USER ADMINISTRATION IN RHEL5

/etc/passwd /etc/passwd-
/etc/shadow /etc/shadow-
/etc/group /etc/group-
useradd
usermod
-g primary group
-G secondary group
-s login shell
-d login directory
-c comment
-u uid

-l login name
-L lock user account
-U unlock
userdel

groupadd
groupmod
groupdel
------------------------------------------------
useradd -c "Admin" jane
Example:(useradd -c "Admin" -s /bin/sh -d /var/tmp jane

grep jane /etc/passwd or getent passwd jane
jane:x:500:500:Admin:/home/jane:/bin/bash
Similarly
getent group jane
getent shadow jane

groupadd java
getent group java
java:x:501:

useradd -G java tom
getent passwd jane tom
jane:x:500:500:Admin:/home/jane:/bin/bash
tom:x:501:502::/home/tom:/bin/bash

getent group jane java tom
jane:x:500:
java:x:501:tom
tom:x:502:

useradd -g java mary
getent passwd jane tom mary
jane:x:500:500:Admin:/home/jane:/bin/bash
tom:x:501:502::/home/tom:/bin/bash
mary:x:502:501::/home/mary:/bin/bash


getent group jane java tom mary
jane:x:500:
java:x:501:tom
tom:x:502:

mkdir /data
chmod 750 /data/
chown -R jane:java /data/
ls -ld /data/
drwxr-x--- 2 jane java 4096 Oct 4 17:20 /data/

touch /data/file
chmod 640 /data/file
chown -R jane:java /data
ls -ld /data/file
-rw-r----- 1 jane java 0 Oct 4 17:24 /data/file

useradd eric
Check whether jane, tom, mary and eric can (cd /data/ and cat file)
Result:
jane: can-user(owner-7(rwx)) of /data/
tom: and maty can access -the belongs to java (group-5(r-x))
eric: he can't access (cd /data/) (other-0(---))

Advanced File Permissions
------------------------------------
StickyBit - 1 or T/t(777)
chmod 1770 /data/
drwxrwx--T 2 jane java 4096 Oct 4 17:35 /data/
No user of java group can delete each other's files or folders.
Only jane can delete, as he is owner of /data/

SGID - 2 or s (group Inheritance on the file/folders created)
chmod 2770 /data/
drwxrws--- 2 jane java 4096 Oct 4 17:43 /data/

If you want both StickBit and SGID, then apply 1+2 = 3
eg: chmod 3770 /data/


SUID - 4
Applied on executable files

ls -ld /bin/ping
-rwsr-xr-x 1 root root 35832 Apr 24 2009 /bin/ping

chmod 755 /bin/ping
ls -ld /bin/ping
-rwxr-xr-x 1 root root 35832 Apr 24 2009 /bin/ping
chmod 4755 /bin/ping
ls -ld /bin/ping
-rwsr-xr-x 1 root root 35832 Apr 24 2009 /bin/ping

ACL
------------
getfacl /data/
getfacl /data/file

chmod -R 640 /data/*

As eric try to
cd /data/ (No permission)
cat /data/file

setfacl -m u:eric:--x /data/
setfacl -m u:eric:r-- /data/file

Now eric can do
cd /data/
cat /data/file

getfacl /data/
getfacl /data/file