Setting up a new user: Difference between revisions

From Alpine Linux
(Created page with "Creating a user is an important step when first configuring a Linux system. Generally ''root'' account is used for administration only as it has access to the operating system...")
 
mNo edit summary
(80 intermediate revisions by 20 users not shown)
Line 1: Line 1:
Creating a user is an important step when first configuring a Linux system. Generally ''root'' account is used for administration only as it has access to the operating system and its configuration.
 
The <code>root</code> account should be used only for local administrative purposes that require elevated access permissions.
 
This page shows how to create non-privileged user accounts. i.e. those used for daily work, including desktop use and remote logins.


= Overview =
= Overview =


When Alpine Linux is first installed by default it comes with the user ''root'' with no password set. For security reasons it's always a good idea to either set a password to the user ''root'' or disabling the login to the user, which its why is suggested to run <code>[[setup-alpine]]</code> to change ''root'' password.
Creating user accounts provides users with their own {{path|$HOME}} directory and allows you (the root user) to limit the access those user accounts have to the operating system configuration files.


Creating an account allows it to have it's own $HOME directory and allows you to limit access to the configuration of the operating system for security reasons.
Using them increases security, because they limit possible actions and thus possible damage (even from accidental errors).


= Creating a new user =
= Creating a new user =


Using the command '''adduser''' will allow you to create a new user in the system.
# adduser --help
Usage: adduser [OPTIONS] USER [GROUP]
Create new user, or add USER to GROUP
-h DIR Home directory
-g GECOS GECOS field
-s SHELL Login shell
-G GRP Group
-S Create a system user
-D Don't assign a password
-H Don't create home directory
-u UID User id
-k SKEL Skeleton directory (/etc/skel)


If no ''OPTIONS'' is set, by default when creating a new user, it will create a home directory in {{Path|/home/<username>}}, with the shell set that uses the ''root'' account (ash by default), user ID and group ID 1000+, and the GECOS field ''Linux User,,,''.
{{Warning|If using a '''"diskless" or "data" disk mode''' installation, it's important to make the <code>/home</code> directory persistent.
<br>
* Either the <code>/home</code> filesystem needs to be mounted from a writable partition, or
* the /home directories have to be added to the lbu backup, and a new local backup needs to be committed after creating the user:
{{Cmd| # lbu include /home
# lbu commit
}} (Not recommended, as reverting to an older .apkovl will also revert the files in /home).
}}
 
Regular user accounts can be created with:
{{Cmd|# adduser [-g "<Full Name>"] <username>}}
 
By default, <code>adduser</code> will:
* prompt you to set a password for the new user
* create a home directory in {{Path|/home/<username>}}
* set the shell to the one used by the <code>root</code> account (ash by default)
* assign user ID and group ID starting at 1000
* set the GECOS (full name) field to "Linux User,,,"
 
{{Tip|The optional <code>-g "<Full Name>"</code> above sets the GECOS field.
This can be very useful to specify. Setting this string - at least equal to the username - makes the user distinguishable, e.g. when they are listed at the login screen of a display manager.
}}
 
'''If a user ''really must'' be allowed to have access to the root account''', the <username> can be added to the '''wheel''' group and <code>{{Pkg|doas}}</code> ("do as") may be installed:
# adduser -g "<username>" <username>
# adduser <username> wheel
# apk add doas
 
You will want to allow members of the '''wheel''' group to use root privileges with <code>doas</code>. To do this, open the <code>doas</code> config file:


== Example creating a user ==
{{Cmd|# <editor> /etc/doas.d/doas.conf}}
{{Cmd|adduser test}}


It will prompt to set a password for the new user
Add the following line and save the file:
# adduser test
{{Cmd|permit persist :wheel}}
Changing password for test
New password:
Retype password:  
passwd: password for test changed by root


The new user can be seen in  
{{Warning|It's recommended to '''not''' run complete applications, like editors, as root just to modify administrative files.
<br>
* [https://github.com/AN3223/scripts/blob/master/doasedit <code>doasedit</code>] or <code>sudoedit</code>([https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.15.0#Move_from_sudo_to_doas being deprecated in favour of <code>doas</code>]) enables starting an editor with a temporary copy of a file, which overwrites the original file after the user modifies and saves it. For example, <code>sudoedit /etc/apk/lbu.conf</code>
* Many desktop environments and file browsers support using <code>admin:///</code> in their address bars, to access files through a local gvfs-admin mount.
}}
The <code>sudo</code> package is an alternative to using the BSD-like <code>doas</code>, but is a much larger package.
It may be used as follows: adding a custom user configuration file to avoid having to deal with manually changing configuration files later during package upgrades.
apk add sudo
NEWUSER='yourUserName'
adduser -g "${NEWUSER}" $NEWUSER
echo "$NEWUSER ALL=(ALL) ALL" > /etc/sudoers.d/$NEWUSER && chmod 0440 /etc/sudoers.d/$NEWUSER
 
<br>
 
If no seat manager like [[elogind]] or [[seatd]] is being used and running, then users that want a graphical environment need the '''video''' and '''input''' groups:
# adduser '<username>' video
# adduser '<username>' input
 
The above is highly discouraged. See {{Issue|15409}}.
 
The new user gets listed in  


{{Cat|/etc/passwd|root:x:0:0:root:/root:/bin/ash
{{Cat|/etc/passwd|root:x:0:0:root:/root:/bin/ash
Line 41: Line 74:
.
.
.
.
test:x:1000:1000:Linux User,,,:/home/test:/bin/ash}}
<username>:x:1000:1000:<username>:/home/<username>:/bin/ash}}
 
Now you should be able to issue the command <code>exit</code> and login to the new account.
 
= Options =
 
=== adduser ===
 
Usage (from "man busybox"):
 
<pre><nowiki>adduser [OPTIONS] USER [GROUP]
 
Create new user, or add USER to GROUP
 
    -h --home DIR          Home directory
    -g --gecos GECOS        GECOS field
    -s --shell SHELL        Login shell named SHELL by example /bin/bash
    -G --ingroup GRP        Group (by name)
    -S --system            Create a system user
    -D --disabled-password  Don't assign a password, so cannot login
    -H --no-create-home    Don't create home directory
    -u --uid UID            User id
    -k SKEL                Skeleton directory (/etc/skel)
</nowiki></pre>
 
{{Tip|Multi-user collaboration
If <nowiki>--ingroup</nowiki> isn't set, (default) the new user is assigned a new GID that matches the UID. If the GID corresponding to a provided UID already exists, adduser will fail.
 
This ensures new users default to having a "user's private group" (UPG) as primary group. These allow the system to use a permission umask (002), which creates new files automatically as group-writable, but only by the user's private group. In special set-group-id (collaboration) directories, new files can be automatically created writable by the directory's group.
}}
 
=== addgroup ===
 
Usage (from "man busybox"):  
 
<pre><nowiki>addgroup [-g GID] [-S] [USER] GROUP
 
Create a group or add a user to a group
 
    -g --gid GID    Group id
    -S --system    Create a system group
</nowiki></pre>
 
= Home directory permissions =
 
`adduser` creates home directories with permissions `rwxr-sr-x`. This makes the directory readable by all other users on the system. If you prefer to not allow other users to read your home directory, the permissions can be changed:
 
{{Cmd| chmod o-rx <path-to-directory>}} 
 
= Legacy =
 
=== Common permission groups ===
 
{{Draft|Need to note a few security implications outlined on [https://wiki.debian.org/SystemGroups debian/wiki SystemGroups]}}
 
Groups are needed for certain operations on your system.
 
(Names taken from https://git.alpinelinux.org/alpine-baselayout/tree/group)
 
{{Cmd|adm        Used for system monitoring tasks.
disk        Raw access to disks.  '''Mostly equivalent to root access.'''
lp          Members of this group can enable and use printers.
wheel      Administrator group, members can use '''doas''' to run commands as root if enabled in the doas configuration.
floppy      Access to floppy drives and other removable (non-optical) drives (like USB flash drives).
audio      Direct access to sound hardware (the soundcard or a microphone).
cdrom      For access to disk writers and mounting DVD, BR or CD-ROM disk as normal user.
dialout    Full and direct access to serial ports.
input      Access to input devices.
tape        Needed to give a set of users access to a tape drive.
video      Access to video capture devices (like a webcam).
netdev      For network connections management as normal user.
kvm        Needed to use the KVM acceleration of virtual machines.
games      Access to some game software.
cdrw        Needed to write RW-DVD, RW-BR or RW-CD disk on a disk writing device.
usb        Needed to access special USB devices, deprecated group.
users      Needed if you plan to used common files for all users, mandatory as desktop usage.}}
 
To add your user to a group use the following command:
{{Cmd|# adduser <username> <group>}}
{{Note|You need to log out for the group change(s) to take effect.}}
 
To see what group(s) a <username> is in, use the following command:
{{Cmd|# id <username>}}
 
= Old newbie notes =
 
=== User creation and defaults ===
 
The following commands will set up root environment login, then assign a new password:
 
<pre><nowiki>
cat > /root/.cshrc << EOF
unsetenv DISPLAY || true
HISTCONTROL=ignoreboth
EOF
 
cp /root/.cshrc /root/.profile
 
echo "secret_new_root_password" | chpasswd
</nowiki></pre>
 
By default, remote management cannot be done directly with the root account. Because of SSH security we need to set up a remote connection account that will be used to switch to the root user via the su command, once connected.
 
Here's an example: create user named "remote" and a user named "general". We will set up a hardened, limited, user environment and create those two users:
 
<pre><nowiki>
mkdir -p /etc/skel/
 
cat > /etc/skel/.logout << EOF
history -c
/bin/rm -f /opt/remote/.mysql_history
/bin/rm -f /opt/remote/.history
/bin/rm -f /opt/remote/.bash_history
EOF
 
cat > /etc/skel/.cshrc << EOF
set autologout = 30
set prompt = "$ "
set history = 0
set ignoreeof
EOF
 
cp /etc/skel/.cshrc /etc/skel/.profile
 
adduser -D --home /opt/remote --shell /bin/ash remote
 
echo "secret_new_remote_user_password" | chpasswd
 
adduser -D --shell /bin/bash general
 
echo "secret_new_general_user_password" | chpasswd
</nowiki></pre>
 
{{Tip|"'''general'''" is the name of the user. That name MUST contain ONLY lowercase letters, NO spaces and NO symbols}}
 
Note that those users are created with minimal privilege settings.
 
== User management and system access ==
 
By default, a newly created user will not have enough privileges for most desktop purposes.
 
To add newly created users to groups that may come in handy for desktop useage, you run this command as root:
 
{{cmd|for u in $(ls /home); do for g in disk lp floppy audio cdrom dialout video netdev games users; do addgroup $u $g; done;done}}
 
== See also ==


You can now ''exit'' and login to the new account.
* [https://wiki.archlinux.org/title/Users_and_groups Users and groups - Archwiki]


= TODO =
[[Category: System_Administration]]
Adding user to a group?, Privilege escalation with sudo?

Revision as of 04:29, 19 April 2024

The root account should be used only for local administrative purposes that require elevated access permissions.

This page shows how to create non-privileged user accounts. i.e. those used for daily work, including desktop use and remote logins.

Overview

Creating user accounts provides users with their own $HOME directory and allows you (the root user) to limit the access those user accounts have to the operating system configuration files.

Using them increases security, because they limit possible actions and thus possible damage (even from accidental errors).

Creating a new user

Warning: If using a "diskless" or "data" disk mode installation, it's important to make the /home directory persistent.


  • Either the /home filesystem needs to be mounted from a writable partition, or
  • the /home directories have to be added to the lbu backup, and a new local backup needs to be committed after creating the user:

# lbu include /home # lbu commit

(Not recommended, as reverting to an older .apkovl will also revert the files in /home).


Regular user accounts can be created with:

# adduser [-g "<Full Name>"] <username>

By default, adduser will:

  • prompt you to set a password for the new user
  • create a home directory in /home/<username>
  • set the shell to the one used by the root account (ash by default)
  • assign user ID and group ID starting at 1000
  • set the GECOS (full name) field to "Linux User,,,"
Tip: The optional -g "<Full Name>" above sets the GECOS field.

This can be very useful to specify. Setting this string - at least equal to the username - makes the user distinguishable, e.g. when they are listed at the login screen of a display manager.

If a user really must be allowed to have access to the root account, the <username> can be added to the wheel group and doas ("do as") may be installed:

# adduser -g "<username>" <username>
# adduser <username> wheel
# apk add doas

You will want to allow members of the wheel group to use root privileges with doas. To do this, open the doas config file:

# <editor> /etc/doas.d/doas.conf

Add the following line and save the file:

permit persist :wheel

Warning: It's recommended to not run complete applications, like editors, as root just to modify administrative files.


  • doasedit or sudoedit(being deprecated in favour of doas) enables starting an editor with a temporary copy of a file, which overwrites the original file after the user modifies and saves it. For example, sudoedit /etc/apk/lbu.conf
  • Many desktop environments and file browsers support using admin:/// in their address bars, to access files through a local gvfs-admin mount.


The sudo package is an alternative to using the BSD-like doas, but is a much larger package. It may be used as follows: adding a custom user configuration file to avoid having to deal with manually changing configuration files later during package upgrades.

apk add sudo
NEWUSER='yourUserName'
adduser -g "${NEWUSER}" $NEWUSER
echo "$NEWUSER ALL=(ALL) ALL" > /etc/sudoers.d/$NEWUSER && chmod 0440 /etc/sudoers.d/$NEWUSER


If no seat manager like elogind or seatd is being used and running, then users that want a graphical environment need the video and input groups:

# adduser '<username>' video
# adduser '<username>' input

The above is highly discouraged. See #15409.

The new user gets listed in

Contents of /etc/passwd

root:x:0:0:root:/root:/bin/ash . . . <username>:x:1000:1000:<username>:/home/<username>:/bin/ash

Now you should be able to issue the command exit and login to the new account.

Options

adduser

Usage (from "man busybox"):

adduser [OPTIONS] USER [GROUP]

Create new user, or add USER to GROUP

     -h --home DIR           Home directory
     -g --gecos GECOS        GECOS field
     -s --shell SHELL        Login shell named SHELL by example /bin/bash
     -G --ingroup GRP        Group (by name)
     -S --system             Create a system user
     -D --disabled-password  Don't assign a password, so cannot login
     -H --no-create-home     Don't create home directory
     -u --uid UID            User id
     -k SKEL                 Skeleton directory (/etc/skel)
Tip: Multi-user collaboration

If --ingroup isn't set, (default) the new user is assigned a new GID that matches the UID. If the GID corresponding to a provided UID already exists, adduser will fail.

This ensures new users default to having a "user's private group" (UPG) as primary group. These allow the system to use a permission umask (002), which creates new files automatically as group-writable, but only by the user's private group. In special set-group-id (collaboration) directories, new files can be automatically created writable by the directory's group.

addgroup

Usage (from "man busybox"):

addgroup [-g GID] [-S] [USER] GROUP

Create a group or add a user to a group

    -g --gid GID    Group id
    -S --system     Create a system group

Home directory permissions

`adduser` creates home directories with permissions `rwxr-sr-x`. This makes the directory readable by all other users on the system. If you prefer to not allow other users to read your home directory, the permissions can be changed:

chmod o-rx <path-to-directory>

Legacy

Common permission groups

This material is work-in-progress ...

Need to note a few security implications outlined on debian/wiki SystemGroups
(Last edited by Vptr on 19 Apr 2024.)

Groups are needed for certain operations on your system.

(Names taken from https://git.alpinelinux.org/alpine-baselayout/tree/group)

adm Used for system monitoring tasks. disk Raw access to disks. Mostly equivalent to root access. lp Members of this group can enable and use printers. wheel Administrator group, members can use doas to run commands as root if enabled in the doas configuration. floppy Access to floppy drives and other removable (non-optical) drives (like USB flash drives). audio Direct access to sound hardware (the soundcard or a microphone). cdrom For access to disk writers and mounting DVD, BR or CD-ROM disk as normal user. dialout Full and direct access to serial ports. input Access to input devices. tape Needed to give a set of users access to a tape drive. video Access to video capture devices (like a webcam). netdev For network connections management as normal user. kvm Needed to use the KVM acceleration of virtual machines. games Access to some game software. cdrw Needed to write RW-DVD, RW-BR or RW-CD disk on a disk writing device. usb Needed to access special USB devices, deprecated group. users Needed if you plan to used common files for all users, mandatory as desktop usage.

To add your user to a group use the following command:

# adduser <username> <group>

Note: You need to log out for the group change(s) to take effect.

To see what group(s) a <username> is in, use the following command:

# id <username>

Old newbie notes

User creation and defaults

The following commands will set up root environment login, then assign a new password:

cat > /root/.cshrc << EOF
unsetenv DISPLAY || true
HISTCONTROL=ignoreboth
EOF

cp /root/.cshrc /root/.profile

echo "secret_new_root_password" | chpasswd

By default, remote management cannot be done directly with the root account. Because of SSH security we need to set up a remote connection account that will be used to switch to the root user via the su command, once connected.

Here's an example: create user named "remote" and a user named "general". We will set up a hardened, limited, user environment and create those two users:

mkdir -p /etc/skel/

cat > /etc/skel/.logout << EOF
history -c
/bin/rm -f /opt/remote/.mysql_history
/bin/rm -f /opt/remote/.history
/bin/rm -f /opt/remote/.bash_history
EOF

cat > /etc/skel/.cshrc << EOF
set autologout = 30
set prompt = "$ "
set history = 0
set ignoreeof
EOF

cp /etc/skel/.cshrc /etc/skel/.profile

adduser -D --home /opt/remote --shell /bin/ash remote

echo "secret_new_remote_user_password" | chpasswd

adduser -D --shell /bin/bash general

echo "secret_new_general_user_password" | chpasswd
Tip: "general" is the name of the user. That name MUST contain ONLY lowercase letters, NO spaces and NO symbols

Note that those users are created with minimal privilege settings.

User management and system access

By default, a newly created user will not have enough privileges for most desktop purposes.

To add newly created users to groups that may come in handy for desktop useage, you run this command as root:

for u in $(ls /home); do for g in disk lp floppy audio cdrom dialout video netdev games users; do addgroup $u $g; done;done

See also