Chapter3.Working with SUSE Linux Enterprise Server 9

If the second field in the /etc/passwd file is an "x", shadow passwords are enabled. This is the default configuration for SLES. Shadow passwords provide for a more secure environment, and allow for additional password aging options.

When you use shadow passwords, an additional configuration file is used for storing encrypted user passwords. This file is the /etc/shadow file. Table 3.2 explains the fields of this file for the entry jdoe:AztgeYU5TrGn.:12702:0:38:7:3::: .

Table 3.2. Explanation of /etc/shadow EnTRy

Within the /etc/passwd file, the fourth field contains the GID of the primary group of the specified user. When users create files and directories, the new filesystem objects receive a user owner and a group owner. The user owner is the UID of the user who created the filesystem entry. The group owner is the GID of the user's primary group at the time of object creation. (Both the UID and GID numbers are converted to user and group names when viewing file listings.) Local groups are defined in the /etc/group file. Table 3.3 shows the fields and their definitions for the entry users:x:100:tjohnson,mblack .

Table 3.3. Explanation of the /etc/group File

NOTE

A user's primary group designation is performed within the /etc/passwd file. Any additional or secondary groups the user belongs to are defined using the last field of the /etc/group file.

Creating and modifying local user accounts and groups can be done with several utilities. Within SLES, the YaST utility can be used to easily create these accounts. (Information on YaST can be found in Chapter 6.) Users and groups can also be added to the system using several command-line utilities. A few of these utilities are listed in Table 3.4.

Table 3.4. Local User and Group Utilities

The Root Administrator Account

Within Linux, the superuser or administrator account is known as root. This account has all rights over everything found on a Linux server. It is important to realize that these rights cannot be locked out or restricted in any way. Given the vast amount of power root has, a secure and confidential password must be used for this account.

It is also important to avoid using the root account just for the sake of accessibility. When you are logged in as root, malicious scripts or programs can potentially be deadly to your Linux environment if they are run accidentally . Be sure to avoid these issues by logging in as a regular user and only using root privileges when necessary. (See the "Switching Identities" section later in this chapter for more information on that topic.)

The UID for root is always 0 (zero). This is hard-coded into many aspects of Linux and should not be manually adjusted. Also, when integrating local Linux accounts into OES through LUM, the root account should not be included. Local user account access to the server as the root user is critical for many troubleshooting steps.

NOTE

The UID for root is always 0. UID numbers from 1 to 999 are reserved for special daemon or system user accounts. Normal SLES user account UID numbers begin at 1000.

The Login Process

There are actually many methods by which a user can authenticate or log in to a Linux server. The tables in the preceding section describe how local user accounts are stored in the system, but having a local user account is only one step in the login process.

Local logins are not the only method of authentication to a Linux server. Logins can be initiated through several methods, including remote graphical sessions, remote shell sessions, and service-specific type of authentications, such as occur when authenticating to a Samba server.

Although these types of authentications normally rely on the local user account files, most can also be configured to authenticate using a remote user account store. These stores can be many different types, but authentication back to an LDAP-enabled directory, such as eDirectory, is an extremely common method of providing account management. OES provides for this functionality in the Linux User Management (LUM) component. LUM is covered in detail in Chapter 8, "Users and Network Security." LUM is actually quite complex, and understanding the authentication process of a local login should help you get prepared for implementing LUM.

In SLES, Pluggable-Authentication Modules (PAM) are used to provide user authentication to all PAM-enabled services. PAM-enabled services include local logins, secure shell access, and most other services requiring authentication. PAM configuration of these services is performed using service-specific configuration files found in /etc/pam.d . In this directory, each service relying on PAM to enforce authentication has a configuration file. The default login configuration file used for local logins is shown in Figure 3.2.

PAM configuration divides the authentication process across four distinct module types. The explanations for these module types can be found in Table 3.5.

Table 3.5. PAM Module Types

Each module type takes one of four control flags as a parameter used to indicate how that specific module is to be handled. These control flags are explained in Table 3.6.

Table 3.6. PAM Control Flags

The last two fields of the PAM configuration file for any service are used to denote external authentication modules and any parameters those modules may require. Many different modules can be used for each portion of the authentication stages. These modules range from providing LDAP lookup for user accounts to checking passwords for certain security requirements.

In the case of a login process based on the configuration file in Figure 3.2, the authentication process would have to successfully pass all requirements for each specified module in order to generate a fully authenticated connection. In other words, the pam_unix2.so module would ensure that the user's account exists and is allowed access. The pam_securetty.so module then determines if the user is allowed to log in from the current terminal. The pam_nologin.so module is used to check for the existence of an /etc/ nologin file, which would prevent non-root users from logging in. This process continues until all modules have been processed. If the PAM modules are successfully processed, the user is authenticated and provided with a shell prompt. Otherwise, the user is denied access.

NOTE

For more information on PAM configuration, including possible authentication modules and their options, please refer to the PAM documentation found in /usr/share/doc/packages/pam .

Switching Identities

When you have logged in to a Linux environment using your local account, you may find that you have insufficient privileges to accomplish a specific task. In order to execute certain commands, or have rights to view specific files, it is sometimes required to change your identity to that of the root user. To do this, you must use the su command.

The su or "substitute user" command is used to temporarily substitute your identity with that of another user. When run as a normal user and executed with no parameters, the su command will prompt for root's password. After the password has been entered, the current session will be given root-level access. (To return to your normal permissions, use exit .) The su command can also be used to switch to the identity of another, non-root user. To perform this action, specify the desired user name as a parameter to su , as shown in Figure 3.3.

Figure 3.3. An example of using the su command.

It is important to realize that the su command does not otherwise modify the current environment. In other words, executing su will not change the current directory, or the currently configured environment variables . When switching to another user's identity, it is often desirable to also assume that user's environment. This requires switching identities and also executing a normal login process for the new user. In order to temporarily switch users and complete a login cycle as that user, the su command must be executed using a "-" command-line parameter, as shown in Figure 3.4.

Figure 3.4. Example of the su - command.