aix 用户、组、及安全管理

作者：佚名上传时间：2019-05-13 版权申诉

文件位置

/etc/passwd #存放用户账号

/etc/group #存放组账号

useradd 用法

Syntax

useradd [ -c comment ] [ -d dir ] [ -e expire ] [ -g group ] [ -G
group1,group2 ... ] [ -m [ -k skel_dir ] ] [ -u uid ] [ -s shell ] [ -r
role1,role2 ... ] login

1、创建用户账号

useradd testuser #新增testuser,默认不增加/home/testuser目录

如新增加的用户，但是没有设置密码，/etc/passwd的第二个字段会显示*号, 设置密码后会显示!号

passwd testuser #设置testuser密码

2、创建用户账号并创建home下的用户目录

useradd -m testuser

3 创建用户账号并使用bash为登陆运行的shell(前提已安装bash)

useradd -s /usr/bin/bash testuser

注：也可以使用smit mkuser 新增用户 smit mkuser

4更改账号

usermod -l newuser username #更改用户名

也可以 smit chuser 命令更改

5、删除用户

userdel -r testuser # -r 指删除用户home目录的用户文件夹

userdel -r
Removes the user's home directory.

smit rmuser

6、显示用户账号

smit lsuser

7、锁定用户账号与解锁

smit lockuser

选择用户后， true锁定用户。登陆时会有以下提示。

AIX Version 6
Copyright IBM Corporation, 1982, 2009.
login: usert1
usert1's Password:
3004-301 Your account has been locked; please see the system administrator.

组管理

创建新组

smit mkgroup

Add a Group

Type or select values in entry fields.
Press Enter AFTER making all desired changes.

[Entry Fields]
* Group NAME                                         []
ADMINISTRATIVE group?                               false                  +
Group ID                                           []                       #
USER list                                          []                      +
ADMINISTRATOR list                                 []                      +
Projects                                           []                      +
Initial Keystore Mode                              []                      +
Keystore Encryption Algorithm                      []                      +
Keystore Access                                    []                      +

F1=Help             F2=Refresh          F3=Cancel           F4=List
F5=Reset            F6=Command          F7=Edit             F8=Image
F9=Shell            F10=Exit            Enter=Do

组的更改

smit chgroup

Change Group Attributes

Type or select values in entry fields.
Press Enter AFTER making all desired changes.

[Entry Fields]
Group NAME                                         [groupt]
Group ID                                           [201]                    #
ADMINISTRATIVE group?                               false                  +
USER list                                          []                      +
ADMINISTRATOR list                                 [root]                  +
Projects                                           []                      +
Initial Keystore Mode                              []                      +
Keystore Encryption Algorithm                      []                      +
Keystore Access                                    []                      +

F1=Help             F2=Refresh          F3=Cancel           F4=List
F5=Reset            F6=Command          F7=Edit             F8=Image
F9=Shell            F10=Exit            Enter=Do

组的删除

smit rmgroup

查看用户与组状态

显示当前登陆用户状态

-bash-3.2# id
uid=0(root) gid=0(system) groups=2(bin),3(sys),7(security),8(cron),10(audit),11(lp)

查看指定用户的状态

-bash-3.2# id usert
uid=209(usert) gid=1(staff)

查看当前登陆用户信息 who命令

查看系统最近的启动时间

-bash-3.2$ who -b
. system boot Nov 06 14:53

查看当前启动级别

-bash-3.2$ who -r
. run-level 2 Nov 06 14:53 2 0 S

显示标题

-bash-3.2$ who -H
Name Line Time Hostname
kim pts/0 Nov 06 20:12 (99.99.99.254)

显示终端号

-bash-3.2$ who -T
kim       + pts/0       Nov 06 20:12
root      + pts/1       Nov 06 22:06
kim       + pts/2       Nov 06 22:07

-bash-3.2$ w
10:08PM   up   7:15, 3 users, load average: 0.03, 0.10, 0.08
User     tty          login@       idle      JCPU      PCPU what
kim      pts/0       08:12PM          0         3         0 w
root     pts/1       10:06PM          2         0         0 -bash
kim      pts/2       10:07PM          1         0         0 -bash

查看当前终端所登陆用户的信息（也就是可以确定当前的终端号）

-bash-3.2$ who -m
kim pts/0 Nov 06 20:12 (99.99.99.254)

等同 who am i

-bash-3.2$ who am i ;who -m
root pts/1 Nov 06 22:06 (99.99.99.254)
root pts/1 Nov 06 22:06 (99.99.99.254)

whoami （如果用户su后，所以显示是当前用户，并不是当前终端登陆的用户。）

查看当前用户账号信息

看下面的操作与显示就明白（telnet 时输入的用户名kim）。

-bash-3.2$ who -m ;echo "----";who am i
kim         pts/0       Nov 06 22:32     (99.99.99.254)
----
kim         pts/0       Nov 06 22:32     (99.99.99.254)
-bash-3.2$ whoami
kim
-bash-3.2$ su - root
root's Password:
-bash-3.2# who -m ;echo "----";who am i
kim         pts/0       Nov 06 22:32     (99.99.99.254)
----
kim         pts/0       Nov 06 22:32     (99.99.99.254)
-bash-3.2# whoami
root

与其它终端的用户对话

-bash-3.2$ talk kim@localhost pts/2

用户账号切换su

su 的日志文件

-bash-3.2# tail /var/adm/sulog
SU 11/06 19:14 + pts/0 kim-root
SU 11/06 19:16 + pts/0 kim-root
SU 11/06 19:18 + pts/0 kim-root
SU 11/06 20:12 + pts/0 kim-root
SU 11/06 20:18 + pts/0 root-usert5
SU 11/06 22:06 + pts/1 root-kim
SU 11/06 22:15 + pts/1 root-kim
SU 11/06 22:18 + pts/1 root-kim
SU 11/06 22:20 + pts/1 kim-root
SU 11/06 22:33 + pts/0 kim-root

必要时可能清空该文件

>/var/adm/sulog

组，用户安全管理

/etc/security/passwd 文件存放用户账号的密码。

-bash-3.2# head -n 10 /etc/security/passwd

root:
password = xdq5doH57hC6c
lastupdate = 1352230576

daemon:
password = *

passwd -s 更改用户使用的shell

-bash-3.2$ passwd -s
Current available shells:
/usr/bin/bash
/bin/sh
/bin/bsh
/bin/csh
/bin/ksh
/bin/tsh
/bin/ksh93
/usr/bin/sh
/usr/bin/bsh
/usr/bin/csh
/usr/bin/ksh
/usr/bin/tsh
/usr/bin/ksh93
/usr/bin/rksh
/usr/bin/rksh93
/usr/sbin/uucp/uucico
/usr/sbin/sliplogin
/usr/sbin/snappd
kim's current login shell:
/usr/bin/bash
Change (yes) or (no)? > yes
To?>/usr/bin/bash

pwdadm命令的使用

更改用户密码

-bash-3.2# pwdadm usert
Changing password for "usert"
usert's New password:
Enter the new password again:

设置用户自身不能更改密码（属性ADMIN）

-bash-3.2# pwdadm -f ADMIN kim
-bash-3.2# pwdadm -q kim
kim:
lastupdate = 1352236213
flags = ADMIN

-bash-3.2# passwd kim
Changing password for "kim"
kim's New password:
Enter the new password again:
-bash-3.2# su - kim
-bash-3.2$ passwd
Changing password for "kim"
3004-664 You are not authorized to change "kim's" password.
3004-709 Error changing password for "kim" : You do not have permission.
-bash-3.2# pwdadm -c kim
-bash-3.2# pwdadm -q kim
kim:
lastupdate = 1352351804

pwdadm -c user 清除用户所有的密码标志

pwdadm -q user 查询用户密码的状态

pwdadm -f ADMIN|ADMCHG|NOCHECK user 设置用户的三个密码属性

ADMIN 表示用户不能自己设置密码

ADMCHG 强制用户在下次登陆login|su时更改密码

NOCHECK 表示新密码不需要遵/etc/security/user的密码组合规则

pwdck 命令检查本地账户认证信息的正确性

/etc/security/user 文件主要控制用户账号的参数设置，如密码的个数，密码的使用周期，设定umask等。

default:
admin = false
login = true
su = true #是否可以使用su命令
daemon = true
rlogin = true #是否可以使用telnet 登陆
sugroups = ALL
admgroups =
ttys = ALL
auth1 = SYSTEM
auth2 = NONE
tpath = nosak
umask = 022
expires = 0

/etc/security/group 文件对组进行安全性管理，设置组是否为管理员组。

-bash-3.2# head -n 10 /etc/security/group
system:
admin = true

staff:
admin = false

bin:
admin = true

/etc/security/login.cfg 文件控制用户登陆与身份验证的信息，控制用户登陆使用shell的方式，在多长时间输入密码等。

-bash-3.2# cat /etc/security/login.cfg|grep -v '*'

default:
sak_enabled = false
logintimes =
logindisable = 0
logininterval = 0
loginreenable = 0
logindelay = 0

usw:
shells = /usr/bin/bash,/bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/uucp/uucico,/usr/sbin/sliplogin,/usr/sbin/snappd
maxlogins = 32767
logintimeout = 60
maxroles = 8
auth_type = STD_AUTH

/etc/security/limits 为每个用户指定进程资源，如内存，cpu的使用时间等。

-bash-3.2# cat /etc/security/limits|grep -v '*'

default:
fsize = 2097151
core = 2097151
cpu = -1
data = 262144
rss = 65536
stack = 65536
nofiles = 2000

/etc/security/lastlog 主要记录用户账号上次登陆系统的信息。如上次成功登陆的时间，登陆的IP等。

-bash-3.2# cat /etc/security/lastlog |grep -v '*'

root:
time_last_login = 1352261160
tty_last_login = /dev/pts/1
host_last_login = 99.99.99.254
unsuccessful_login_count = 0
time_last_unsuccessful_login = 1352234585
tty_last_unsuccessful_login = /dev/pts/0
host_last_unsuccessful_login = 99.99.99.254

kim:
time_last_login = 1352427960
tty_last_login = /dev/pts/0
host_last_login = 99.99.99.254
unsuccessful_login_count = 0