USER - GROUP

Users - Groups

During AIX installation default set of user accounts have been created, and the main purpose of these to prevent root from owning all filesystems and files. If these users and group IDs are not needed, you can remove them to minimize security risks associated with them. (Most typically uucp, nuucp, guest, lpd can be removed.)

root:     superuser (UID 0), system administrators log into it to perform system maintenance and problem determination.
bin:      owns important system dirs/files (so not only root owns all important files), and also owns the executable files for user commands
daemon:   responsible for executing server processes, owning these processes and the associated files
sys:      owns the default mounting point for the Distributed File Service (DFS) cache (I have not much info about DFS???)
adm:      ownership of diagnostic tools
guest:    useful to give access to the system for someone who has no account on the server
nobody:   it is used by the Network File System (NFS), and to enable remote printing
uucp:     (unix-to-unix copy) this user owns the files when transferring data between Unix servers over a dedicated line or telephone line
nuucp:    uucp and nuucp, are created when bos.net.uucp fileset is installed. Logging in as uucp is not allowed, with nuucp it is possible
lpd, lp:  used for starting the lpd daemon which is necessary to do remote printing.
invscout: used by Inventory Scout. This tool checks software and hardware configurations on the Hardware Management Console (HMC).
imnadm:   it is used by the AIX Documentation Search Service to conduct searches of online HTML documents

-----------------------------------

USER INFORMATION:
/etc/passwd                  contains the basic attributes of users. (username, if pw set, uid, gid, GECOS, home dir, shell)
                             (* means invalid or password is not set, ! means user has a password)   

/etc/security/passwd         it contains the password (encrypted) and other information. (here is the ADMCHG flag...)

                             root:
                                password = D2ylo7rm3Qw7g
                                lastupdate = 1244118051
                                flags =

                             pw: encrypted pw, if pw contains only an asterisk (*), account is locked until a password has been set
                             lastupdate: number of seconds since epoch (1970. jan. 1) when the password was last updated
                             flags: restrictions to changing the user's password. You can set three different flags:

                                * ADMIN.   If set, only the root user can change the user's password.
                                * ADMCHG.  If set, the user is prompted to change his or her password on the next login/su.
                                * NOCHECK. If set, any additional restrictions in /etc/security/user are ignored.


/etc/security/user           contains the most important settings, outside of the basics in /etc/passwd(umask, expires settings...)
                                       
                             uucp:
                                 admin = true
                                 login = false
                                 rlogin = false
                                 su = true
                                 ...   

/usr/lib/security/mkuser.sys    when new user is created (with mkuser) this script is executed
                             it will use the default parameters from file: /usr/lib/security/mkuser.default
                             creates home directory, sets permission, copies /etc/security/.profile as users profile
                       
/etc/security/.profile       this is the template .profile, which is copied when a new user created
                             (if you make changes in this file, the new users .profile will look like this file)

-----------------------------------

User profile is set up in the following way:

1. /etc/environment
PATH=/wherever:/right/there

2. /etc/profile which is shell script
PATH=$PATH:/somewhere/else
export PATH

3. users .profile
which is copied from /etc/security/profile at user creation

-----------------------------------

USER ULIMIT:

The /etc/security/limits file contains all the ulimits, or users' system resource limitations. The values are set with the mkuser command when the user is added to the system, or changed with the chuser command.  A soft limit is a value that a user or application can change on the fly up to the maximum (the hard limit). The hard limit is just that -- the maximum value a parameter can be set to. (you can set the parameter to  -1, which translates to unlimited. )

(in smitty user or chuser, you can set the hard and softlimits, e.g. chuser fsize_hard=4000000 bb)

The /etc/security/limits file contains a section called default that defines a template of standard values for each user unless that user has set custom values. It can be changed with "vi" or with command "chuser" or for temporary for that user sesion with command "ulimit".

With the ulimit command, you can change your soft limits, up to the maximum set by the hard limits and ulimit command affects the current shell environment.

change user's ulimit parameters:
su - bb "-c ulimit -a"                            <--shows user ulimit settings
chuser core=2000000 bb                            <--change user core file size
chuser rss=-1 rss_hard=-1 data=-1 data_hard=-1 <user>        <--data and memory unlimited,  rss:memory (shared memory), data: data stack
su - bb "-c ulimit -a"                            <--check new settings (or you can see in /etc/security/limits)

Max user process:
lsattr -EHl sys0                                  <--shows many things, maxuproc also

Normally there are three things we change for oracle. the system maxuproc and oracle's fsize and data segment size:
chdev -l sys0 -a maxuproc=512                     <--reboot is needed only for decresing (F1 in smitty)
chuser fsize=-1 data=-1 oracle


-----------------------------------

SUID, SGID, SVTX

SUID Permission Bit:
An additional permission bit that can cause serious security problems is the SUID (set user ID). The SUID on an executable file means that when the file is executed, the process runs with an effective UID of the owner of the file. The SUID is not supported on shell scripts, and it has no meaning on a directory

SGID Permission Bit:
Another additional permission bit is the SGID (set group ID). The SGID on an executable file means that when the file is executed, the process runs with an effective GID of the group owner of the file. The SGID on a directory means that any file or directory created within the directory will have the same group ownership as the directory, rather than of the primary group of the user. The SGID permission bits are propagated down through the directory structure, so any directory created within a directory with the SGID bit set also inherits that bit

The SVTX Permission Bit:
The last of the additional permission bits is the SVTX, also referred to as the sticky bit. The SVTX on a directory means that even if the directory has global write permission (such as /tmp), users cannot delete a file in the directory unless they own the file or the directory

If the third bit is a lowercase s, it indicates that the SUID bit is set and that the execute permission (x) is turned on. An uppercase S indicates that the file has the SUID turned on but not the execute permission

Using Octal Notation
In octal notation, you are probably familiar with setting permissions, using three numbers such as 777 to indicate rwxrwxrwx. There is actually another position that is 0 by default, so 777 is really 0777. If you want to set the SUID, SGID, or SVTX permission bit, this position takes on a value other than 0. SUID is assigned a 4; SGID is assigned a 2, and SVTX is assigned a 1. Use the appropriate value to turn on that permission

root@aix1: /home/bubba # chmod 7777 bb01
root@aixi1: /home/bubba # ls -l | grep bb01
-rwsrwsrwt   1 root     system            0 Jul 02 15:39 bb01

root@aix1: /home/bubba # chmod 7666 bb01
root@aix1: /home/bubba # ls -l | grep bb01
-rwSrwSrwT   1 root     system            0 Jul 02 15:39 bb01

-----------------------------------

umask

umask determines the permissions for new files and directories (for example if files are created with 644 or 640 permissions). /etc/security user file contains the umask value, which is by default: 022. It can be changed for the whole system, or for a specific user.

The umask logic is similar to the file/dir permissions, just with umas we need to subtract the umask value from a specific number to know with which permission a new file/dir will be created:

# umask
0022
# touch new.file; mkdir new.dir
drwxr-xr-x    2 root     system          256 Nov 02 18:11 new.dir
-rw-r--r--    1 root     system            0 Nov 02 18:11 new.file

# umask 027
# touch new027.file; mkdir new027.dir
drwxr-x---    2 root     system          256 Nov 02 18:13 new027.dir
-rw-r-----    1 root     system            0 Nov 02 18:13 new027.file


-----------------------------------

GROUPS:
adm                        takes care of most monitoring functions, such as performance, cron, and accounting
audit                      conducts system audits
system                     configures the system and standard hardware and also performs software maintenance
printq                     system manages queuing. Typical commands include enable, disable, qadm, and qpri
security                   handles password and user account issues.
staff                      the default group assigned to all new users


GROUP INFORMATION:

/etc/group                 Contains the basic attributes of groups.
/etc/security/group        Contains the extended attributes of groups.

-----------------------------------

USER ADMINISTRATION RELATED COMMANDS:

mkuser                     Creates a new user
passwd                     Creates or changes the password of a user
pwdadm                     Change other people's passwords and does not require the old password (-q:shows flag, -c:clears it)
echo <user>:<password> | chpasswd; pwdadm -c <user> <--root user can change other users passwords by standard input
chuser                     Changes user attributes (except password)
chuser groups=staff,uucp bb        <--adds user "bb" to groups: staff, uucp
rmuser                     Removes a user and its attributes
chsec                      Changes security related stanzas
chsec -f /etc/security/lastlog -a unsuccessful_login_count=0 -s account_name    <--reset unsuccessful login count
chsh                       Changes a user's login shell
login                      Initiates a user session
dtconfig                   Enables or disables the desktop autostart feature

umask                      shows the actual umask
umask 022                  sets the umask to 022 (umask of 000 would give 666 permissions on a file or 777 on a directory)

w                          who logged in
whoami                     who am i
who am i                   who am i with more details
last                       who logged in last to the system

finger username            info about the user
lsuser -f <username>       deatiled info about the user (-f: readable format)
rmuser -p <username>       removes a user
                           (-p: removes auth. info from /etc/security/* files, the user's home dir is not removed automatically)

mkgroup                    makes a group
chgroup                    changes a group
lsgroup ALL                lists all group
lsgroup -f <groupname>     deatiled info about the user (-f: readable format)
rmgroup <groupname>        removes a group from the system

pwdck                      verifies consistency between /etc/passwd, /etc/security/user, and /etc/security/passwd
usrck                      verifies consistency between /etc/passwd, /etc/security/user, and /etc/security/limits
grpck                      verifies consistency between /etc/passwd, /etc/security/user, /etc/group, and /etc/security/group

usrck, grpck, pwdck        verifies the validity of: user, group, password
    -n                     reports errors but does not fix them
    -t                     reports errors and asks if they should be fixed

------------------------------------

User creation
1. smitty user
2. pwdadm username          <--setting the password
3. pwdadm -c username       <--removing the ADMCHG flag from /etc/security/passwd file

chuser unsuccessful_login_count=0 <user>    clears unsuccessful login count

------------------------------------

nofiles ( number of file descriptors a process may have):
It specifies the number of open files permitted. If this value is set too low, a memory allocation error will occur on AIX and a too many files open will be logged to the to the stderr log file. Set this value higher than the default system value. For large multi-processor machines, set to unlimited.

# ulimit -a                   <--to query
# ulimit -n <new_value>       <--to set to a new value
# ulimit -n -1                <--to set it to unlimited

------------------------------------

maximum number of processes per user:
'maxuproc' defines the max number of processes each AIX user can 'fork'. If it is set too low, you may not be able to create high number of database agents necessary to handle connections from your application.  So it is recommended to set this to at least 4096.

To query current setting:
# lsattr -El sys0 -a maxuproc

To set to a different value:
# chdev -l sys0 -a maxuproc='4096'

------------------------------------

Copying users between AIX systems:


0. On source system check file consistency:
# usrck -t ALL
# pwdck -t ALL
# grpck -t ALL

1. These files should be copied:
/etc/group
/etc/passwd
/etc/security/group
/etc/security/limits
/etc/security/passwd
/etc/security/.ids
/etc/security/environ
/etc/security/.profile

These can be copied as well (between same AIX versions):
/etc/security/login.cfg
/etc/security/user

2. If needed edit /etc/passwd, to look like this:
root:!:0:0::/:/usr/bin/ksh

3. On destination system check file consistency:
# usrck -t ALL
# pwdck -t ALL
# grpck -t ALL

------------------------------------

Mass user creation:

32 users had to be created.

1. I created 3 files:

test1: contained usernames
test2: contained gecos fields of the users (in the same order as the users were in test1)
test3: contained home dirs of the users (same order as in test1)

(It could be done in 1 file, with 3 columns and awk the columns, but this way was easier for me)

2. This script was created:
    x=1
    while [[ $x -lt 33 ]]
    do

    i=`cat test1 | head -n $x | tail -1`
    j=`cat test2 | head -n $x | tail -1`
    k=`cat test3 | head -n $x | tail -1`

    mkuser -a gecos="$j" home="$k" $i

    (( x += 1 ))
    done


3. After users were created, some attibutes were set to these users:
for i in `cat test1`; do chuser rlogin=true minage=0 maxage=0 maxexpired=-1 minalpha=0 minother=0 mindiff=0 maxrepeats=8 minlen=0 $i; done

4. User passwords have been set this way:
for i in `cat test1`; do echo $i:abcd1234| chpasswd; pwdadm -c $i; done

------------------------------------