Remove and Create Accounts¶

Once the list is compared, act on it. Every account change on Linux is one command, and each has a verify line.

Remove an unauthorized account¶

sudo userdel -r dave

-r removes the home directory too. If the account is logged in or running a process, userdel refuses; sudo pkill -u dave first. If the README says the account should exist but must not log in (a service account, a former employee whose files are needed), lock it instead of deleting:

sudo usermod -L -s /usr/sbin/nologin dave

-L locks the password, -s /usr/sbin/nologin removes the shell, so there's no way in even with a key.

Remove a second root¶

An account with UID 0 that isn't root is deleted like any other, but userdel warns about the UID. Do it anyway:

sudo userdel -r toor
awk -F: '$3 == 0' /etc/passwd

Create an account the README asks for¶

sudo adduser carol

adduser (Debian's friendly wrapper) creates the home directory, sets the shell to bash, and prompts for a password. On an image without it, sudo useradd -m -s /bin/bash carol then sudo passwd carol.

Give an administrator the sudo group at the same time:

sudo gpasswd -a carol sudo

Fix an account that exists but is wrong¶

Problem	Fix
No shell, but the README says the user logs in	`sudo usermod -s /bin/bash carol`
Shell is bash, but it's a service account	`sudo usermod -s /usr/sbin/nologin svc`
Locked, but authorized	`sudo usermod -U carol` or `sudo passwd carol`
Home directory missing	`sudo mkhomedir_helper carol`
Wrong UID range (a human with UID 999)	`sudo usermod -u 1005 carol` then `sudo chown -R carol: /home/carol`

Verify¶

getent passwd dave          # nothing
getent passwd carol         # carol:x:1003:1003::/home/carol:/bin/bash
sudo getent shadow carol | cut -d: -f2 | cut -c1-3   # $y$ or $6$, not ! or empty

Example¶

README: carol should exist and be an administrator; dave should not exist. getent passwd carol returns nothing. sudo adduser carol, set a password, sudo gpasswd -a carol sudo. sudo userdel -r dave fails with "user dave is currently used by process 2311"; sudo pkill -u dave, then run userdel again.

Try it¶

Create a user with adduser, lock it, unlock it, change its shell, and delete it with -r, checking getent passwd after each.
Try userdel on a user who is logged in and read the error.

Build it¶

A mkusers.sh that creates every user in authorized.txt who doesn't exist and adds the ones marked admin to sudo. Second file, same input as accounts.sh.

Next¶

Passwords and Shells