Oracle Solaris 11.3 用户账户与环境管理指南

需积分: 2 89 浏览量更新于2024-06-24 收藏 1.18MB PDF 举报

"Oracle Solaris 11.3 管理用户账户和用户环境" 在Oracle Solaris 11.3操作系统中，管理和维护用户账户及用户环境是系统管理员的核心任务之一。Oracle Solaris 11.3 提供了强大的工具和功能，帮助管理员高效地管理用户权限、安全策略以及个性化的工作环境。以下是对这部分内容的详细说明： 1. **用户账户管理**：在Oracle Solaris 11.3中，用户账户的创建、修改和删除可以通过`useradd`、`usermod`和`userdel`命令来完成。这些命令允许管理员设置用户的登录名、密码、主目录、默认Shell等属性。此外，`pwconv`和`pwunconv`用于管理和同步/etc/passwd和/etc/shadow文件。 2. **组管理**：Oracle Solaris 11.3支持基于组的权限控制，`groupadd`、`groupmod`和`groupdel`命令用于创建、修改和删除组。`gpasswd`则用于添加或删除用户到组，或者改变组的GID（组标识号）。 3. **权限与访问控制**：Solaris提供了多种权限模型，包括基本的文件权限（读、写、执行），以及更复杂的ACL（访问控制列表）和POSIX权限。`chmod`、`chown`和`chgrp`命令用于调整文件和目录的权限和所有权。 4. **用户环境**：每个用户都有一个定制的工作环境，包括环境变量、Shell别名和初始化脚本。`.bash_profile`、`.bashrc`等文件用于设置用户的Shell启动参数。用户还可以通过`.profile`文件来定义全局的Shell环境。 5. **安全策略**：Oracle Solaris 11.3强调安全性，它提供了PAM（可插拔身份验证模块）机制，允许管理员灵活配置认证策略。同时，通过`authselect`可以选择和配置不同的认证服务。另外，`nis`和`ldap`等服务可用于集中管理用户账户和组信息。 6. **账户锁定与过期**：为了增强安全性，管理员可以使用`passwd`命令的`-l`选项锁定用户账户，防止未经授权的登录。此外，通过设置`expire`属性，可以设定账户的有效期限。 7. **审计与监控**：Oracle Solaris 11.3提供了强大的审计功能，允许管理员追踪和记录系统事件，包括用户登录、文件访问和系统变更等，这有助于提高系统的安全性和合规性。 8. **Zones和品牌**：Solaris Zones是一种轻量级虚拟化技术，允许在一个物理系统上创建多个独立的用户环境。通过Zone，管理员可以为用户提供隔离的工作空间，同时保持系统资源的有效利用。 9. **Solaris Management Console (SMC)**：图形化的SMC工具提供了用户账户和环境的直观管理界面，简化了日常维护任务，使得管理员能更方便地管理用户账户和系统设置。 10. **软件包和更新管理**：Oracle Solaris 11.3采用 IPS (Image Packaging System) 包管理系统，用于安装、更新和管理软件包，确保用户环境始终拥有最新的安全补丁和功能。 Oracle Solaris 11.3 提供了一套全面的工具和机制，使得系统管理员能够有效管理用户账户和环境，确保系统的安全性和稳定性，同时也为用户提供了一个定制化的工作体验。

What Are User Accounts and Groups?

This type of shutdown does not block the superuser from logging in. Starting in this release, the

following additional users are not blocked when the nologin file is present on the system:

■

Users assigned with the root role

■

Users assigned with the solaris.system.maintenance authorization

For further information, see the nologin(4) and shutdown(1M) man pages.

Security Changes That Affect User Account

Management

System administrators who manage user accounts should note that the following security

features that have changed in this release:

■

Specific extended rights can be applied to file objects, port numbers, and user IDs. These

extended rights replace the set of rights that are otherwise available, except for the basic set.

For a discussion about expanding a user's rights, see “Expanding a User or Role’s

Privileges” in Securing Users and Processes in Oracle Solaris 11.3.

For instructions, see Chapter 4, “Assigning Rights to Applications, Scripts, and Resources”

in Securing Users and Processes in Oracle Solaris 11.3. Also, see the ppriv(1) or

privileges(5) man pages.

■

You can set the auth_profiles right so that users must provide a password before

executing a command that is assigned through a rights profile. The password is effective for

a configurable period of time.

The AUTH_PROFS_GRANTED keyword in the policy.conf file sets the password requirement

for running a privileged command for all users of a system.

For further information, see “Expanding Users’ Rights” in Securing Users and Processes in

Oracle Solaris 11.3. Also, see the useradd(1M) and usermod(1M) man pages.

What Are User Accounts and Groups?

This section describes the following topics:

■

“User Account Components” on page 13

■

“Guidelines for Assigning User Names, User IDs, and Group IDs” on page 19

A typical user account includes the information a user needs to log in and use a system. User

account components are described in “User Account Components” on page 13.

12 Managing User Accounts and User Environments in Oracle Solaris 11.3 • March 2017

What Are User Accounts and Groups?

When you set up a user account, you can add the user to a predefined group of users. A typical

use of groups is to set up group permissions on a file or directory, which allows access only to

those users who are part of that group.

For example, you might have a directory containing confidential files that only a few users

should be able to access. You could set up a group called private that includes the users that

are working on the non-public project. In addition, you could set up the private files with read

permission for the private group so that only the users in the private group are able to read

the files.

A special type of user account, called a role, gives special rights to specific users. For more

information, see Chapter 1, “About Using Rights to Control Users and Processes” in Securing

Users and Processes in Oracle Solaris 11.3.

User Account Components

This section describes the various components of a user account.

User (Login) Names

User names, also called login names, enable users to access their own local and remote systems

that have the appropriate access rights. You must choose a unique user name for each account

that you create.

Consider establishing a standard way of assigning user names so that they are easier for you

to track. Also, names should be easy for users to remember. A simple scheme when selecting

a user name is to use the first name initial and first seven letters of the user's last name. For

example, John Smith becomes jsmith. If this scheme results in duplicate names, you can use

the first initial, middle initial, and the first six characters of the user's last name. For example,

John Jay Smith becomes jjsmith.

If this scheme still results in duplicate names, consider using the following scheme to create a

user name:

■

Using the first initial, middle initial, and first five characters of the user's last name

■

Adding the number 1, or 2, or 3, and so on, until you have a unique name

Note - User names must be distinct from any mail aliases that are known to the system or to a

NIS domain. Otherwise, mail might be delivered to the alias rather than to the actual user.

For detailed guidelines on setting up user (login) names, see “Guidelines for Assigning User

Names, User IDs, and Group IDs” on page 19.

Chapter 1 • About User Accounts and User Environments 13

What Are User Accounts and Groups?

User ID Numbers

A unique user identification number (UID) is associated with each user name. The UID number

identifies the user name to any system on which the user attempts to log in. It is also used

by systems to identify the owners of files and directories. If you create user accounts for an

individual on a number of different systems, always use the same user name and ID number.

This enables the user to easily move files between systems without ownership problems.

UID numbers must be a whole number that is less than or equal to 2147483647. UID numbers

are required for both regular user accounts and special system accounts. The following table

lists the UID numbers that are reserved for user accounts and system accounts.

TABLE 1

Reserved UID Numbers

UID Numbers User or Login Accounts Description

0 – 99

root, daemon, bin, sys, and so on

Reserved for use by the operating system

100 – 2147483647 Regular users General purpose accounts

60001 and 65534

nobody and nobody4

NFS Anonymous users

60002

noaccess

Reserved for OS

Do not assign UIDs 0 through 99. These UIDs are reserved for allocation by Oracle Solaris. By

definition, root always has UID 0, daemon has UID 1, and pseudo-user bin has UID 2.

For additional guidelines on setting up UIDs, see “Guidelines for Assigning User Names, User

IDs, and Group IDs” on page 19.

As with user (login) names, you should adopt a scheme for assigning unique UID numbers.

Some companies assign unique employee numbers. Then, administrators add a number to the

employee number to create a unique UID number for each employee.

To minimize security risks, you should avoid reusing the UIDs from deleted accounts. If

you must reuse a UID, remove the account information completely so that the new user is

not affected by attributes set for a former user. For example, a former user might have been

included in a printer deny list. However, denying access to that printer might be inappropriate

for the new user.

Using Large User IDs and Group IDs

UIDs and group IDs (GIDs) can be assigned up to the maximum value of a signed integer, or

2147483647.

14 Managing User Accounts and User Environments in Oracle Solaris 11.3 • March 2017

What Are User Accounts and Groups?

The following table describes UID and GID limitations.

TABLE 2

Large UID and GID Limitation Summary

UID or GID Limitations

262144 or greater

Users who use the cpio command with the default archive format to copy a file see an

error message for each file. The UIDs and GIDs are set to nobody in the archive.

2097152 or greater

Users who use the cpio command with the -H odc format or the pax -x cpio command

to copy files see an error message returned for each file. The UIDs and GIDs are set to

nobody in the archive.

1000000 or greater

Users who use the ar command have their UIDs and GIDs set to nobody in the archive.

2097152 or greater

Users who use the tar command, the cpio -H ustar command, or the pax -x tar

command have their UIDs and GIDs set to nobody.

UNIX Groups

A group is a collection of users who can share files and other system resources. For example,

users working on the same project can be formed into a group. A group is traditionally known

as a UNIX group.

Each group must have a name, a group identification (GID) number, and a list of user names

that belong to the group. A GID number identifies the group internally to the system.

The two types of groups that a user can belong to are as follows:

■

Primary group – Specifies a group that the operating system assigns to files that are

created by the user. Each user must belong to a primary group.

■

Secondary groups – Specifies one or more groups to which a user also belongs. Users can

belong to up to 1024 supplemental groups.

For detailed guidelines on setting up group names, see “Guidelines for Assigning User Names,

User IDs, and Group IDs” on page 19.

Sometimes, the secondary group of a user is not important. For example, ownership of files

reflect the primary group, not secondary groups. Other applications, however, might rely on

the secondary group memberships of a user. For example, a user has to be a member of the

sysadmin group (group 14) to use the Admintool software in previous Oracle Solaris releases.

However, it does not matter if group 14 is the user's current primary group.

The groups command lists the groups that a user belongs to. A user can have only one primary

group at a time. However, users can temporarily change their primary group to any other group

in which the user is a member by using the newgrp command.

Chapter 1 • About User Accounts and User Environments 15

剩余71页未读，继续阅读

weixin_40191861_zj

粉丝: 86
资源: 1万+

Oracle Solaris 11.3 用户账户与环境管理指南

Oracle Solaris 11.1 Managing User Accounts and User Environments

Oracle Solaris 11.2 Managing User Accounts and User Environments

Oracle Solaris 11.3 Managing Network Virtualization and Network

Oracle Solaris 11.3 Managing Devices in Oracle Solaris 11.3-282

Oracle Solaris 11.3 Managing Auditing in Oracle Solaris 11.3-16

Oracle Solaris 11.3 Managing SAN Devices and Multipathing-190

Oracle Solaris 11.3 Managing Kerberos and Other Authentication S

Oracle Solaris 11.3 Managing Encryption and Certificates in Orac

Oracle Solaris 11.3 Managing SMB File Sharing and Windows Intero

Oracle Solaris 11.3 Managing Serial Networks Using UUCP and PPP

最新资源