3.3Linux用户和组管理

最新推荐文章于 2024-02-21 19:50:34 发布

weixin_34150830

最新推荐文章于 2024-02-21 19:50:34 发布

阅读量148

点赞数

文章标签：操作系统 shell 人工智能

原文链接：https://my.oschina.net/u/1762991/blog/662968

版权

为什么80%的码农都做不了架构师？>>>

仅获取命令执行成功后的状态 echo $?

把没有意义信息输出到/dev/null: bit bucket（位桶）
正确执行
[root@linux_basic tmp]# ls
A free hello mylinux mylog system-release test test.txt yoH you yoU you.txt
[root@linux_basic tmp]# echo $?
0
[root@linux_basic tmp]# ls > /dev/null
[root@linux_basic tmp]# echo $?
0
错误执行
[root@linux_basic tmp]# lssl
-bash: lssl: command not found
[root@linux_basic tmp]# lssl > /dev/null
-bash: lssl: command not found
[root@linux_basic tmp]# lssl &> /dev/null
[root@linux_basic tmp]# echo $?
127

通过设置阻止覆盖重定向已经存在的文件
[root@linux_basic tmp]# type set
set is a shell builtin
[root@linux_basic tmp]# help set
set: set [--abefhkmnptuvxBCHP] [-o option-name] [arg ...]
    Set or unset values of shell options and positional parameters.

    Change the value of shell attributes and positional parameters, or
    display the names and values of shell variables.
    -C If set, disallow existing regular files to be overwritten
          by redirection of output.   如果文件存在，不能覆盖它
[root@linux_basic tmp]# cp test mylog/
[root@linux_basic tmp]# cat /etc/issue > mylog/test
[root@linux_basic tmp]# set -C
[root@linux_basic tmp]# cat /etc/issue > mylog/test
-bash: mylog/test: cannot overwrite existing file
[root@linux_basic tmp]# set +C
[root@linux_basic tmp]# cat /etc/issue > mylog/test
[root@linux_basic tmp]# set -C
[root@linux_basic tmp]# cat /etc/issue > mylog/test
-bash: mylog/test: cannot overwrite existing file
[root@linux_basic tmp]# cat /etc/issue >| mylog/test

用户和组：

     权限:定义资源或服务的访问能力
用户：获取资源或服务的标识
用户，容器(用户的容器)，关联权限：用户组，方便地指派权限
组是权限的容器或是权限的集合

用户和组：实现资源分派的核心要素

容器：用户
权限

    用户两类：
        管理员
        普通用户

        用户的身份标识 User ID = UID
            名称解析：查找用户名对应的用户id
                文本文件
                关系型数据库
                NIS
                LDAP

组用户也有组id Group ID = GID

密码
    authentication    认证过程
        密码：口令   通过提供密码
    认证工具
        生物识别：
        电子口令卡：
    authorization:   提供权限
        授权通过文件的属组和属主来实现的
    audit: 监督是否乱用了权限
        审计   通过日志来实现的

    权限：获取某种资源的能力
        一切皆文件：
            用户所访问资源都是文件

    用户类别：
        管理员：0
        系统用户：1-499
            目的运行后台程序（daemon）
        普通用户：500+

可以登录的：交互式访问的用户（管理员和普通用户）

    组类别：
        管理员组：0
        系统组：1-499
        用户组：500+   500以上的

    权限：
        r 可读
        w 可写
        x 可执行

        文件：
            r: 查看文件内容
            w: 修改文件内容
            x: 把此文件启动为一个运行的程序（进程），可以在命令提示符下当作命令提交给内核运行；

        目录：
            r: 可使用ls命令查看目录中的文件名列表
            w: 可以在目录中创建或删除文件
            x: 可以cd到此目录中，以及使用ls -l显示目录中文件的元数据信息

    用户访问文件时的权限匹配模型：
        1、检查运行此程序的的属主是否与其正在访问的文件的属主相同？
            如果相同，则以属主的权限访问；
            否则：
        2、查检运行此进程的属组是否属于此文件的属组
            如果是，则以属组的权限访问；
            否则：
        3、以其它用户的身份访问

    用户管理：用户的账号密码相关的信息
        Linux:
            /etc/passwd: 用户的帐号信息
            /etc/shadow: 用户密码和相关的帐户设定
            /etc/group: 组的帐号信息
            /etc/gshaow: 组的密码信息

        /etc/passwd文件格式：
            account:password:UID:GID:GECOS:directory:shell
        用户可以加入不止一个组：
                    基本组
                    额外组，附加组
用户组类别：
    私有组：创建用户时，如果没有为其指定所属的组，系统会自动为其创建一个与用户名同名的组
    基本组：用户的默认组
    附加组，额外组：默认组以外的其它组
[root@linux_basic tmp]# whatis passwd
passwd               (1) - update user's authentication tokens
passwd               (5) - password file
passwd [sslpasswd]   (1ssl) - compute password hashes
NAME
       passwd - password file

DESCRIPTION
       Passwd is a text file, that contains a list of the system’s accounts, giving for each account some useful information like
       user ID, group ID, home directory, shell, etc. Often, it also contains the encrypted passwords for each account. It should
       have general read permission (many utilities, like ls(1) use it to map user IDs to usernames), but write access only for the
       superuser.
            登录名:密码占位符:UID:GID:注释信息:家目录:用户的默认shell
There is one entry per line, and each line has the format:

account:password:UID:GID:GECOS:directory:shell

The field descriptions are:

account the name of the user on the system. It should not contain capital letters.

            password the encrypted user password, an asterisk (*), or the letter 'x'. (See pwconv(8) for an explanation of 'x'.)
            x是一个密码占位符，真正密码在/etc/shadow中
            UID       the numerical user ID.

GID the numerical primary group ID for this user.

            GECOS     This field is optional and only used for informational purposes. Usually, it contains the full username.
                      GECOS means General Electric Comprehensive Operating System, which has been renamed to GCOS when GE’s large
                      systems division was sold to Honeywell. Dennis Ritchie has reported: "Sometimes we sent printer output or
                      batch jobs to the GCOS machine. The gcos field in the password file was a place to stash the information
                      for the $IDENTcard. Not elegant."
            用户注释信息
            directory the user’s $HOME directory.
            用户的家目录
            shell     the program to run at login (if empty, use /bin/sh). If set to a non-existing executable, the user will be
                      unable to login through login(1).
            用户默认shell
[root@linux_basic you]# cat /etc/shells 安全shell，用于用户使用的默认
/bin/sh
/bin/bash
/sbin/nologin
/bin/dash
/bin/tcsh
/bin/csh

        /etc/group文件：
            组名:组密码占位符:GID:以逗号分隔属于此组（以之做为额外组）的用户列表
[root@linux_basic you]# head -1 /etc/group
root:x:0:
NAME
       group - user group file

DESCRIPTION
/etc/group is a text file which defines the groups on the system. There is one entry per line, with the following format:

group_name:passwd:GID:user_list

The field descriptions are:

group_name
the name of the group.

password
the (encrypted) group password. If this field is empty, no password is needed.

GID the numerical group ID.

user_list
a list of the usernames that are members of this group, separated by commas.

[root@linux_basic you]# which useradd
/usr/sbin/useradd
[root@linux_basic you]# ls -l `which useradd`
-rwxr-x---. 1 root root 103096 Oct 15 21:34 /usr/sbin/useradd
[root@linux_basic you]# which adduser
/usr/sbin/adduser
[root@linux_basic you]# ls -l `which adduser`
lrwxrwxrwx. 1 root root 7 Dec 8 20:06 /usr/sbin/adduser -> useradd
新增用户的命令
useradd命令：
NAME
useradd - create a new user or update default new user information

SYNOPSIS
useradd [options] LOGIN

useradd -D

       useradd -D [options]
[root@linux_basic you]# useradd user1
[root@linux_basic you]# tail -1 /etc/passwd
user1:x:501:501::/home/user1:/bin/bash
[root@linux_basic you]# useradd user2
[root@linux_basic you]# tail -2 /etc/passwd
user1:x:501:501::/home/user1:/bin/bash
user2:x:502:502::/home/user2:/bin/bash
每增加一个用户，其的uid都是前一个用户的uid加1
[root@linux_basic you]# tail -2 /etc/shadow
user1:!!:16425:0:99999:7:::
user2:!!:16425:0:99999:7:::
            -u UID
            -u, --uid UID
           The numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be
           non-negative. The default is to use the smallest ID value greater than or equal to UID_MIN and greater than every other
           user.
            -g GID: 所属的基本组
            -g, --gid GROUP
           The group name or number of the user's initial login group. The group name must exist. A group number must refer to an
           already existing group.

           If not specified, the behavior of useradd will depend on the USERGROUPS_ENAB variable in /etc/login.defs. If this
           variable is set to yes (or -U/--user-group is specified on the command line), a group will be created for the user, with
           the same name as her loginname. If the variable is set to no (or -N/--no-user-group is specified on the command line),
           useradd will set the primary group of the new user to the value specified by the GROUP variable in /etc/default/useradd,
           or 100 by default.
            -G GID: 所属的附加组
            -G, --groups GROUP1[,GROUP2,...[,GROUPN]]]
           A list of supplementary groups which the user is also a member of. Each group is separated from the next by a comma, with
           no intervening whitespace. The groups are subject to the same restrictions as the group given with the -g option. The
           default is for the user to belong only to the initial group.
            -c 'COMMENT'：注释信息
            -c, --comment COMMENT
           Any text string. It is generally a short description of the login, and is currently used as the field for the user's full
           name.
            -d /path/to/somewhere: 如果此目录事先存在，会有警告信息；
            -d, --home HOME_DIR 用户的家目录
           The new user will be created using HOME_DIR as the value for the user's login directory. The default is to append the
           LOGIN name to BASE_DIR and use that as the login directory name. The parent directory of HOME_DIR must exist otherwise
           the home directory cannot be created.
[root@linux_basic you]# ls /etc/skel/ -a   用户的必备信息
. .. .bash_logout .bash_profile .bashrc
[root@linux_basic you]# ls /home/user
user1/ user2/ user3/ user4/ user5/
[root@linux_basic you]# ls /home/user1/ -a
. .. .bash_logout .bash_profile .bashrc
[root@linux_basic you]# useradd -d /tmp/user3 user6
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
[root@linux_basic you]# su - user6
-bash-4.1$
-bash-4.1$
-bash-4.1$ ls
-bash-4.1$ exit
logout
[root@linux_basic you]# ls /tmp/user3/ -a
. ..
需要注意权限
[root@linux_basic you]# ls -ld /tmp/user3
drwxr-xr-x. 2 root root 4096 Dec 21 17:57 /tmp/user3
[root@linux_basic you]# ls /home/ -l
total 24
drwx------. 2 cactiuser cactiuser 4096 Dec 10 21:18 cactiuser
drwx------. 2 user1     user1     4096 Dec 21 17:33 user1
drwx------. 2 user2     user2     4096 Dec 21 17:34 user2
drwx------. 2 user3     user3     4096 Dec 21 17:41 user3
drwx------. 2 user4     user4     4096 Dec 21 17:43 user4
drwx------. 2 user5     user5     4096 Dec 21 17:45 user5
            -s SHELL: SHELL必须是/etc/shells文件中存在的shell
      -s, --shell SHELL
           The name of the user's login shell. The default is to leave this field blank, which causes the system to select the
           default login shell specified by the SHELL variable in /etc/default/useradd, or an empty string by default.
[root@linux_basic you]# useradd -s /bin/tcsh user7
[root@linux_basic you]# su - user7
[user7@linux_basic ~]$ ls
[user7@linux_basic ~]$ echo $SHELL
/bin/tcsh
[user7@linux_basic ~]$ exit
logout
[root@linux_basic you]# echo $SHELL
/bin/bash
            -m：强制给用户创建家目录
            -m, --create-home
           Create the user's home directory if it does not exist. The files and directories contained in the skeleton directory
           (which can be defined with the -k option) will be copied to the home directory.
            -M：不给用户创建家目录
      -M
           Do not create the user's home directory, even if the system wide setting from /etc/login.defs (CREATE_HOME) is set to
           yes.
            -r: 创建系统用户
            -r, --system
           Create a system account.

           System users will be created with no aging information in /etc/shadow, and their numeric identifiers are chosen in the
           SYS_UID_MIN-SYS_UID_MAX range, defined in /etc/login.defs, instead of UID_MIN-UID_MAX (and their GID counterparts for the
           creation of groups).
[root@linux_basic tmp]# useradd -r cacti
[root@linux_basic tmp]# tail -1 /etc/passwd
cacti:x:498:498::/home/cacti:/bin/bash   uid和gid都是小于500的

[root@linux_basic tmp]# useradd -u 1000 user3
[root@linux_basic tmp]# tail -1 /etc/passwd
user3:x:1000:1000::/home/user3:/bin/bash
[root@linux_basic tmp]# tail -1 /etc/group
user4:x:1001:
[root@linux_basic tmp]# useradd -u 1001 -g 1001 user4
[root@linux_basic tmp]# tail -1 /etc/passwd
user4:x:1001:1001::/home/user4:/bin/bash
[root@linux_basic tmp]# groupadd mytest
[root@linux_basic tmp]# useradd -G user4,mytest user5
[root@linux_basic tmp]# tail -1 /etc/passwd
user5:x:1002:1003::/home/user5:/bin/bash
[root@linux_basic tmp]# tail -1 /etc/shadow
user5:!!:16425:0:99999:7:::
[root@linux_basic tmp]# tail /etc/group
wbpriv:x:88:
apache:x:48:
mysql:x:27:
cactiuser:x:500:
user1:x:501:
user2:x:502:
user3:x:1000:
user4:x:1001:user5
mytest:x:1002:user5
user5:x:1003:
[root@linux_basic tmp]# useradd -r -s /sbin/nologin -M -u 301 mogilefs 可以不用加'M'选项，因为系统用户默认是不创建家目录的
[root@linux_basic tmp]# ls /home/
cactiuser user1 user2 user3 user4 user5 user7 user8
[root@linux_basic tmp]# tail -1 /etc/passwd
mogilefs:x:301:301::/home/mogilefs:/sbin/nologin

groupadd命令：添加组用户
NAME
groupadd - create a new group

SYNOPSIS
groupadd [options] group

DESCRIPTION
       The groupadd command creates a new group account using the values specified on the command line plus the default values from
       the system. The new group will be entered into the system files as needed.
            -g GID：指定GID，可以为id也可以为组名
-g, --gid GID
           The numerical value of the group′s ID. This value must be unique, unless the -o option is used. The value must be
           non-negative. The default is to use the smallest ID value greater than 999 and greater than every other group. Values
           between 0 and 999 are typically reserved for system accounts.
            -r: 系统组
-r, --system
           Create a system group.
[root@linux_basic tmp]# groupadd user9
[root@linux_basic tmp]# useradd -r -g user9 user8
useradd: user 'user8' already exists
[root@linux_basic tmp]# useradd -r -g user9 user9
[root@linux_basic tmp]# tail -1 /etc/passwd
user9:x:300:1007::/home/user9:/bin/bash
[root@linux_basic tmp]# su - user9
su: warning: cannot change directory to /home/user9: No such file or directory
-bash-4.1$ exit
logout

[root@linux_basic tmp]# groupadd -r user10
[root@linux_basic tmp]# useradd -g user10 user10
[root@linux_basic tmp]# tail -1 /etc/passwd
user10:x:1007:300::/home/user10:/bin/bash

转载于:https://my.oschina.net/u/1762991/blog/662968