Skip Navigation Links | |
Exit Print View | |
Managing User Accounts and User Environments in Oracle Solaris 11.1 Oracle Solaris 11.1 Information Library |
1. Managing User Accounts and User Environments (Overview)
What's New or Changed in Managing User Accounts and User Environments?
Security Changes That Impact User Account Management
Introducing the User Manager GUI
Administrative Editor (pfedit)
Failed Login Count Notification
What Are User Accounts and Groups?
Using Large User IDs and Group IDs
Guidelines for Assigning User Names, User IDs, and Group IDs
Where User Account and Group Information Is Stored
Commands for Obtaining User Account Information
Commands That Are Used for Managing Users, Roles, and Groups
Customizing a User's Work Environment
Using Site Initialization Files
Avoiding Local System References
Bash and ksh93 Shell Environment Variables
2. Managing User Accounts by Using the Command-Line Interface (Tasks)
3. Managing User Accounts by Using the User Manager GUI (Tasks)
The following information is described in this section:
Part of setting up a user's home directory is providing user initialization files for the user's login shell. A user initialization file is a shell script that sets up a work environment for a user after the user logs in to a system. Basically, you can perform any task in a user initialization file that you can do in a shell script. However, a user initialization file's primary job is to define the characteristics of a user's work environment, such as a user's search path, environment variables, and windowing environment. Each login shell has its own user initialization file, or files, which are listed in the following table. Note that the default user initialization file for both the bash and ksh93 shells is /etc/skel/local.profile.
Table 1-7 Bash and ksh93 User Initialization Files
|
You can use these files as a starting point and then modify them to create a standard set of files that provide the work environment common to all users. You can also modify these files to provide the working environment for different types of users.
For step-by-step instructions on how to create sets of user initialization files for different types of users, see How to Customize User Initialization Files.
The user initialization files can be customized by both the administrator and the user. This important task can be accomplished with centrally located and globally distributed user initialization files that are called, site initialization files. Site initialization files enable you to continually introduce new functionality to the user's work environment, while enabling the user to customize the user's initialization file.
When you reference a site initialization file in a user initialization file, all updates to the site initialization file are automatically reflected when the user logs in to the system or when a user starts a new shell. Site initialization files are designed for you to distribute site-wide changes to users' work environments that you did not anticipate when you added the users.
You can customize a site initialization file the same way that you customize a user initialization file. These files typically reside on a server, or set of servers, and appear as the first statement in a user initialization file. Also, each site initialization file must be the same type of shell script as the user initialization file that references it.
To reference a site initialization file in a bash or ksh93 user initialization file, place a line at the beginning of the user initialization file similar to the following line:
. /net/machine-name/export/site-files/site-init-file
Do not add specific references to the local system in the user initialization file. The instructions in a user initialization file should be valid, regardless of which system the user logs into.
For example:
To make a user's home directory available anywhere on the network, always refer to the home directory with the variable $HOME. For example, use $HOME/bin instead of /export/home/username/bin. The $HOME variable works when the user logs in to another system, and the home directories are auto-mounted.
To access files on a local disk, use global path names, such as /net/system-name/directory-name. Any directory referenced by /net/system-name can be mounted automatically on any system on which the user logs in, assuming the system is running AutoFS.
This Oracle Solaris release supports the following shell features and behavior:
The user account that is created when you install the Oracle Solaris release is assigned the GNU Bourne-Again Shell (bash) by default.
The standard system shell (bin/sh) is now the Korn Shell 93 (ksh93).
The default interactive shell is the Bourne-again (bash) shell (/usr/bin/bash).
Both the bash and ksh93 shells feature command-line editing, which means you can edit commands before executing them.
There are a few ways in which you can display default shell and path information:
Use the echo $SHELL and which commands:
$ grep root /etc/passwd root:x:0:0:Super-User:/root:/usr/bin/bash $ echo $SHELL /usr/bin/bash $ which ksh93 /usr/bin/ksh93
Use the pargs command:
~$ pargs -l $$ /usr/bin/i86/ksh93
The ksh93 shell also has a built-in variable called .sh.version, which can be displayed as follows:
~$ echo ${.sh.version} Version jM 93u 2011-02-08
To change to a different shell, type the path of the shell that you want to use.
To exit a shell, type exit.
The following table describes the shell options that are supported in Oracle Solaris.
Table 1-8 Basic Shell Features in the Oracle Solaris Release
|
Note - The Z Shell (zsh) and the enhanced C Shell (tsch) are not installed on your system by default. To use either of these shells, you must first install the required software packages.
Both the bash and ksh93 shells record a history of all of the commands that you run. This history is kept on a per-user basis, which means the history is persistent between login sessions, as well as representative of all your login sessions.
For example, if you are in a bash shell, you can display the complete history of the commands that you have run, as follows:
$ history 1 ls 2 ls -a 3 pwd 4 whoami . . .
To display a number of previous commands, include an integer in the command:
$ history 2 12 date 13 history
For more information, see the history(1) man page.
The bash and ksh93 shells store special variable information that is known to the shell as anenvironment variable. To view a complete list of the current environment variables for the bash shell, use the declare command:
$ declare BASH=/usr/bin/bash BASH_ARGC=() BASH_ARGV=() BASH_LINEND=() BASH_SOuRCE=() BASH_VERSINFO=([0]=''3'' [1]=''2'' [2]=''25'' [3]=''1'' [4]=''release'' [5]'' . . .
For the ksh93 shell, use the set command, which is the bash shell's declare command equivalent:
$ set COLUMNS=80 ENV='$HOME/.kshrc' FCEDIT=/bin/ed HISTCMD=3 HZ='' IFS=$' \t\n' KSH_VERSION=.sh.version LANG=C LINENO=1 . . .
To print environment variables for either shell, use the echo or printf command. For example:
$ echo $SHELL /usr/bin/bash $ printf ''$PATH\n'' /usr/bin:/usr/sbin
Note - Environment variables do not persist between sessions. To set up environment variables that remain consistent between logins, you must make the changes in the .bashrc file.
A shell can have two types of variables:
Specifies variables that are exported to all processes that are spawned by the shell. The export command is used to export a variable. For example:
export VARIABLE=value
These settings can be displayed by using the env command. A subset of environment variables, such as PATH, affects the behavior of the shell itself.
Specifies variables that affect only the current shell.
In a user initialization file, you can customize a user's shell environment by changing the values of the predefined variables or by specifying additional variables.
The following table provides more details about the shell and environment variables that are available in the Oracle Solaris release.
Table 1-9 Shell and Environment Variable Descriptions
|
To customize your bash shell, add the information to the .bashrc file that is located in your home directory. The initial user that is created when you install Oracle Solaris has a .bashrc file that sets the PATH, MANPATH, and command prompt. For more information, see the bash(1) man page.
The MANPATH environment variable specifies where the man command looks for reference manual (man) pages. The MANPATH is set automatically based on a user's PATH value, but it generally includes /usr/share/man and usr/gnu/share/man.
Note that a user's MANPATH environment variable can be modified independent of the PATH environment variable. A one to one equivalent of the associated man page locations, with directories in the user's $PATH, is not required.
When the user executes a command by using the full path, the shell uses that path to find the command. However, when users specify only a command name, the shell searches the directories for the command in the order specified by the PATH variable. If the command is found in one of the directories, the shell executes the command.
A default path is set by the system. However, most users modify it to add other command directories. Many user problems related to setting up the environment and accessing the correct version of a command or a tool can be traced to incorrectly defined paths.
Here are some guidelines for setting up efficient PATH variables:
If you must include the current directory (.) in your path, it should be placed last. Including the current directory in your path is a security risk because some malicious person could hide a compromised script or executable in the current directory. Consider using absolute path names instead.
Keep the search path as short as possible. The shell searches each directory in the path. If a command is not found, long searches can slow down system performance.
The search path is read from left to right, so you should put directories for commonly used commands at the beginning of the path.
Make sure that directories are not duplicated in the path.
Avoid searching large directories, if possible. Put large directories at the end of the path.
Put local directories before NFS mounted directories to lessen the chance of “hanging” when the NFS server does not respond. This strategy also reduces unnecessary network traffic.
The LANG and LC environment variables specify the locale-specific conversions and conventions for the shell. These conversions and conventions include time zones, collation orders, and formats of dates, time, currency, and numbers. In addition, you can use the stty command in a user initialization file to indicate whether the terminal session will support multibyte characters.
The LANG variable sets all possible conversions and conventions for the given locale. You can set various aspects of localization separately through these LC variables: LC_COLLATE, LC_CTYPE, LC_MESSAGES, LC_NUMERIC, LC_MONETARY, and LC_TIME.
Note - By default, Oracle Solaris 11 installs UTF-8 based locales only.
The following table describes the environment variable values for the core Oracle Solaris 11 locales.
Table 1-10 Values for LANG and LC Variables
|
Example 1-1 Setting the Locale Using the LANG Variables
In a Bourne or Korn shell user initialization file, you would add the following:
LANG=de_DE.ISO8859-1; export LANG
LANG-de_DE.UTF-8; export LANG
When you create a file or directory, the default file permissions assigned to the file or directory are controlled by the user mask. The user mask is set by the umask command in a user initialization file. You can display the current value of the user mask by typing umask and pressing Return.
The user mask contains the following octal values:
The first digit sets permissions for the user
The second digit sets permissions for group
The third digit sets permissions for other, also referred to as world
Note that if the first digit is zero, it is not displayed. For example, if the user mask is set to 022, 22 is displayed.
To determine the umask value that you want to set, subtract the value of the permissions you want from 666 (for a file) or 777 (for a directory). The remainder is the value to use with the umask command. For example, suppose you want to change the default mode for files to 644 (rw-r--r--). The difference between 666 and 644 is 022, which is the value you would use as an argument to the umask command.
You can also determine the umask value you want to set by using the following table. This table shows the file and directory permissions that are created for each of the octal values of umask.
Table 1-11 Permissions for umask Values
|
The following line in a user initialization file sets the default file permissions to rw-rw-rw-.
umask 000
The following is an example of the .profile user initialization file. You can use this file to customize your own user initialization files. This example uses system names and paths that you will need to modify for your particular site.
Example 1-2 The .profile File
(Line 1) PATH=$PATH:$HOME/bin:/usr/local/bin:/usr/gnu/bin:. (Line 2) MAIL=/var/mail/$LOGNAME (Line 3) NNTPSERVER=server1 (Line 4) MANPATH=/usr/share/man:/usr/local/man (Line 5) PRINTER=printer1 (Line 6) umask 022 (Line 7) export PATH MAIL NNTPSERVER MANPATH PRINTER
Defines the user's shell search path.
Defines the path to the user's mail file.
Defines the user's time/clock server.
Defines the user's search path for man pages.
Defines the user's default printer.
Sets the user's default file creation permissions.
Sets the listed environment variables.