Unix for Mac OS X 10.4 Tiger: Visual QuickPro Guide (2nd Edition)
Managing User Accounts and Groups

The system administrator's job includes adding new users to the system and managing the ability of various groups to access different parts of the file system (review Chapter 8).

The easiest way to add a user in Mac OS X is with the Accounts pane in System Preferences (see the following task). This not only adds the user, but it also creates his or her home directory and several files that each user needs.

It is possible to add a user to your system using the command line, but the process is rather complex and is beyond the scope of this book. (If you really must know how, see the sidebar "Adding a User from the Command Line," later in this chapter.)

Adding and deleting users with System Preferences

The Mac OS X System Preferences is a GUI interface for many basic administrative tasks . You access System Preferences from the Apple menu or from the Dock.

To create a new user:

1.

Choose System Preferences from the Apple menu or click its icon in the Dock. The main System Preferences window opens ( Figure 11.3 ).

Figure 11.3. The System Preferences window.

2.

Click the Accounts icon.

The Accounts pane opens showing the list of users on the left ( Figure 11.4 ).

Figure 11.4. The Accounts pane of System Preferences, showing users.

All the current regular users are shown (not shown are special system accounts, including the root account).

3.

Click the lock icon.

You will get a dialog asking for your user name and password ( Figure 11.5 ). This is basically the Aqua version of using sudo you are about to assume root privileges for this task. Fill in the dialog and click OK.

Figure 11.5. The Authenticate dialog, asking for your user name and password.

4.

Back in the Accounts pane, click the plus (+) button, just above the lock icon.

A dialog slides down with fields for the new user's information ( Figure 11.6 ).

Figure 11.6. The dialog that appears when you click the plus button on the Accounts pane.

5.

Fill in the Name and Short Name fields for the new user.

The Name field is just the everyday name, typically including both first and last name. Mac OS X uses the term short name for what all Unix systems call the user name or login name ." On many Unix systems the short name must be eight characters or less and should consist only of lowercase letters and numbers , so you may want to stick with that to be consistent with other Unix systems. But in Mac OS X since 10.2, you can use up to 255 bytes for the short user name. (Note, however, that bytes does not mean characters, because there are multibyte characters, for example, in Japanese.)

6.

Fill in the user's new password.

You type the password twice, and it is displayed as a series of bullets (so someone looking over your shoulder won't see it).

7.

If you click the key icon next to the Password field (see Figure 11.6), you get the cool Password Assistant dialog ( Figure 11.7 ), which will help you create a good password.

Figure 11.7. The Password Assistant dialog.

You may fill in a "password hint" for the user. This will show up in the Aqua Login window if he or she fails three login attempts in a row. (The hint option must also be set in the Login Options pane of the Accounts preferences pane.)

8.

If you want the new user to have root access on the machine, check the box next to "Allow user to administer this computer."

Figure 11.8 shows an example of the new-user dialog filled in and ready to save.

Figure 11.8. The new user dialog all filled in and ready to save.

9.

Click Create Account.

At this point the new user has been added to the system, and that person can log in.

The new-user dialog slides away and the Accounts pane shows the new user's name in the list ( Figure 11.9 ).

Figure 11.9. The Accounts pane, showing the new user added to the list.

The new user's home directory has been created, along with various subdirectories such as his or her Documents folder. Also, a configuration file for the Apache Web server is created for the new user in /etc/httpd/users/ .

Add more users if you like.

10.

Quit System Preferences.

Tip

Occasionally you'll need to remove a user, and you can use System Preferences to do that as well. It gives you a choice about whether or not to completely delete the user's home directory; the default behavior is to create a disk-image file (a .dmg file) of the user's home directory and place that file in the /Users/Deleted Users directory.

To remove a user:

1.

Open System Preferences.

2.

Click the Accounts icon.

3.

Select the user from the list.

4.

Click the minus () button at the bottom of the list of users (see Figure 11.9).

You will get a dialog asking if you want to delete the user's home directory immediately or allow a disk image to be placed in /Users/Deleted Users .

5.

Choose either OK or Delete Immediately.

If you allow the disk image to be created, you can always remove it later.

6.

Quit System Preferences.

Choosing a Safer Password

Good passwords always have a combination of letters, numbers, punctuation marks, and symbols (!@#$%^&*_+-=":;'><,.?/\), and never contain a dictionary word. For example, secret23 would be a terrible password, far too easy for a computerized guessing program to figure out.

One way to make a good password is to use the first letter from each word in a song lyric or poem, and change some of the characters to numbers and punctuation. For example, the lyric "Sporting 50-dollar sneakers and all the money's spent" (from Grandmaster Flash's "All Wrapped Up") might become the password S50$s&atm .

In addition to the root password, all user passwords, especially those for admin users, must also be excellent in order for your system to have good security. In Mac OS X, having an admin user's password is equivalent to having the root password. (We'll go into more about choosing good passwords in Chapter 12, "Security.")

Tip

Adding a User from the Command Line

OK, you want to be a hotshot Unix sysadmin. At the end of this sidebar we provide a list of things you have to do to add a user from the command line. Each of these steps has several substeps .

Before trying this, download the Apple documentation for Mac OS X Server Command-Line Administration: http://images.apple.com/server/ pdfs /Command_Line_v10.4.pdfand please , experiment on a noncritical machine.

The documentation in the PDF file mentioned above refers to some command-line tools ( serversetup , dsimport , createhomedir , and so on). One of them, serversetup , is not installed in the non-Server version of Mac OS X. So unless you are working on the Server version, you will not be able to create new admin users from the command line or perform some of the tests that the documentation describes. The tools are installed in different places on the Server and non-Server versions of Mac OS X. In the non-Server version these commands are installed in /usr/bin and /usr/sbin , so they are already in your PATH . (See Chapter 7 for more about your PATH .)

Here is the basic process:

1.

Create a text file containing the required information for the user(s) you are adding. The PDF file mentioned above has examples of this file.

2.

Use the dsimport command to import the file. See man dsimport .

3.

Use the createhomedir command to create home directories for the user(s). This will also populate the directories with the appropriate files. See man createhomedir .

Note: There is a command-line tool called dsidentity that can be used to create a limited type of user account at the command line. The dsidentity tool is intended for creating accounts that are used only for remote file sharing and similar purposes. See man dsidentity for more.

Managing passwords

Perhaps the most common task for a system administrator is to help users who have forgotten their password. While there is no easy way to find a user's current password, it can be changed easily. You can use System Preferences, but you can also do this easily from the command line. Refer to Figure 11.10 throughout the following task.

Figure 11.10. Changing a user's password with the passwd command.

To change a user's password:

1.

sudo passwd user nam e

The user name argument is the same as the short name that was entered when the user's account was created. For example,

sudo passwd sarafina

If you haven't used sudo in the last 5 minutes, you are prompted for your password, with just

Password:

After you enter your password, or if you have recently used sudo , you will see a prompt from the passwd command.

2.

Enter the user's new password.

3.

Reenter the new password.

Because the passwords are not displayed, you have to enter them twice to make sure you have it right. If the entries don't match, you'll be prompted to enter them again.

Tips

Changing a user's login shell

Although it's not as common an activity as changing passwords, system administrators occasionally are asked (or decide) to change a user's login shell. For example, a user might want to use the tcsh shell as his or her login shell instead of the Mac OS X default (which is bash ).

The command-line tool for changing a user's shell in Darwin and Mac OS X is quite different from that used in other versions of Unix (in which you would probably use either usermod or chsh ). Darwin and thus Mac OS X use a different system than other flavors of Unix to store and access all the system-configuration information, such as users, groups, and mounted disks. See the sidebar "About lookupd , Open Directory, and Directory Service."

The main command-line tool for dealing with the Directory Services system is dscl ( Directory Service command line ), and that's what you'll use in the following task ( Figure 11.11 )

Figure 11.11. Using dscl to change a user's login shell from /bin/bash to /bin/tcsh .

localhost:~ vanilla$ sudo dscl . -change /users/name=puffball UserShell /bin/bash /bin/tcsh Password: localhost:~ vanilla$ dscl . -read /users/name=puffball UserShell UserShell: /bin/tcsh localhost:~ vanilla$

About lookupd, Open Directory, and Directory Service

All Unix systems need a way to store and retrieve system-configuration information about users, groups, networks, and disks. On many other Unix systems, this data is stored (primarily) in text files in the /etc directory. For example, /etc/passwd usually has all the user accounts, and /etc/ group has the list of groups.

While Mac OS X/Darwin is able to use the traditional /etc files (which it calls BSD Flat Files) to manage system-configuration information, at a more fundamental level it uses a system called Open Directory, which uses the DirectoryService and lookupd daemons. Apple has rewritten the low-level software libraries ( get_pw for you C hackers) so that they use lookupd . The lookupd daemon can use a variety of data sources, including BSD Flat Files, Apple's legacy NetInfo database (see the sidebar "Deeper into NetInfo"), an LDAP server, and more. For more on lookupd , see man lookupd . For more on Directory Services, see man DirectoryService and http://developer.apple.com/darwin/projects/opendirectory/.

To change a user's login shell:

1.

sudo dscl . -change /users/ user

UserShell oldshell newshell

For example, to change the shell for user puffball from /bin/bash to /bin/tcsh the command line is

sudo dscl . -change /users/puffball UserShell /bin/bash /bin/tcsh

If sudo prompts you for your password, enter it.

Now you can check that the change took place:

2.

dscl . -read /users/ user UserShell

For example:

dscl . -read /users/puffball

Tips

Tracking who uses the system

Every time a user logs in, entries are made in three log files. These files enable you to see who is currently using the system and a history of logins to the system.

Table 11.2 lists these files and the commands used to view them.

Table 11.2. Files Used to Track User Logins

F ILE

P URPOSE AND C OMMANDS

var/run/utmp

Shows who is logged in right now ( tmp stands for temporary ). Used by the users , w , and who commands.

/var/log/wtmp

Records each login and logout. A binary file, not human-readable . Used by the last and ac commands. This file is "rolled over" every month by the script /etc /monthly . See "Running Regularly Scheduled Commands," later in this chapter.

/var/log/lastlog

Records the date and time of each user's last login. The date of the last login is displayed when logging in via a command-line interface (for example, when you open a new Terminal window).

Using the commands listed in Table 11.2, you can see a good deal of information about who was and is using your system.

To see a list of users logged in right now:

To see a list of users and where they logged in from:

Deeper into NetInfo

The NetInfo system is being phased out of Mac OS X/Darwin but is still in use as of Mac OS X 10.4 and probably will be for a while. NetInfo was originally a hierarchical directory service system like LDAP or Active Directory, but it is now used solely for storing local configuration information. The data stored in NetInfo is mostly data that is stored on other Unix systems in plain-text files: The file /etc/passwd has the list of all users, their home directories, and their login shells . In Darwin, /etc/passwd is used only when the machine is in single-user mode, but on most Unix systems, /etc/passwd is the only database of users.

The official Apple overview of the NetInfo system is available as a PDF document at www.apple.com/server/pdfs/UnderstandingUsingNetInfo.pdf.

To see who is logged in and what they are doing:

To see a history of logins for all users:

To see a history of all logins for one user:

Tip

To see a summary of login times:

Tip

Managing groups

In Chapter 8, you learned about how Unix uses groups to grant permission for various file operations (read, write, execute) to groups of users. And earlier in this chapter, you learned that Mac OS X allows any user in the admin group to use sudo to execute commands as root.

In this section we're going to show you how to change a user's group assignment, and how to add and remove groups. A common reason to create a new group is if you have several people using your computer and want to allow some of them to have write permission in a directory where the other users do not. You would create a new group and put each of the team members into that group. Users can be members of many groups.

You will be using a Darwin-only tool called dseditgroup to manage group information, as well as the Darwin-only nireport and dscl .

To see all the groups a user belongs to:

Tip

To see a list of all the groups:

To see all the attributes of one group:

To see all the users who belong to a group:

Compare with Aqua: NetInfo Manager

You can use the GUI application NetInfo Manager to see who is a member of a group, as well as to add and remove groups. Even though NetInfo Manager is a GUI application, it is far less easy to use than most Mac applications. This is one case where the command-line tools are probably easier than the GUI equivalent.

To create a new group:

1.

First get the list of all groups as described in the task "To see a list of all the groups":

dscl . -list /groups PrimaryGroupID

2.

Make up a group name that is not in use.

Group names should be all lowercase and should contain only letters and numbers.

3.

sudo dseditgroup -o create groupname

You must be root to modify the data sources used by Directory Service, hence the use of sudo .

For example, to create a group called "dancers":

sudo dseditgroup -o create dancers

Enter your password if sudo prompts you for it.

If a group already exists with the name you chose, you will be asked if you want to overwrite the existing record.

Tips

To add a user to an existing group:

Starting in Mac OS X 10.4, you can have groups be members of other groups. Any user who is a member of a subgroup is automatically a member of the higher-level group(s). You may only add groups to groups that were created using the new 10.4 tools, such as dseditgroup , described above. (That is, you will get an error if you try to add a group to a "legacy-style" group.)

To display information about a group:

To add a group to another group:

To remove a user from a group:

To remove a subgroup from a group:

To remove a group:

1.

sudo dseditgroup -o delete groupname

For example, to delete a group called "tango":

sudo dseditgroup -o delete tango

You will get a prompt telling you the group already exists and asking if you really want to delete it:

Delete called on existing record - do you really want to delete, y or n :

2.

y

Typing y confirms the request to delete the group. It's gone as soon as you press .

Related

Категории