default values for three environment variables that apply only to Windows NT domain accounts. [Return to example]

  4. This (truncated) list shows the new default values for the environment variables, which are as follows:

    [Return to example]

Use the groupmod -D command to set the default environment variables for creating new groups. You can also specify alternate values for the environment variables when you create a new account, overriding the defaults. For more information, refer to the useradd(8), usermod(8), and userdel(8) reference pages.

At the command-line prompt, you can also type -h after each command to display a help screen showing the various command options. In ASU User Manager for Domains, you perform a similar task when you edit the default policy, which establishes similar default environment variables for newly created accounts.

You cannot use ASU account management utilities to perform operations on UNIX-only accounts, or use UNIX utilities to perform operations on accounts that exist only in the Windows NT domain. The following sections provide information on how the UNIX and ASU account administration utilities behave when ASU is running and when you are administering synchronized accounts.

7.6.1    Administering Synchronized Accounts

If you have set up ASU and configured the creation of synchronized accounts, certain features in the account administration utilities are enabled automatically. The following sections describe how those features appear in the different account management utilities.

A lock file prevents you from using two different utilities (or two instances of the same utility) at the same time. This scenario could easily arise in large installations with many administrators managing many accounts. This lock file is at /etc/.AM_is_running. If the lock file exists, only one process can access the system files that relate to user and group data. If you attempt to invoke a second instance of any UNIX account management utility, an error message informs you that the data files are locked.

When using the ASU utilities to add accounts, ASU detects the presence of the lock file, and is unable to create an associated UNIX account. It only creates a Windows NT domain account. No lock file error message is displayed, and you do not receive a confirmation that the associated account was not created. When using ASU tools, you should always verify the creation of an associated UNIX account by checking the contents of the /etc/passwd file.

7.6.1.1    Using SysMan Menu Accounts and Groups Options

The user interfaces for SysMan Menu Accounts utilities do not show any changes when ASU is running. If synchronized accounts are enabled, there are no differences in the windows and screens. However the following changes in behavior should be noted:

Refer to Chapter 1 for information on using the SysMan Menu.

7.6.1.2    Using the Account Manager (dxaccounts)

The Account Manager (dxaccounts) is an X11-compliant GUI and as such can be used only in an X-window user environment such as CDE. The dxaccounts main window provides an option to create PC (Windows NT domain) accounts. This option is grayed out and unusable unless ASU is running. When ASU is running, the following features are available:

You use the processes described in Section 7.5.2 to perform administrative operations on PC accounts and groups.

The advantage of using dxaccounts is that it is a native X11 application and can use the features of the windowing environment such as iconic drag-and-drop or cut-and-paste to easily clone new user accounts and groups from existing entities. However, unlike the portable SysMan Menu Account utilities, it runs only in an X-window user environment such as CDE.

7.6.1.3    Using Command-Line Utilities

The command-line utilities for administering user and group accounts are also used to configure the default account characteristics, as demonstrated in Example 7-1. These characteristics are applied to all newly created accounts, and are referred to as the account policy in the ASU utilities. Unlike the graphical utilities, when using the commands you can choose to override the default environment variables and specify customized values for new accounts.

When ASU is installed, the following account and group creation options become available for use:

The advantage of using the command-line is that it offers complete control over administrative tasks, enabling you to specify any and all command options and override the default account environment variables.

Commands can be used as part of a shell script to customize and automate account creation. However, the command options can be lengthy, so it is often easier to set up an account using the graphical utilities.

Refer to the useradd(8) and groupadd(8) reference pages, and the related reference pages identified therein.

7.6.1.4    Using the ASU User Manager for Domains

ASU provides its own utility for administering Windows NT domains, domain user accounts, and groups. This application must be installed on and can only be used from a system running Windows NT. It provides the same features as the net command-line options.

You can specify default environment variables for all newly created accounts. These environment variables are referred to as account policies in the Windows NT domain.. You cannot set the default environment variables for synchronized UNIX accounts when using the User Manager for Domains (usrmgr.exe).

Refer to the ASU Installation and Administration Guide and the User Manager for Domains online help for more information.

7.6.1.5    Using ASU net Commands

ASU provides an extensive set of net commands that you enter on the UNIX command line or from a DOS window on a Windows NT server.

For example, the following command displays the help for net user, the command you can use to add, modify, or delete user accounts: 

# net help user | more
 
The syntax of this command is:
 
NET USER [username [password | \*] [options]]
          username [password | \*] /ADD [options]
          username [/DELETE]
.
.
.
# net user josef /add

Enter the following command to display a list of net command options: 

# net help view

See the Installation and Administration Guide and net(1) for more information on using net commands.

7.6.2    Windows 2000 Single Sign-On

If your local computing environment consists of UNIX servers and Windows 2000 client systems, and you have one or more domain controllers in the environment, you can configure the optional Windows 2000 Single Sign-On (SSO) software. The SSO software enables account holders in the Windows 2000 domain to access computing resources on the UNIX server without needing a separate UNIX account.

The SSO software modifies the Windows Active Directory and the associated Windows account management utilities. These modifications enable administrators in the Windows 2000 domain to record UNIX information in the user's Windows 2000 account records. The UNIX server systems have secure access to the account holder's data and can read the account holder's UNIX login information, such as password or GID.

You can also create SSO user groups using the same software and administrative tools.

7.6.2.1    Single Sign-On Installation Requirements

Configuration and use of this feature has the following installation prerequisites:

7.6.2.2    Installing the Single Sign-On Software

Install the software as follows:

  1. Load the CD-ROM into the reader.

  2. Create a mount point and mount the CD-ROM using commands similar to the following: 

    # mkdir /apcd
# mount -r /dev/disk/cdrom4c /apcd

  3. Locate the installation kits and documentation as follows: 

    # ls /apcd/Windows2000_SSO
 
 

  4. Use the setld command to install the software subset named W2KSS0100. The configuration script, /usr/sbin/w2ksetup, runs automatically when the installation is complete. Complete the configuration as described in the Windows 2000 Single Sign-On Installation and Administration Guide.

7.6.2.3    UNIX Requirements for Creating Single Sign-On Accounts

The following requirements for UNIX account characteristics apply to SSO accounts:

7.6.2.4    Creating Single Sign-On Accounts and Groups

Using the information prepared in Section 7.6.2.3, create SSO accounts as follows:

  1. Log in to your administrator's account on the Windows 2000 domain controller.

  2. Invoke the Microsoft Management Console (MMC) interface and display the Active Directory Users and Computers Window.

  3. Open the Users folder and either choose an existing user or open the Action menu and choose the New option then the User option.

  4. Three dialog boxes are displayed in succession. You are prompted to enter the following information for each new user account:

To create an SSO group use the same procedure, selecting the New and Group menu options in step 3.

7.6.2.5    Single Sign-On System Files

When you install and configure the software, the following system files are created:

Refer to the file headers and the Windows 2000 Single Sign-On Installation and Administration Guide for more information on these files.