Setting Up and Managing User Accounts by Using the CLI

The following tasks describe how to set up and manage user accounts by using the CLI.

Setting Up and Managing User Accounts by Using the CLI (Task Map)

Task	Description	For Instructions
Gather user information.	Use a standard form to gather user information to help you keep user information organized.	Gathering User Information
Customize user initialization files.	You can set up user initialization files to provide new users with consistent environments.	How to Customize User Initialization Files
Change account defaults for all roles.	Change the default home directory and skeleton directory for all roles.	How to Change Account Defaults For All Roles
Create a user account.	Using the account defaults that you set up, create a local user by using the `useradd` command.	How to Add a User
Modify a user account.	Modify a user's login information on the system.	How to Modify a User
Delete a user account.	Delete a user account by using the `userdel` command.	How to Delete a User
Create, then assign a role to perform an administrative task.	Using the account defaults that you set up, create a local role to enable the user to perform a specific administrative command or task.	How to Create a Role in Oracle Solaris 11.1 Administration: Security Services How to Assign a Role in Oracle Solaris 11.1 Administration: Security Services
Create a group.	Create a new group by using the `groupadd` command.	How to Add a Group
Add security attributes to a user account.	After you set up a local user account, you can add the required security attributes.	How to Change the Security Attributes of a User in Oracle Solaris 11.1 Administration: Security Services
Share a user's home directory.	You must share the user's home directory so that the directory can be remotely mounted from the user's system.	How to Share Home Directories That Are Created as ZFS File Systems
Manually mount a user's home directory.	Typically, you do not need to manually mount user home directories that are created as a ZFS file system. The home directory is mounted automatically when it is created and also at boot time from the SMF local file system service.	Manually Mounting a User's Home Directory

Gathering User Information

When setting up user accounts you can create a form similar to the following form to gather information about users before setting up their accounts.

Item	Description
User Name:
Role Name:
Profiles or Authorizations:
UID:
Primary Group:
Secondary Groups:
Comment:
Default Shell:
Password Status and Aging:
Home Directory Path Name:
Mounting Method:
Permissions on Home Directory:
Mail Server:
Add to These Mail Aliases:
Desktop System Name:

How to Customize User Initialization Files

Assume the root role or a role that has the User Management rights profile.
```
$ su -
Password: 
#
```
See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.
Create a skeleton directory for each type of user.
```
# mkdir /shared-dir/skel/user-type
```
shared-dir

The name of a directory that is available to other systems on the network.

user-type

The name of a directory to store initialization files for a type of user.
Copy the default user initialization files into the directories that you created for different types of users.
Edit the user initialization files for each user type and customize them based on your site's needs.
For a detailed description on the ways to customize the user initialization files, see Customizing a User's Work Environment.
Set the permissions for the user initialization files.
```
# chmod 744 /shared-dir/skel/user-type/.*
```
Verify that the permissions for the user initialization files are correct.
```
# ls -la /shared-dir/skel/*
```

How to Change Account Defaults For All Roles

In the following procedure, the administrator has customized a roles directory . The administrator changes the default home directory and skeleton directory for all roles.

Assume the root role or a role that has the User Management rights profile.
See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

Create a custom roles directory. For example:

# roleadd -D
group=other,1  project=default,3  basedir=/home  
skel=/etc/skel  shell=/bin/pfsh  inactive=0  
expire=  auths=  profiles=All  limitpriv=  
defaultpriv=  lock_after_retries=

Change the default home directory and skeleton directory for all roles. For example:

# roleadd -D -b /export/home -k /etc/skel/roles
# roleadd -D
group=staff,10  project=default,3  basedir=/export/home  
skel=/etc/skel/roles  shell=/bin/sh  inactive=0  
expire=  auths=  profiles=  roles=  limitpriv=  
defaultpriv=  lock_after_retries=

Future uses of the roleadd command create home directories in /export/home, and populate the roles' environment from the /etc/skel/roles directory.

Guidelines for Setting Up User Accounts

Note the following guidelines for setting up user accounts by using the CLI:

In this release, user accounts are created as Oracle Solaris ZFS file systems. As an administrator, when you create user accounts, you are giving users their own file system and their own ZFS dataset. Every home directory that is created by using the useradd and roleadd commands places the home directory of the user on the /export/home file system as an individual ZFS file system. As a result, users have the ability to back up their home directories, create ZFS snapshots of their home directories, and replace files in their current home directory from the ZFS snapshots that they created.
To set up user accounts, you must assume the root role or a role that has the appropriate rights profile, for example, the User Management rights profile. See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.
When you create a user account with the useradd command, you must specify the -m option in the command syntax. Otherwise, a home directory will not be created for the user.

For example, the following command will create a home directory for the user jdoe:
```
# useradd -m jdoe
```
But, the following syntax will not create a home directory for the user:
```
# useradd jdoe
```
Note - The only exception to this rule is if you want the pam_zfs_key module to create an encrypted home directory for the user. In this case, you would not specify the -m option with the useradd command. See the pam_zfs_key(5) and zfs_encrypt(1M) man pages.
The useradd command creates entries in the auto_home map only if the -d option is specified with hostname:/pathname. Otherwise, the path name that is specified is updated as the home directory for the user in the passwd database, and no auto_home map entry is created. Home directories that are specified in the auto_home automounter map are only mounted if the autofs service is enabled.

For example, if you specify the -d option to create a user as follows, the user is created without an auto_home entry, and the passwd entry specifies /export/home/user1 as the user's home directory:
```
# useradd -d /export/home/user1 user1
```
But, if you use the -d option to create the user as follows, the user with have an auto_home entry, and the passwd database will contain /home/user1, indicating a dependency on the autofs service:
```
# useradd -d localhost:/export/home/user1 user1
```
If the pathname of the home directory includes a remote host specification, for example, foobar:/export/home/jdoe, then the home directory for jdoe must be created on the system foobar. The default pathname is localhost:/export/home/username.
When the file system is a ZFS dataset, which is the case for all of Oracle Solaris 11, the user's home directory is created as a child ZFS dataset, with the ZFS permission to take snapshots delegated to the user. If a pathname is specified that does not correspond to a ZFS dataset, then a regular directory is created. If the -S ldap option is specified, then the auto_home map entry is updated on the LDAP server instead of the local auto_home map.

How to Add a User

In this release, user accounts are created as Oracle Solaris ZFS file systems. Every home directory that is created by using the useradd and roleadd commands places the home directory of the user on the /export/home file system as an individual ZFS file system.

The useradd command creates entries in the auto_home map only if the -d option is specified with hostname:/pathname. Otherwise, the pathname that is specified is updated as the home directory for the user in the passwd database, and no auto_home map entry is created. Home directories that are specified in the auto_home automounter map are only mounted if the autofs service is enabled.

Assume the root role or a role that has the User Management rights profile.
See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.
Create a local user.
By default, the user is created locally. If you include the -S ldap option, the user is created in an existing LDAP repository.
```
# useradd -d dir -m username
```
useradd

Creates an account for the specified user.

-d

Specifies the location of the home directory of the user.
Use the -d localhost:/export/home/username instead of -d /export/home/username to force the entry to be written to auto_home.

-m

Creates a local home directory on the system for the user.

If you specify the -d dir option as follows, the user is created without an auto_home entry, and the passwd entry specifies /export/home/user1 as the user's home directory:
```
# useradd -d /export/home/user1 user1
```
If you specify the -d dir option as follows, the user with have an auto_home entry, and the passwd database will contain /home/user1, indicating a dependency on the autofs service:
```
# useradd -d localhost:/export/home/user1 user1
```
Note - If you want the pam_zfs_key module to create an encrypted home directory for the user. In this case, do not specify the -m option with the useradd command. See Guidelines for Setting Up User Accounts.

For a detailed description of all of the options and arguments that you can specify with the useradd command, see the useradd(1M) man page.

Note - The account is locked until you assign the user a password.
Assign the user a password.
```
# passwd username
New password: Type user password
Re-enter new password: Retype password
```
For more command options, see the useradd(1M) and passwd(1) man pages.

How to Modify a User

The usermod command is used to change the definition of a user's login and make appropriate login-related file system changes for the user.

Assume the root role or a role that has the User Management rights profile.
See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.
Modify the user account, as required.
See the usermod(1M) man page for details about the arguments and options that you can specify with the usermod command.
For example, to add a role to a user, you would type:
```
# usermod -R role username
```

Example 2-1 Setting Per-User PAM Policy by Modifying a User's Account

The following example shows how to modify a user to set PAM policy. This particular modification specifies that user jdoe should only be authenticated with the Kerberos V5 protocol for all PAM services. See pam_user_policy(5) for more information.

# usermod -K pam_policy=krb5_only jdoe

How to Delete a User

Assume the root role
```
$ su -
Password: 
#
```
Note - This method works whether root is a user account or a role.
Archive the user's home directory.
Run one of the following commands:
- If the user has a local home directory, delete the user and the home directory.
```
# userdel -r username
```
  usesrdel
  
  Deletes the account of the specified user.
  
  -r
  
  Removes the account from the system.
  Because user home directories are now ZFS datasets, the preferred method for removing a local home directory for a deleted user is to specify the -r option with the userdel command.
- Otherwise, delete the user only.
```
# userdel username
```
  You must manually delete the user's home directory on the remote server.
For a full list of command options, see the userdel(1M) man page.

Next Steps

Additional cleanup might be required if the user that you deleted had administrative responsibilities, for example creating cron jobs, or if the user had additional accounts in non-global zones.

How to Add a Group

When an administrator creates a group, the system assigns the solaris.group.assign/groupname to that administrator, giving the administrator complete control over that group. If another administrator who has the same authorization creates a group, that administrator has the control over that group. An administrator who has control of one group cannot administer the group of the other administrator. For more information, see the groupadd(1M) and groupmod(1M) man pages.

Assume the root role or an administrator who has the solaris.group.manage authorization.
See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.
List the existing groups.
```
# cat /etc/group
```
Create a new group.
```
$ groupadd -g 18 exadata
```
groupadd

Creates a new group definition on the system by adding the appropriate entry to the /etc/group file.

-g

Assigns the group ID for the new group.

For more information, see the groupadd(1M) man page.

Example 2-2 Setting Up a Group and User With the groupadd and useradd Commands

The following example shows how to use the groupadd and useradd commands to add the group scutters and the user scutter1 to files on the local system.

# groupadd -g 102 scutters
# useradd -u 1003 -g 102 -d /export/home/scutter1 -s /bin/csh \
-c "Scutter 1" -m -k /etc/skel scutter1
64 blocks

For more information, see the groupadd(1M) and useradd(1M) man pages.

How to Share Home Directories That Are Created as ZFS File Systems

In this Oracle Solaris release, you can share a ZFS file system by setting the share.nfs property or the share.smb property. Or, you can create a file system share by using the zfs share command. By default, all file systems are unshared.

By default, the pool/export/home dataset is already mounted on /export/home. The useradd command automatically creates per-user datasets as children of this dataset. As an administrator, you can choose to create a new pool for user home directories. The following procedure describes these steps.

For more information about sharing and unsharing file systems, see Sharing and Unsharing ZFS File Systems in Oracle Solaris 11.1 Administration: ZFS File Systems.

Assume the root role.
See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.
Create a separate pool for the user home directories. For example:
```
# zpool create users mirror c1t1d0 c1t2d0 mirror c2t1d0 c2t2d0
```
Create a container for the home directories. For example:
```
# zfs create users/home
```
Set the share properties for the home directory. For example, to create an NFS share and set the share.nfs property for users/home, you would type:
```
# zfs set share.nfs=on users/home
```
When using this new syntax, each file system contains an "auto share" that is created as soon as the share.nfs property (or the share.smb property) is set to on for that file system. The previous command shares a file system named users/home and all of its children.
Confirm that the descendent file system shares are also published. For example:
```
# zfs get -r share.nfs users/home
```
The -r option displays all of the descendent file systems.

Manually Mounting a User's Home Directory

User accounts that are created as ZFS file systems do not typically need to be manually mounted. With ZFS, file systems are automounted when they are created and then mounted at boot time from the SMF local file system service.

When creating user accounts, make sure home directories are set up as they are in the name service, at /home/username. Then, make sure that the auto_home map indicates the NFS path to the user's home directory. For task-related information, see Task Overview for Autofs Administration in Managing Network File Systems in Oracle Solaris 11.1.

If you need to manually mount a user's home directory, use the zfs mount command. For example:

# zfs mount users/home/alice

Note - Make sure that the user's home directory is shared. For more information, see How to Share Home Directories That Are Created as ZFS File Systems.

Skip Navigation Links
Exit Print View
	Managing User Accounts and User Environments in Oracle Solaris 11.1 Oracle Solaris 11.1 Information Library