|
Action
|
Command
|
|
List users configured on local host
|
awk -F: '/\/home/ {printf "%s:%s\n",$3,$1}' /etc/passwd | sort -n |
|
List groups configured on local host
|
awk -F: -v id="999" '$3 > id' /etc/group |
/home directory/etc/login.defs
|
Create user
|
useradd -c "Firstname Lastname" -d /home/firstname.lastname.suffix -u <uid> -g <gid> -m -s /bin/bash firstname.lastname.suffix |
|
Create user (shorter)
|
useradd -c "Firstname Lastname" -u <uid> -g <gid> firstname.lastname.suffix |
|
Set password
|
passwd firstname.lastname.suffix |
|
Set account aging policy
|
chage -M 90 -W 7 -I 30 -d 0 firstname.lastname.suffix |
|
where -M maximum number of days between password changes, -W number of days warning before password expires, -I inactive days after password expires that account is locked, -d days since password changed (setting to 0 zero forces password change on next logon)
|
|
|
Expire password
(force password change) |
chage -d 0 firstname.lastname.suffix |
|
Expire password and set account expiry(for contractors)
|
chage -d 0 -E YYYY-MM-DD firstname.lastname.suffix |
|
List account aging information
|
chage -l firstname.lastname.suffix |
|
Disable account
(most effective method) |
chage -E0 firstname.lastname.suffix |
|
Re-enable account
|
chage -E1 firstname.lastname.suffix |
|
Lock account
|
usermod -L username |
|
Check lock status
|
grep username /etc/shadowsingle exclamation mark before encrypted password means account locked |
|
Lock password
|
passwd -l username |
|
Unlock password
|
passwd -u username |
|
Check password status
|
grep username /etc/shadowtwo exclamation marks before encrypted password means password locked |
|
Check whether password ever set
|
grep username /etc/shadowtwo exclamation marks with no encrypted password means password has never been set |
|
Extend account expiry
(for contractors) |
chage -E YYYY-MM-DD firstname.lastname.suffix |
chage command. Locking of accounts by using usermod or passwords by using passwd commands are not as effective. For example, an account which uses SSH does not use passwords.
|
Show who is logged on
|
who |
|
Show who is logged on and what they are doing
|
w |
|
Show list of last logged in users who are "still logged in"
|
last -F | grep 'still logged in' |
|
Print name of users currently logged in to local host
|
users |
|
Alias
|
Command
|
lusers |
awk -F: '{ if ($3 > 999 && $3 < 60001) print $1 }' /etc/passwd | grep -v suffix | sort |
ladmins |
awk -F: '{ if ($3 > 999 && $3 < 60001) print $1 }' /etc/passwd | grep suffix | sort |
/etc/profile.d/aliases.sh. Again, refer to /etc/login.defs for UID_MIN and UID_MAX and GID_MIN and GID_MAX values
# get-useraccounts [Account Type: ALL|normal|admins|service] [Output Format:name|description|almostall|csv|table] [Additional Info: GROUP|nogroup|complete] |
|
Where group information is collected from corresponding user entry in
/etc/group and where addition information is collated from chage command |
|
Argument order is important (does not use
getopt or getopts). Account Type - ALL (is the default option). Output Format: no specific option required. Additional Info - GROUP info (is the default option). |
# get-useraccounts |
# get-useraccounts service csv group |
# get-useraccounts admins tablefull complete |
|
Based on function listusers / get-useraccounts (expanded version of the above custom functions
lusers and ladmins). The get-useraccounts alias is in PowerShell (verb-noun) format so somewhat familiar for Windows Administrators. |
/etc/profile.d/aliases.sh).
No comments yet.
Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.