Администрирование oracle linux server

Содержание

Oracle В® Linux 7
Administrator’s Guide
Oracle Legal Notices
Oracle Documentation License
ChapterВ 1В Configuring and Managing Local Accounts
1.1В About User and Group Configuration
1.2В About Files Storing User and Group Information
1.3В Changing Default Settings for User Accounts
1.4В Creating User Accounts
1.4.1В About umask and the setgid and Restricted Deletion Bits
1.5В Locking an Account
1.6В Modifying or Deleting User Accounts
1.7В Creating Groups
1.8В Modifying or Deleting Groups
1.9В Configuring Password Ageing
1.10В Granting sudo Access to Users

Oracle В® Linux 7

Administrator’s Guide

Oracle Legal Notices

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs) and Oracle computer documentation or other Oracle data delivered to or accessed by U.S. Government end users are «commercial computer software» or «commercial computer software documentation» pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, reproduction, duplication, release, display, disclosure, modification, preparation of derivative works, and/or adaptation of i) Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs), ii) Oracle computer documentation and/or iii) other Oracle data, is subject to the rights and limitations specified in the license contained in the applicable contract. The terms governing the U.S. Government’s use of Oracle cloud services are defined by the applicable contract for such services. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Inside are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Epyc, and the AMD logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Oracle Documentation License

This document uses the Web-based Help format from DocBook XML. The following license information applies to this format.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the «Software»), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Except as contained in this notice, the names of individuals credited with contribution to this software shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the individuals in question.

Any stylesheet derived from this Software that is publicly distributed will be identified with a different name and the version strings in any derived Software will be changed so that no possibility of confusion between the derived package and this Software will exist.

THE SOFTWARE IS PROVIDED «AS IS», WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL NORMAN WALSH OR ANY OTHER CONTRIBUTOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Web-based Help from DocBook XML

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the вЂњSoftwareвЂќ), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Warranty: THE SOFTWARE IS PROVIDED «AS IS», WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL DAVID CRAMER, KASUN GAJASINGHE, OR ANY OTHER CONTRIBUTOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Certain search characteristics associated with the DocBook XSL webhelp stylesheets are provided as javascript files generated using Apache Lucene and other fourth party technologies, which are licensed under the Apache License reproduced below.

Источник

ChapterВ 1В Configuring and Managing Local Accounts

This chapter describes how to configure and manage local user and group accounts in Oracle Linux 8.

1.1В About User and Group Configuration

You use the useradd and groupadd commands to add and delete users and groups, as well as to modify settings such as passwords, home directories, login shells, and group membership

In an enterprise environment that might have hundreds of servers and thousands of users, user and group account information is more likely to be held in a central repository rather than in files on individual servers. You can configure user and group information on a central server and then retrieve this information by using services such as the Lightweight Directory Access Protocol (LDAP) or the Network Information Service (NIS). You can also create home directories on a central server and then automatically mount or access these remote file systems when the user logs in to a system.

1.2В About Files Storing User and Group Information

Unless you select a different authentication mechanism during installation or use the authselect command to create an authentication profile, Oracle Linux verifies a user’s identity by using the information that is stored in the /etc/passwd and /etc/shadow files.

The /etc/passwd file stores account information for each user such as his or her unique user ID (or UID , which is an integer), user name, home directory, and login shell. A user logs in using his or her user name, but the operating system uses the associated UID. When the user logs in, he or she is placed in his or her home directory and his or her login shell runs.

The /etc/group file stores information about groups of users. A user also belongs to one or more groups, and each group can contain one or more users. If you can grant access privileges to a group, all members of the group receive the same access privileges. Each group account has a unique group ID ( GID , again an integer) and an associated group name.

By default, Oracle Linux implements the user private group ( UPG ) scheme where adding a user account also creates a corresponding UPG with the same name as the user, and of which the user is the only member.

Only the root user can add, modify, or delete user and group accounts. By default, both users and groups use shadow passwords, which are cryptographically hashed and stored in /etc/shadow and /etc/gshadow respectively. These shadow password files are readable only by the root user. The root user can set a group password that a user must enter to become a member of the group. If a group does not have a password, a user can only join the group if the root user adds that user as a member.

A user can use the newgrp command to log into a new group or to change the current group ID during a login section. If the user has a password, he or she can add group membership on a permanent basis. See the newgrp(1) manual page.

The /etc/login.defs file defines parameters for password aging and related security policies.

For more information about the content of these files, see the group(5) , gshadow(5) , login.defs(5) , passwd(5) , and shadow(5) manual pages.

1.3В Changing Default Settings for User Accounts

To display the default settings for a user account, use the following command:

The following output is displayed:

INACTIVE : Specifies after how many days the system locks an account if a user’s password expires. If set to 0, the system locks the account immediately. If set to -1, the system does not lock the account.

SKEL : Defines a template directory, whose contents are copied to a newly created userвЂ™s home directory. The contents of this directory should match the default shell defined by SHELL .

You can specify options to useradd -D to change the default settings for user accounts. For example, to change the defaults for INACTIVE , HOME and SHELL :

If you change the default login shell, you would most likely also create a new SKEL template directory that contains contents that are appropriate to the new shell.

If you specify /sbin/nologin for a user’s SHELL , that user cannot log into the system directly but processes can run with that user’s ID. This setting is typically used for services that run as users other than root .

The default settings are stored in the /etc/default/useradd file.

For more information, see SectionВ 1.9, вЂњConfiguring Password AgeingвЂќ and the useradd(8) manual page.

1.4В Creating User Accounts

To create a user account by using the useradd command:

Create a user account by using the useradd command:

You can specify options to change the account’s settings from the default ones.

By default, if you specify a user name argument but do not specify any options, useradd creates a locked user account using the next available UID and assigns a user private group (UPG) rather than the value defined for GROUP as the user’s group.

Assign a password to the account to unlock it as follows:

The command prompts you to enter a password for the account.

If you want to change the password non-interactively (for example, from a script), use the chpasswd command instead:

Alternatively, you can use the newusers command to create a number of user accounts at the same time.

For more information, see the chpasswd(8) , newusers(8) , passwd(1) , and useradd(8) manual pages.

1.4.1В About umask and the setgid and Restricted Deletion Bits

Users whose primary group is not a UPG have a umask of 0022 set by /etc/profile or /etc/bashrc , which prevents other users, including other members of the primary group, from modifying any file that the user owns.

A user whose primary group is a UPG has a umask of 0002. It is assumed that no other user has the same group.

To grant users in the same group write access to files within the same directory, change the group ownership on the directory to the group, and set the setgid bit on the directory:

Files that are created in such a directory have their group set to that of the directory rather than the primary group of the user who creates the file.

The restricted deletion bit prevents unprivileged users from removing or renaming a file in the directory unless they own either the file or the directory.

To set the restricted deletion bit on a directory:

For more information, see the chmod(1) manual page.

1.5В Locking an Account

To lock a user’s account, use the passwd command with the -l option:

To unlock the account, specify the -u option:

For more information, see the passwd(1) manual page.

1.6В Modifying or Deleting User Accounts

To modify a user account, use the usermod command:

For example, to add a user to a supplementary group (other than his or her login group):

You can use the groups command to display the groups to which a user belongs, for example:

To delete a user’s account, use the userdel command:

For more information, see the groups(1) , userdel(8) and usermod(8) manual pages.

1.7В Creating Groups

To create a group by using the groupadd command:

Typically, you might want to use the -g option to specify the group ID (GID). For example:

For more information, see the groupadd(8) manual page.

1.8В Modifying or Deleting Groups

To modify a group, use the groupmod command:

To delete a user’s account, use the groupdel command:

For more information, see the groupdel(8) and groupmod(8) manual pages.

1.9В Configuring Password Ageing

To specify how users’ passwords are aged, edit the following settings in the /etc/login.defs file:

Maximum number of days for which a password can be used before it must be changed. The default value is 99,999 days.

Minimum number of days that is allowed between password changes. The default value is 0 days.

Number of days warning that is given before a password expires. The default value is 7 days.

For more information, see the login.defs(5) manual page.

To change how long a user’s account can be inactive before it is locked, use the usermod command. For example, to set the inactivity period to 30 days:

To change the default inactivity period for new user accounts, use the useradd command:

A value of -1 specifies that user accounts are not locked due to inactivity.

For more information, see the useradd(8) and usermod(8) manual pages.

1.10В Granting sudo Access to Users

By default, an Oracle Linux system is configured so that you cannot log in directly as the root user. You must log in as a named user before using either su or sudo to perform tasks as root . This configuration allows system accounting to trace the original login name of any user who performs a privileged administrative action. If you want to grant certain users authority to be able to perform specific administrative tasks via sudo , use the visudo command to modify the /etc/sudoers file.

For example, the following entry grants the user erin the same privileges as root when using sudo , but defines a limited set of privileges to frank so that he can run commands such as systemctl , rpm , and dnf :

For more information, see the su(1) , sudo(8) , sudoers(5) , and visudo(8) manual pages.

Источник