Make a user

Become root first. Adding a user is of course something only root can do.

~ $ suPassword:~ $ adduser -D taro~ $ grep taro /etc/passwdtaro:x:1000:1000:Linux User,,,:  /home/taro:/bin/sh

One line made. The number starts at 1000. Last lesson said "100 and up is human", and recent Linux hands out from 1000.

-D says "do not set a password". Leave it out and you are asked for one there and then. You can add one later with passwd, so -D is the easy way to start.

A group was made as well. Type grep taro /etc/group and you should find taro:x:1000:. A group of the same name is made automatically.

adduser prepares not only the register but that person's room.

~ $ ls -ld /home/tarodrwxr-sr-x 2 taro taro 40  /home/taro

The owner is taro. Your own room is yours, just as /home/learner was learner's.

Left alone, only taro can use this room freely. Others can read it and not write it.

Add -H and no room is made, which is what you do for a program user nobody ever enters.

-h changes where it goes. Remember www-data's home being /var/www? That sort of thing is made with -h /var/www.

You made it with -D, so there is no password yet. passwd adds one.

~ $ passwd taroChanging password for taroNew password:Retype password:passwd: password for taro  changed by root

Asked twice to catch a mistyping. Nothing shows on the screen, so type carefully.

A short password gets you Bad password: too weak. But when root sets it, it warns and lets it through, so as not to get in the administrator's way.

Where does the password you set go? /etc/shadow, the "it is somewhere else" that the x in the second field pointed at.

The next question looks at what is written there.

Peek into /etc/shadow as root and you find this.

taro:$5$/m5JcgqH/yYoF43Z$.exc5...

The password you typed is stored nowhere. What is there is a hash, the result of crushing it by calculation.

A hash has two properties.

• the same characters always give the same result
• the original characters cannot be recovered from the result

So at login it puts what you typed through the same calculation and only checks whether it matches what is stored.

The $5$ at the front is the kind of calculation (SHA-256), and the /m5Jcg... after it is salt, different for each person, so that the same password gives different results for different people.

That is what "even the administrator cannot read your password" means. Root can overwrite it and cannot read it.

Become the person you made. From root you can, without a password.

~ $ su taro~ $ whoamitaro

Why no password? Because root can do anything, so asking would be pointless. Root could simply change it to whatever it liked with passwd taro.

The other way round, su taro from you (learner) does ask. To become someone at the same level, you need their password.

While you are taro, you cannot write in your own home. /home/learner belongs to learner and the slot for everyone else has no w.

The slots of chapter 6 apply directly. Trying it makes it clear.

Remove a user you no longer need with deluser. But it goes half way.

~ $ deluser taro~ $ grep taro /etc/passwd~ $ ls -ld /home/tarodrwxr-sr-x 2 1000 1000 40  /home/taro

Gone from the register, and the room is still there. And the owner's name is now a number, 1000.

This joins up with what chapter 6 said: "what Linux looks at is the number, and the name is decoration looked up in /etc/passwd".

The line went from the register, so the number can no longer be turned into a name, and out comes the bare number.

This is a common sight on real servers. When the owner in ls -l is a number, the person with that number is no longer in the register.

To remove the room as well, use deluser --remove-home or rm -rf afterwards. Sometimes you keep it on purpose, because the files inside may still be needed.

You become root a lot today. Learn the routine.

su           -> password fulfledgeadduser -D nameexit         -> back to yourself

There are only four flags to know.

Not forgetting exit matters most. Staying as root, or as the person you made, causes trouble in the next question.

When in doubt, type whoami. It tells you at once who you are.