This chapter describes the procedures for setting up and maintaining user accounts and groups.
This is a list of the step-by-step instructions in this chapter.
For overview information about Managing User Accounts and Groups, see Chapter 1, Managing User Accounts and Groups (Overview).
Most administrative tasks such as adding users require that you log in as root (UID=0) first. The root account is also known as the superuser account because it's used to make system changes and can override user file protection in emergency situations.
The superuser account should only be used to perform administrative tasks to prevent indiscriminate changes to the system.
You can either log into the system as superuser or use the su command to change to the superuser account.
Become superuser by one of the following methods. Both methods require that you know the root password.
Change to the superuser account by using the su command.
% su Password: root_password # |
The pound sign (#) is the Bourne shell prompt for the superuser account.
Log in as superuser on the system console.
hostname console: root Password: root_password # |
This method is not enabled by default. You must modify the /etc/default/login file to log in as superuser on the system console. See "How to Restrict Superuser (root) Login to the Console" for information on modifying this file.
Task |
Description |
For Instructions, Go To |
|||||
---|---|---|---|---|---|---|---|
Customize User Initialization Files |
Optional. Set up user initialization files (.cshrc, .profile, .login), so you can provide new users with consistent environments. | ||||||
Add a Group |
Optional. To help administer users, add groups by using the Groups main window. | ||||||
| |||||||
Add a User Account |
Add a user account by using Admintool's Users main window. | ||||||
| |||||||
Share the User's Home Directory |
Share the user's home directory, so the directory can be remotely mounted from the user's system. | ||||||
| |||||||
Mount the User's Home Directory |
Needed If Not Using AutoFS If you did not select AutoFS when creating the user account (the AutoHome Setup field) and the user's home directory is located on another system, manually mount the user's home directory on the user's system. | ||||||
|
You may find it useful to create a form like the one below to gather information about users before adding their accounts.
Item |
Description |
User Name: |
|
UID: |
|
Primary Group: |
|
Secondary Groups: | |
Comment: | |
Default Shell: | |
Password Status and Aging: | |
Home Directory Server Name: | |
Home Directory Path Name: | |
Mounting Method: | |
Permissions on Home Directory: | |
Mail Server: | |
Department Name: | |
Department Administrator: | |
Manager: | |
Employee Name: | |
Employee Title: | |
Employee Status: | |
Employee Number: | |
Start Date: | |
Add to These Mail Aliases: | |
Desktop System Name: |
Become superuser on the system where the users' home directories are created and shared.
Create a skeleton directory for each type of user.
# mkdir /shared-directory/skel/user-type |
shared-directory |
The name of a directory that is available to other systems on the network. |
user-type |
The name of a directory to store initialization files for a type of user. |
Copy the default user initialization files into the directories you created for different types of users.
# cp /etc/skel/local.cshrc /shared-directory/skel/user-type/.cshrc # cp /etc/skel/local.login /shared-directory/skel/user-type/.login # cp /etc/skel/local.profile /shared-directory/skel/user-type/.profile |
You can use the ls -a command to list . (dot) files.
Edit the user initialization files for each user type and customize them based on your site's needs.
See "Customizing a User's Work Environment" for a detailed description on the ways to customize the user initialization files.
Set the permissions for the user initialization files.
# chmod 744 /shared-directory/skel/user-type/.* |
The following example customizes the C-shell user initialization file in the /export/skel/enduser directory designated for a particular type of user.
# mkdir /export/skel/enduser # cp /etc/skel/local.cshrc /export/skel/enduser/.cshrc (Edit .cshrc file-see "Example--.cshrc File ") # chmod 744 /export/skel/enduser/.* |
Verify that the following prerequisites are met. To use Admintool, you must:
Have a bit-mapped display monitor. The Admintool software can be used only on a system with a console that is a bit-mapped screen such as a standard display monitor that comes with a Sun workstation.
Be running an X Window System, such as the OpenWindows environment.
Be a member of the sysadmin group (group 14).
If you want to perform administration tasks on a system with an ASCII terminal as the console, use Solaris commands instead.
Start Admintool.
$ admintool & |
The Users main window is displayed.
This is the Users main window, which enables you to manage user account information.
Start Admintool, if it's not already running.
See "How to Start Admintool" for more information on starting Admintool.
Choose Groups from the Browse menu.
The Groups window is displayed.
Select Add from the Edit menu.
The Add window is displayed. If you need information to complete a field, click on the Help button to see field definitions for this window.
Type the name of the new group in the Group Name text box.
Type the group ID for the new group in the Group ID text box.
The group ID should be unique.
(Optional) Type user names in the Members List text box.
The list of users will be added to the group. User names must be separated by commas.
Click on OK.
The list of groups displayed in the Groups window is updated to include the new group.
The following example adds a group named users that has a group ID of 101.
(Optional) Fill out the user information data sheet on "User Information Data Sheet".
Start Admintool, if it's not already running.
See "How to Start Admintool" for more information.
Choose Add from the Edit menu.
The Add User window is displayed.
Fill in the Add User window.
If you need information to complete a field, click on the Help button to see field definitions for this window.
Click on OK.
The list of user accounts displayed in the Users main window is updated to include the new user account.
If you created a user's home directory, you must share the directory so the user's system can remotely mount it. See "How to Share a User's Home Directory" for detailed instructions.
If disk space is limited, you can set up a disk quota for the user in the file system containing the user's home directory. See Chapter 58, Managing Quotas (Tasks) for information on setting disk quotas.
The following example adds the user kryten to the system.
Become superuser on the system that contains the home directory.
Verify that the mountd daemon is running.
# ps -ef | grep mountd root 176 1 0 May 02 ? 0:19 /usr/lib/nfs/mountd |
The /usr/lib/nfs/mountd line is displayed if the mountd daemon is running.
If the mountd daemon is not running, start it.
# /etc/init.d/nfs.server start |
List the file systems that are shared on the system.
# share |
Determine your next step based on whether the file system containing the user's home directory is already shared.
If the File System Containing the User's Home Directory Is ... |
Then ... |
---|---|
Already shared |
Go to the verification step below. |
Not shared |
Go to Step 6 |
Edit the /etc/dfs/dfstab file and add the following line.
share -F nfs /file-system |
file-system |
Is the file system containing the user's home directory that you need to share. By convention, the file system is /export/home. |
Share the file systems listed in the /etc/dfs/dfstab file.
# shareall -F nfs |
This command executes all the share commands in the /etc/dfs/dfstab file, so you do not have to wait to reboot the system.
Verify that a user's home directory is shared, as follows:
If you selected the AutoHome Setup field when creating the user account (enabled the automounting of the home directory), log in to a system as the new user to make sure that the user's home directory is available. Otherwise, you have to manually mount the user's home directory and then log in to see if it's available.
If you did not select the AutoHome Setup field when creating the user account (did not enable the automounting of the home directory) and the user's home directory is not located on the user's system, you have to mount the user's home directory from the system where it is located. See "How to Mount a User's Home Directory" for detailed instructions.
# ps -ef | grep mountd # /etc/init.d/nfs.server start # share # vi /etc/dfs/dfstab (The line share -F nfs /export/home is added.) # shareall -F nfs |
Make sure that the user's home directory is shared. See "How to Share a User's Home Directory" for more information.
Log in as superuser on the user's system.
Edit the /etc/vfstab file and create an entry for the user's home directory.
system-name:/export/home/user-name - /export/home/user-name nfs - yes rw, intr |
system-name | Is the name of the system where the home directory is located. |
/export/home/user-name |
Is the name of the user's home directory that will be shared. By convention, /export/home contains user's home directories; however, this could be a different file system. |
- |
Are required placeholders in the entry. |
/export/home/user-name |
Is the name of the directory where the user's home directory will be mounted. |
See Chapter 28, Mounting and Unmounting File Systems (Tasks), for more information about adding an entry to the /etc/vfstab file.
Create the mount point for the user's home directory.
# mkdir -p /export/home/user-name |
Mount the user's home directory.
# mountall |
All entries in the current vfstab file (whose mount at boot fields are set to yes) are mounted.
Use the mount command to verify that the home directory is mounted.
# vi /etc/vfstab (The line venus:/export/home/ripley - /export/home/ripley nfs - yes rw,intr is added.) # mkdir -p /export/home/ripley # mountall # mount / on /dev/dsk/c0t3d0s0 read/write/setuid/largefiles on Fri May 2 07:39:11 1997 /usr on /dev/dsk/c0t3d0s6 read/write/setuid/largefiles on Fri May 2 07:39:11 1997 /proc on /proc read/write/setuid on Fri May 2 07:39:11 1997 /dev/fd on fd read/write/setuid on Fri May 2 07:39:11 1997 /opt on /dev/dsk/c0t3d0s5 setuid/read/write/largefiles on Fri May 2 07:39:13 1997 /tmp on swap read/write on Fri May 2 07:39:13 1997 /export/home/ripley on venus:/export/home/ripley /read/write/remote on Fri May 2 07:39:14 1997 # |
Task |
Description |
For Instructions, Go To |
|||||
---|---|---|---|---|---|---|---|
Modify a Group |
Modify a group's name or the users in a group by choosing Modify from the Edit menu in the Groups window. | ||||||
Delete a Group |
Delete a group by choosing Delete from the Edit menu in the Groups window. | ||||||
| |||||||
Modify a User Account |
Disable a User Account If you want to temporarily disable a user account, lock the user account from the Password menu in the Modify window. | ||||||
Change a User's Password If you want to change a user's password, use the Password menu in the Modify window. | |||||||
|
|
Change Password Aging If you want to force users to change their passwords periodically, change the Password Aging fields in the Modify window (Account Security category). |
| ||||
| |||||||
Delete a User Account |
Delete a user account by choosing Delete from in the Edit menu in the Users window. | ||||||
Start Admintool, if its not already running. Select Groups from the Browse menu.
See "How to Start Admintool" for more information.
Select the group entry you want to modify from the Groups window.
Choose Modify from the Edit menu.
The Modify Group window is displayed containing the selected group entry.
Modify either the group's name or the users in the group.
User names must be separated by commas. If you need information to complete a field, click on the Help button to see field definitions for this window.
Click on OK.
The group information displayed in the Groups window is updated.
The following example adds the users r2d2, holly, and kryten to the staff group.
Start Admintool, if it's not already running. Select Groups from the Browse menu.
See "How to Start Admintool" for more information.
Select the group entry you want to delete from Groups window.
Choose Delete from the Edit menu.
A window is displayed asking you to confirm the deletion.
Click on OK.
The group entry is deleted from the Groups window.
Start Admintool, if it's not already running. Select Users from the Browse menu.
See "How to Start Admintool" for more information.
Select the user account entry to modify from the Users window.
Choose Modify User from the Edit menu.
The Modify window is displayed containing the selected user account entry.
Modify the user account.
If you need information to complete a field, click on the Help button to see field definitions for this window. You can change any of the Account Security fields, which includes changing a password or changing password aging. See the following tasks for detailed step-by-step instructions:
Click on OK.
To verify that the modifications were made, double-click on the modified user account entry in the Users window, then click on Cancel to close the window without making any modifications.
The following example adds the secondary group membership lp to the rimmer user account.
You can enable the user account by changing the password status to Normal Password or Cleared Until First Login.
Start Admintool, if it's not already running. Select Users from the Browse menu, if necessary.
See "How to Start Admintool" for more information.
Select the user account entry to be disabled.
Choose Modify from the Edit menu.
The Modify Users window is displayed containing the selected user account entry.
Choose Account Is Locked from the Password menu.
This selects the locked password status, which disables the user account.
Click on OK.
Verify that you have disabled the user account by attempting to log in with the disabled user account.
The following example disables the rimmer user account.
Start Admintool, if it's not already running. Select Users from the Browse menu.
See "How to Start Admintool" for more information.
Select the user account entry that needs the password changed.
Choose Modify from the Edit menu.
The Modify User window is displayed containing the selected user account entry.
Choose Normal Password from the Password menu.
Click on OK.
This is the pop-up window used to change user's passwords that is available from the Add User or Modify User windows.
Start Admintool, if its not already running. Select Users from the Browse menu.
See "How to Start Admintool" for more information.
Select the user account entry that needs its password aging changed.
Choose Modify from the Edit menu.
The Modify window is displayed containing the selected user account entry.
Change the following fields that affect password aging:
Min Change
Max Change
Max Inactive
Expiration Date
Warning
If you need information about the password aging fields that are part of the Account Security category, click on the Help button.
Click on OK.
In the following example, the user must keep a new password for at least one day (Min Change) , and must change the password every 60 days (Max Change). The user must change the password if the account is inactive for more than 10 days (Max Inactive).
Start Admintool, if it's not already running. Select Users from the Browse menu, if necessary.
See "How to Start Admintool" for more information.
Select the user account entry to remove from the Users window.
Choose Delete from the Edit menu.
The Delete window is displayed to confirm the removal of the user account.
(Optional) Click on the check box to delete the user's home directory and its contents.
Click on OK when you are ready to delete the user account. The user account entry is deleted from the Users main window.
The account for user kryten and the /export/home/kryten directory is removed.
Solaris User Registration is a tool for getting information about new Solaris releases, upgrade offers, and promotions. This graphical user interface (GUI) automatically starts when you first log into your desktop. The GUI lets you register now, later, or never. The registration process also provides Sun with the user's Solaris version, survey type, platform, hardware, and locale.
Solaris User Registration is not invoked if the system administrator or user is logged in as superuser.
If you choose to register, a copy of the completed form is stored in $HOME/.solregis/uprops. If you choose to never register and change your mind later, you can start User Registeration by:
Typing solregis at any command line prompt, or
Clicking on the Registration icon in the Application Manager's desktop tools folder (Common Desktop Environmenht desktop only)
See solregis(1) for more information.
The following table describes problems that may occur when you try to register, and actions required to resolve these conflicts.
Table 2-3 Registration Error Conditions and Required Action
Error Condition |
Required Action |
---|---|
Registration form failed to initialize: Web page window displays and requests user see system administrator to resolve problem that prevents registration setup. |
Check for missing registration files. |
Form could not be emailed: Dialog box displays and requests user see system administrator to resolve problem. |
Check to see if email is configured correctly. Also check if CDE is on user's system since it must be present to email completed registration form. Alternatively, users can print the form and fax or mail it. |
Form could not be printed: Dialog box displays and requests user to see system administrator to resolve problem. |
Check to see if printer is configured correctly. Alternatively, user can email form. |
Form could not be saved: Dialog box displays and verifies that registration succeeded; however, the registration information cannot be recalled when updating registration in the future. |
Check user's home directory. Required action depends on the system's configuration. |
Table 2-4 shows how to disable User Registration before and after installing Solaris software. Before disabling Solaris User Registration, Sun recommends that system administrators register for their organization.
Table 2-4 Ways to Disable User Registration
To Disable User Registration... |
You Can... |
For More Information See... |
---|---|---|
Before Solaris software is installed |
|
Solaris Advanced Installation Guide solregis (1) man page |
After Solaris software is installed |
|
Chapter 17, Software Administration (Tasks) Solaris Advanced Installation Guide solregis (1) man page |