Managing User Accounts by Using CLI
This section describes different procedures for managing user accounts.
How to Modify a User Account
usermod
command is used to change the definition of a user's login and make appropriate login-related file system changes for the user.
Example 1 Setting Per-User PAM Policy by Modifying a User's Account
This example shows how to modify a user to set PAM policy. This particular modification specifies that user jdoe
should only be authenticated with the Kerberos V5 protocol for all PAM services. For more information, see the pam_user_policy(7) man page.
# usermod -K pam_policy=krb5_only jdoe
For additional information, see “Creating a Role” in Securing Users and Processes in Oracle Solaris 11.4.
How to Unlock a User Account
Note:
For more information about unlocking a user account, see Guidelines for Assigning User Names, UIDs, and GIDs and the passwd(1) man page.How to Delete a User
cron
jobs, or if the user had additional accounts in nonglobal zones.
How to Add a Group
solaris.group.assign/groupname
to that administrator, giving the administrator complete control over that group. If another administrator who has the same authorization creates a group, that administrator has the control over that group. An administrator who has control of one group cannot administer the group of the other administrator. For more information, see the groupadd(8) and groupmod(8) man pages.
Example: Setting Up a Group and User With the groupadd
and useradd
Commands
This example shows how to use the groupadd
and useradd
commands to add the group scutters
and the user scutter1
to files on the local system.
# groupadd -g 102 scutters
# useradd -u 1003 -g 102 -d /export/home/scutter1 -s /bin/csh \
-c "Scutter 1" -m -k /etc/skel scutter1
64 blocks
For more information, see the groupadd(8) and useradd(8) man pages.
How to Create the Home Directory for a User Without Creating a ZFS Dataset
# useradd -D -z no
Example: Creating a User Account With a Home Directory That Is a ZFS File System With Delegations
Use the following command to create a user account with a home directory that is a ZFS file system with the mount
, create
, and snapshot
delegations:
# useradd -D -z yes
Example: Creating a User Account With a Home Directory That Is a ZFS File System Without Delegations
# useradd -D -z nodelegation
How to Assign Default User Attributes for LDAP Accounts
default@
. The useradd
, usermod
, and userdel
commands have been modified to support this account name. The following example shows how to create a default account and assign default user attributes to users based on their netgroup
membership.
Sharing ZFS File Systems
You can share a ZFS file system by setting the share.nfs
property or the share.smb
property. Or, you can create a file system share by using the zfs share
command. By default, all file systems are unshared.
You can assign a clearance
label to each user, which restricts users' access to confidential process information. You set the value for clearance
label in the encodings file. When you assign a specific clearance
to a user you should also assign the user a multilevel home directory as shown in the next procedure.
For more information about sharing and unsharing file systems, see Autofs Administration in Managing Network File Systems in Oracle Solaris 11.4.
Manually Mounting a User's Home Directory
With ZFS, file systems that are newly created are automatically mounted at boot time from the SMF local file system service.
When creating user accounts, make sure home directories are set up as they are in the name service, at /home/username
. Then, make sure that the auto_home
map indicates the NFS path to the user's home directory. For task-related information, see Autofs Administration in Managing Network File Systems in Oracle Solaris 11.4.
If you need to manually mount a user's home directory, use the zfs mount
command. For example:
# zfs mount users/home/jdoe
Note:
Make sure that the user's home directory is shared. For more information, see How to Share Home Directories That Are Created as ZFS File Systems.