CT320: Network and System Administration

Fall 2018

Accounts

See this page as a slide show

CT320 Accounts

Accounts and Namespaces

Thanks to:

for the contents of these slides.

Topics

  1. UNIX User Accounts
  2. Passwords
  3. User Management
  4. Namespaces

UNIX Accounts

/etc/passwd, /etc/shadow

Central file(s) describing UNIX user accounts.

/etc/passwd/etc/shadow
UsernameUsername
xEncrypted password
UIDDate of last pw change
Default GIDDays until change allowed
GCOSDays until change required
Home directoryExpiration warning time
Login shellExpiration date

/etc/passwd entries

$ getent passwd root
root:x:0:0:root:/root:/bin/bash

$ getent passwd cs160
cs160:$6$Dn1ufY23lm72UHto$eIhJXlP7eHDVYYf3M2ZPU5I0zK7MoYPH2QYFloW8lXXvI2swTxdnu3srxfQnIoK6D2zDhc5zNf9T4JuZggtcm.:1057:1549:CS160 Instructor:/s/bach/a/class/cs160:/sbin/nologin

$ getent passwd cs160 | tr : '\n'
cs160
$6$Dn1ufY23lm72UHto$eIhJXlP7eHDVYYf3M2ZPU5I0zK7MoYPH2QYFloW8lXXvI2swTxdnu3srxfQnIoK6D2zDhc5zNf9T4JuZggtcm.
1057
1549
CS160 Instructor
/s/bach/a/class/cs160
/sbin/nologin

Username

UIDs

Password

Password Field

ContentsDescriptionSanity
xpassword is in /etc/shadowsane
*login forbiddensane
nothingno password needednuts
13-char stringoriginal DES hashing algorithmnuts
$1$salt$hashMD5nuts
$2a$salt$hashBlowfishnuts
$2y$salt$hashBlowfish with 8-bit supportnuts
$3$salt$hashNT LAN Manager hash algorithmnuts
$4$salt$hashSHA-1nuts
$5$salt$hashSHA-256nuts
$6$salt$hashSHA-512sane

Hashing

Good hash algorithms, such as SHA-512, are considered non-reversible, and return radically different results for small input changes:

Word SHA-512 hash
escape

d412b342e7c8eab0034d26408568938965f8b6bff475381aa7c1e6afce026f29
3e35bdbf40e0c7567a8e006611debe94b3c849bd900e62123b12a40fcb3e620e

escaped

bf42edb1581ed28a5b48b4678ab014252b03e729d31b3c5ac1acec1c5727d22a
0265ffee61c02fb7ea7c49fc75d1b97e885973e416ffb8b1de7944927b53d9bd

escapee

d056ce4dce966ce111f5304b0bb98568e0a446fd2308119030f8f4d649d632b6
e644322729507b540fc3ad4a7ba80fc6f26e4b81115fd35f4927b2ca5b15a850

escaper

341706ac2911fbdfbe0ed9c09a36f2b70f9d9d9585af499568f59124fa4efa96
7460ea99edb81ed0d72373b977f321512c44440c7ea750f02bc04047627c5642

escapes

020b71a59aa43d82ec0cd10c49b1a833fd41f088f7845a03ed36d5af29d6d78e
6393d154ca1e892ff560d6fae2b4eb36e7c04853b4dd97297ef6e62f9b0a8521

Common passwords

According to Wikipedia, the most common passwords of 2016 are:

123456  qwerty  login  121212  master  
password  1234567890 welcome flower  hottie  
12345  1234567  solo  passw0rd loveme  
12345678  princess  abc123  dragon  zaq1zaq1  
football  1234  admin  sunshine password1 

Rainbow Tables

Partial MD5 rainbow table:

    e0ebc3c409070d07f1df0f2f4132509e escape
    bafbb2fabbff5876f8bf7834f802936b escaped
    712f32fc42f27433a6db7cba03a980b3 escapee
    1ba8fbf22b249654d5cde753bae85def escaper
    f801cba4d35a3da1501ab3162cbb4dee escapes

Salt

mkpasswd

mkpasswd can be handy for generating an initial password:

$ mkpasswd
Nn8Pr1<zt
$ mkpasswd
35/jzvwYW
$ mkpasswd -l 20
ihxsqwxzhyn\g6wt1RLa
$ mkpasswd -c 2 -C 2 -s 2 -d 2
}kq3j\LP1
$ mkpasswd -c 10 -C 10 -s 10 -d 10 -l 60
4m]C6qQhhkhhbj@$uo^z0kw8Q(K+zHh+nnk564rox2lN1@+zR5~OfxguCcqV
$ mkpasswd -c 0 -C 0 -d 0 -s 50 -l 50
%[$\,,"!"&!;-;&;{]$],?/(_^]-%),,?^@#!)(}\*\.;;)&:&

Or, should you let the user choose one?

Password Aging

/etc/login.defs determines password longevity:

$ grep PASS /etc/login.defs
#	PASS_MAX_DAYS	Maximum number of days a password may be used.
#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
#	PASS_MIN_LEN	Minimum acceptable password length.
#	PASS_WARN_AGE	Number of days warning given before a password expires.
PASS_MAX_DAYS	99999
PASS_MIN_DAYS	0
PASS_MIN_LEN	5
PASS_WARN_AGE	7

Feedback

    $ ssh xyzzy@denver.cs.colostate.edu
    xyzzy@denver.cs.colostate.edu's password:
    Permission denied, please try again.
    xyzzy@denver.cs.colostate.edu's password:
    Permission denied, please try again.
    xyzzy@denver.cs.colostate.edu's password:
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

GID

    wheel:x:10:root,waldenj,bergs

GECOS

Home Directory

Login Shell

$ ssh acushla perl -E \''say $e[8] while @e=getpwent'\' | sort | uniq -c
   1890 /bin/bash
     34 /bin/csh
      1 /bin/ksh
      1 /bin/sync
    101 /bin/tcsh
      5 /bin/zsh
      1 /sbin/halt
   1270 /sbin/nologin
      1 /sbin/shutdown

Changing your Shell

$ cat /etc/shells
/bin/sh
/bin/bash
/sbin/nologin
/usr/bin/sh
/usr/bin/bash
/usr/sbin/nologin
/bin/tcsh
/bin/csh
/bin/ksh
/bin/rksh
/bin/zsh
/usr/local/etc/no_access

Adding a User

  1. Create account with useradd.
  2. Lock account until user arrives.
  3. User signs account agreement.
  4. Set password with the passwd command.
    • Yes, both /etc/passwd and /bin/passwd exist.

Adding a User

Disabling an Account

Removing a User

Namespaces

Systems include many namespaces:

Types of Namespaces

Namespace Problems

Name Selection

Name Lifetime

Namespace Scope

Key Points

User: Guest

Check: HTML CSS
Edit History Source

Modified: 2018-09-17T23:05

Apply to CSU | Contact CSU | Disclaimer | Equal Opportunity
Colorado State University, Fort Collins, CO 80523 USA
© 2018 Colorado State University
CS Building