Mycpen

1. How to know if a user exists in the Linux system?
cat /etc/passwd
or use the id command

2. How to disable a user from logging into the Linux system?
Use usermod -L to lock the user
usermod -s /sbin/nologin root

3. How to know which groups a user belongs to?
Use the id command to check
Use the groups command to check
Check the groups the user belongs to in /etc/group

4. How to know which users are currently logged into Linux? Which users have logged into the Linux system before?
Use the w command to check user login status
Use the last command to check users who have logged in before
Example: w who to see currently logged in users
# Note: w provides more detailed information
[root@localhost ~]# w
 09:37:40 up  8:32,  5 users,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     tty1                      Thu09    6:28   0.09s  0.09s -bash
root     pts/3    192.168.136.1    09:29    4.00s  0.05s  0.03s w
[root@localhost ~]# who
root     tty1         2020-11-05 09:31
root     pts/3        2020-11-06 09:29 (192.168.136.1)

5. How to reset a user's password?
passwd

6. What to do if the root password for Linux is forgotten?
      Enter single-user mode
      1. Boot up, press any key to stop the startup screen, then select the corresponding kernel and press e to edit
      2. Find the line starting with linux16 and add rd.break at the end
      3. Press Ctrl-x to start, then follow the steps below to crack the root password
Example: What to do if you forget the root user password?
Answer: Enter single-user mode

7. How to kick a user who is already logged into the system? And prevent them from logging in again?
1. Kick out suspicious root login users and immediately change the password
2. sshd---》/etc/hosts.deny hosts.allow -->ip 
3. /etc/ssh/sshd_config -->DenyUsers -->user

8. How to turn a regular user into a root user?
1. (Not recommended) Modify the /etc/passwd file, find the regular user to be modified, and change the user ID to 0
2. Use sudo privileges

·  Create directories /tech/cali and /tech/sanle, respectively for storing the home directories of user accounts in the project groups;
·  Add group accounts cali and sanle for the two project groups, with GID numbers 1001 and 1002 respectively; add a group account tech for the technical department, with GID number 200;
·  Add 2 users, b1 and b2, requiring their primary group to be cali, additional group to be tech, and home directories to use folders named after their accounts in the /tech/cali directory (e.g., the home directory for user b1 is /tech/cali/b1); set the b2 user account to expire after 2012-12-31;
·  Add 2 users, a1 and a2, requiring their primary group to be sanle, additional group to be tech; home directories to use folders named after their accounts in the /tech/sanle directory (e.g., the home directory for user a1 is /tech/sanle/a1); set the login shell for user a2 to /bin/ksh.
All newly created user passwords are 123456;

1. mkdir -p  /tech/cali /tech/sanle
2. groupadd -g 1001 cali  
     groupadd -g 1002 sanle
     groupadd -g 200 tech
3. useradd -g cali -G tech -d /tech/cali/b1 b1
     useradd -g cali -G tech -d /tech/cali/b2 -e 2020-11-6 b2
4. useradd -g sanle -G tech -d /tech/sanle/a1 a1
     useradd -g sanle -G tech -d /tech/sanle/a2 -s /bin/ksh a2
5. echo 123456|passwd a1 --stdin
     echo 123456|passwd a2 --stdin
----------------------------------------------------------------
Example: Expired accounts cannot log in
-----------------------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# useradd -e "2012-11-22" sanle3	# Note: Expired accounts cannot log in
[root@sanchuang-linux ~]# su - sanle3						# Note: Can switch, cannot log in
[sanle3@sanchuang-linux ~]$ 

Example
---------------------------------------------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# useradd -g sanchuang4 -G sanchuang5 sanchuang10
[root@sanchuang-linux ~]# useradd -g sanchuang4 -G sanchuang5 sanchuang12
[root@sanchuang-linux ~]# useradd -g sanchuang5 -G sanchuang4 sanchuang13
[root@sanchuang-linux ~]# cat /etc/group
sanchuang4:x:1100:sanchuang13					# Note: Only shows the member list of the secondary group
sanchuang5:x:1200:sanchuang10,sanchuang12		# Note: Only shows the member list of the secondary group
# Note: Group account name: sanchuang5; GID: 1200; member list sanchuang10,sanchuang12
# Note: Only shows the member list of the secondary group
===========================================================================================================
Example: How to check which users are in a group
---------------------------------------------------------------------------------------------------------------------------------
# Note: Relate to 2 files /etc/passwd /etc/group
[root@sanchuang-linux ~]# awk -F: '/sanchuang5/{print $3,$4}' /etc/group	
1200 sanchuang10,sanchuang12				# Note: Fuzzy matching, matches lines containing sanchuang5
[root@sanchuang-linux ~]# awk -F: '$1=="sanchuang5"{print $3,$4}' /etc/group	# Note: Add quotes
1200 sanchuang10,sanchuang12				# Note: Exact match
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# vim group_member.sh
#!/bin/bash
group_name=$1           # Note: Group name as parameter
#/etc/group to get its GID and member list
group_msg=`awk -F: -v group_awk=$group_name '$1==group_awk{print $3,$4}' /etc/group`
echo $group_msg # Note: -v option passes shell variable to awk, assigns external $group_name to awk internal variable, used with custom variable during execution
[root@sanchuang-linux ~]# sh group_member.sh sanchuang5
1200 sanchuang10,sanchuang12
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# a='1200 sanchuang10,sanchuang12'
[root@sanchuang-linux ~]# s1=(a b c d e)
[root@sanchuang-linux ~]# s2=($a)			# Note: Convert to array
[root@sanchuang-linux ~]# echo $s2
1200
[root@sanchuang-linux ~]# echo $s2[@]
1200[@]
[root@sanchuang-linux ~]# echo ${s2[@]}		# Note: Get all elements in the array
1200 sanchuang10,sanchuang12
[root@sanchuang-linux ~]# echo ${#s2[@]}	# Note: Get array length
2
[root@sanchuang-linux ~]# echo ${#s2}		# Note: Get the length of the first element
4
[root@sanchuang-linux ~]# echo ${s2[0]}		# Note: Get the first element in the array
1200
[root@sanchuang-linux ~]# echo ${s2[1]}		# Note: Get the second element in the array
sanchuang10,sanchuang12
-----------------------------------------
group_name=$1           # Note: Group name as parameter
#/etc/group to get its GID and member list
group_msg=`awk -F: -v group_awk=$group_name '$1==group_awk{print $3,$4}' /etc/group`
# Note: -v option passes shell variable to awk, assigns external $group_name to awk internal variable, used with custom variable during execution
# Note: Get the first element in the array
group_lst=($group_msg)  # Note: Convert to array
group_id=${group_lst[0]}		# Note: gid
group_user_1=${group_lst[1]}	# Note: Members of that group (secondary group)
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# vim group_member.sh
#!/bin/bash
  
group_name=$1           # Note: Group name as parameter
#/etc/group to get its GID and member list
group_msg=`awk -F: -v group_awk=$group_name '$1==group_awk{print $3,$4}' /etc/group`
# Note: -v option passes shell variable to awk, assigns external $group_name to awk internal variable, used with custom variable during execution
# Note: Get the first element in the array
group_lst=($group_msg)  # Note: Convert to array
group_id=${group_lst[0]}
group_user_1=${group_lst[1]}
# Note: Get /etc/passwd primary group members; tr "\n" "," specifies the delimiter as ,; filter out lines where $4==group_id
group_user_2=`awk -F: -v group_id=$group_id '$4==group_id{print $1}' /etc/passwd|tr "\n" ","`
echo $group_user_2$group_user_1		# Note: Directly concatenate, no need to add “+” sign
[root@sanchuang-linux ~]# sh group_member.sh sanchuang5
sanchuang13,sanchuang10,sanchuang12
--------------------------------------------------------
[root@sanchuang-linux ~]# cat /etc/passwd
sanchuang13:x:1034:1200::/home/sanchuang13:/bin/bash	# Note: gid position $4
===========================================================================================================
Summary: How to view which members are in a group
# Shell and awk parameter passing:
https://blog.csdn.net/imzoer/article/details/8738581
[root@sanchuang-linux ~]# cat group_member2.sh
#!/bin/bash

group_name=$1
group_msg=`awk -F: -v group_awk=$group_name '$1==group_awk{print $3,$4}' /etc/group`
group_lst=($group_msg)			# Note: awk -v option defines parameters, passing variables to awk
group_id=${group_lst[0]}		# Note: () brackets convert characters into an array, default split by space, get 1,2 elements
group_user_1=${group_lst[1]}
group_user_2=`awk -F: -v group_id=$group_id '$4==group_id{print $1}' /etc/passwd| tr "\n" ","`
echo $group_user_2$group_user_1						# Note: Replace newline with comma
[root@sanchuang-linux ~]# sh group_member2.sh sanchuang5
sanchuang13,sanchuang10,sanchuang12

--------------------------------------------------------------------------------------------
Command line
[root@sanchuang-linux ~]# less /etc/group
sanchuang5:x:1200:sanchuang10,sanchuang12
[root@sanchuang-linux ~]# awk -F: '$1=="sanchuang5"{print $3}' /etc/group
1200									# Note: Add quotes, indicates a string
[root@sanchuang-linux ~]# awk -F: '$1=="sanchuang5"{print $3,$4}' /etc/group
1200 sanchuang10,sanchuang12			# Note: Group id	secondary group members
[root@sanchuang-linux ~]# awk -F: '$4==1200{print $1}' /etc/passwd
sanchuang13								# Note: Get the usernames of members when primary group
group_user_2=`awk -F: -v group_id=$group_id '$4==group_id{print $1}' /etc/passwd| tr "\n" ","`
# Note: Replace newline with comma
--------------------------------------------------------------------------------------------
String slicing				# Note: Not accurate, gid may be 5 digits
[root@sanchuang-linux ~]# result=`awk -F: '$1=="sanchuang5"{print $3,$4}' /etc/group`
[root@sanchuang-linux ~]# echo ${result:0:4}
1200
[root@sanchuang-linux ~]# echo ${result#* }
sanchuang10,sanchuang12
[root@sanchuang-linux ~]# echo ${result:5}
sanchuang10,sanchuang12
[root@sanchuang-linux ~]# echo ${result%% *}
1200
---------------------------
String slicing:
# String operations
line=`head -n1 /etc/passwd`
echo "The string is: $line"
echo 'The string is: $line'
echo "Extracting the first 4 characters:"
echo ${line:0:4}
echo "Extracting the last 9 characters:"
echo ${line:0-9}
echo "Extracting 4 characters starting from the ninth last character"
echo ${line:0-9:4}
echo "Extracting the last character from the right after the last :"
echo ${line##*:}
echo "Extracting the first character from the left after the first :"
echo ${line#*:}
echo "Extracting the last character from the right before the last :"
echo ${line%%:*}
echo "Extracting the first character from the right before the first :"
echo ${line%:*}
echo "String length"
echo ${#line}
--------------------------------------------------------------------------------------------
For loop to get
[root@sanchuang-linux lianxi]# vim user.sh
result=`awk -F: '$1=="sanchuang5"{print $3,$4}' /etc/group`
for i in $result
do
    echo $i
done
[root@sanchuang-linux lianxi]# bash user.sh 
1200
sanchuang10,sanchuang12
[root@sanchuang-linux ~]# result=`awk -F: '$1=="sanchuang5"{print $3,$4}' /etc/group`
------------------------------------------------------------
[root@sanchuang-linux ~]# for i in $result; do echo $i; done
1200
sanchuang10,sanchuang12

Example: groupadd groupdel
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# groupadd -g 5000 sanle	# Note: Create group sanle with gid 5000
[root@sanchuang-linux ~]# less /etc/group			#↑Note: Added group account sanle
sanle:x:5000:
[root@sanchuang-linux ~]# groupdel sanle			# Note: Deleted group account sanle
[root@sanchuang-linux ~]# less /etc/group			# Note: No longer exists

Example: newgrp changes effective group
--------------------------------------------------------------------------------------------
[root@sanchuang-linux lianxi]# ll				# Note: ll to view detailed directory information
-rw-r--r--. 1 root root      86 Sep  25 14:23 abcd.txt
-rw-r--r--. 1 root root     158 Sep  25 09:47 backup_log.sh
# Note: The first root is the file owner
# Note: The second root is the file group
---------------------------------------------------
[root@sanchuang-linux lianxi]# newgrp sanchuang4
[root@sanchuang-linux lianxi]# touch aa
[root@sanchuang-linux lianxi]# ll
-rw-r--r--  1 root sanchuang4       0 Nov  6 11:25 bb		# Note: Group ownership changed
---------------------------------------------------
[root@sanchuang-linux lianxi]# su - sanchuang10
[root@sanchuang-linux lianxi]# touch cc
[sanchuang10@sanchuang-linux ~]$ ll
Total 0
-rw-r--r-- 1 sanchuang10 sanchuang4 0 Nov  6 11:27 cc
[sanchuang10@sanchuang-linux ~]$ newgrp sanchuang	# Note: Ordinary users want to switch effective groups, must have this ordinary user in the effective group
Password:
newgrp: failed to crypt password with previous salt: Invalid argument
# Note: Ordinary users want to switch effective groups, must have this ordinary user in the effective group

Example: Remove group member root
--------------------------------------------------------------------------------------------
[root@localhost ~]# gpasswd -d root market
Removing user "root" from group "market"

Example: Set group account password
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# gpasswd sanchuang
Modifying password for group sanchuang
New password:
Please re-enter new password:
[root@sanchuang-linux ~]# 

Example: md5sum
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# echo "123456"|md5sum 	# Note: md5sum is also a hash algorithm
f447b20a7fcbf53a5d5be013ea0b15af  -				# Note: Regardless of the input, it will return a fixed-length output
[root@sanchuang-linux ~]# echo "123456xyzzzzz"|md5sum 	# Note: One-way encryption algorithm
bcdd6694d1ece311bd7bd668da54b9b9  -
[root@sanchuang-linux ~]# echo "xxxxxxxxxxxxxxxxxxxxxxxx"|md5sum
7373d8394616d74ba2c42402266ae3aa  -

[root@sanchuang-linux tmp]# md5sum douban		# Note: Encrypting a file
816ba8dd29e68f3450d8748096227d42  douban		# Note: Any file input will have a corresponding length output
[root@sanchuang-linux tmp]# md5sum sucai8
9a44802fc09e1b84dc94740c40aa6450  sucai8

Example: Brute force attack with salt
--------------------------------------------------------------------------------------------
# Note: Brute force attack
[root@sanchuang-linux ~]# echo "123456"|md5sum		# Note: Same encrypted string, same hash output
f447b20a7fcbf53a5d5be013ea0b15af  -
[root@sanchuang-linux ~]# echo "123456"|md5sum
f447b20a7fcbf53a5d5be013ea0b15af  -
# Note: Adding salt		# Note: Improve password security
[root@sanchuang-linux ~]# echo "123456xndfoaei242"|md5sum	# Note: xndfoaei242 is the salt
15465f7aa2929cca95ed7efb97ffeba0  -

Example
--------------------------------------------------------------------------------------------
root:$6$i4J5vzOUIMpchLRj$nTCbYWgA5cpv34Set6R2ZmC1AYYHGHnQafNbA9fkFsTR0E9GG1BJP5o3OTMuC4kGUqsomCI/G8FdEVELI/aeq0::0:99999:7:::

Password field: $encryption algorithm id$salt$actual ciphertext
The encryption is implemented using the kernel's crypt function

Python implementation (sha512)
>>> import crypt
>>> crypt.crypt('123456','$6$i4J5vzOUIMpchLRj')	# Note: $encryption algorithm id$salt, ciphertext is the same as above
'$6$i4J5vzOUIMpchLRj$nTCbYWgA5cpv34Set6R2ZmC1AYYHGHnQafNbA9fkFsTR0E9GG1BJP5o3OTMuC4kGUqsomCI/G8FdEVELI/aeq0'		# Note: Matches the ciphertext above
-----------------------------------------
$6 						represents sha512 algorithm
$i4J5vzOUIMpchLRj 		salt
$nTCbYWgA5cpv……aeq0 	actual ciphertext

Hash algorithm usage: Used to determine if the md5 value of a file has changed

Example
[root@sanchuang-linux ~]# vim /etc/login.defs 
MAIL_DIR        /var/spool/mail		# Note: Set default address
PASS_MAX_DAYS   99999				# Note: Password expiration days
PASS_MIN_DAYS   0
PASS_MIN_LEN    5
PASS_WARN_AGE   7
UID_MIN                  1000

Example: Home directory configuration
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# less .bash_profile 
# .bash_profile
if [ -f /etc/bashrc ]; then		# Note: Check if /etc/bashrc exists, if so, execute /etc/bashrc
        . /etc/bashrc			# Note: /etc/bashrc executes the initialization user environment settings
fi								# Note: Use . to execute, . represents the current bash
PATH=$PATH:$HOME/bin

export PATH

[root@localhost ~]# less .bashrc 
# .bashrc
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
if [ -f /etc/bashrc ]; then
        . /etc/bashrc					# Note: Ultimately executes this file
fi
[root@sanchuang-linux ~]# which ls		# Note: ls executes /usr/bin/ls, finds through the PATH environment variable from front to back
alias ls='ls --color=auto'
	/usr/bin/ls

============================================================================================
Example: .bash_history records the history of commands used before the last logout
.bash_history stores the current user's command history, when a user logs in for the first time, this file will not be generated
The first login will automatically write the history from memory to the .bash_history file upon logout

[root@sanchuang-linux ~]# history				# Note: history just views the current user's command history

# Note: User command history is only written to .bash_history upon logout
# Note: When a new user is created, .bash_history file will not be generated, it will only be generated after logging out and logging in again
# Note: Not all commands are written to history, it's not very accurate

[root@sanchuang-linux ~]# cat .bash_history 	# Note: View the .bash_history file in the current user's home directory

Steps
1. In the sanchuang user, modify the .bash_profile file, add		# Note: Because this file is executed every time logging in
now_date=`date`
echo $now_date"login..." >> /tmp/sanchuang_log
2. In the sanchuang user, modify the .bash_logout file, add			# Note: Because this file is executed every time logging out
now_date=`date`
echo $now_date"logout..." >> /tmp/sanchuang_log
3. Monitor file changes, new lines added at the end								# Note: Often use tail -f to monitor files
$ tail -f /tmp/sanchuang_log	# Note: tail -f monitors changes at the end of the file (newly added lines)

Example
--------------------------------------------------------------------------------------------
[root@sanchuang-linux log]# su - sanchuang					# Note: Ordinary user operates in their own home directory
Last login: Fri Nov  6 14:59:23 CST 2020pts/1 on
[sanchuang@sanchuang-linux ~]$ vim ~/.bash_profile 			# Note: Operate on the .bash_profile in the home directory
now_date=`date`
echo $now_date"login..." >> /tmp/sanchuang_log
[sanchuang@sanchuang-linux ~]$ tail -f /tmp/sanchuang_log	# Note: tail -f monitors changes at the end of the file
2020-11-06 15:05:26 CSTlogin...
[sanchuang@sanchuang-linux ~]$ vim ~/.bash_logout 
now_date=`date`
echo $now_date"logout..." >> /tmp/sanchuang_log
[sanchuang@sanchuang-linux ~]$ tail -f /tmp/sanchuang_log	# Note: tail -f monitors changes at the end of the file
2020-11-06 15:05:26 CSTlogin...
2020-11-06 15:07:33 CSTlogout...

Example: w who
--------------------------------------------------------------------------------------------
[root@sanchuang-linux ~]# w		# Note: Shows which user you logged in as, not the current user you switched to
 15:26:24 up  6:11,  6 users,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     tty1     -                Thu15   58:07   0.07s  0.07s -bash		# Note: tty real terminal
root     pts/0    192.168.0.42     14:28    0.00s  0.18s  0.01s w		 # Note: Remote login pts virtual terminal
root     pts/1    192.168.0.42     14:28   12:24   0.07s  0.01s -bash
# Note: Real terminal FORM is empty
# Note: Virtual terminal shows the physical machine's IP address
# Note: WHAT shows what is currently being done in the environment
# Note: 15:26:24 Current time
# Note: 6:11		Total uptime
# Note: 6 users	Number of logged-in users
# Note: load average	 Average CPU load, the higher the number, the busier the machine
--------------------------------------------------------------
[root@sanchuang-linux ~]# who			# Note: Less detailed than w
root     tty1         2020-11-05 15:13
root     pts/0        2020-11-06 14:28 (192.168.0.42)
root     pts/1        2020-11-06 14:28 (192.168.0.42)
------------------------------------------------------------------
[root@sanchuang-linux ~]# users			# Note: Check which users are currently logged in
root root root root root root
---------------------------------------------------------------------------------
[root@sanchuang-linux ~]# groups sanchuang10	# Note: Shows the user's primary and supplementary groups
sanchuang10 : sanchuang4 sanchuang5
[root@sanchuang-linux ~]# id sanchuang10
uid=1032(sanchuang10) gid=1100(sanchuang4)  groups=1100(sanchuang4),1200(sanchuang5)
--------------------------------------------------------------------------------
[root@sanchuang-linux ~]# last		# Note: View which users have logged in before
root     tty1                          Wed Sep 16 13:41 - 13:41  (00:00)
root     pts/0        192.168.136.1    Wed Sep 16 13:29 - 13:40  (00:11)
reboot   system boot  4.18.0-193.el8.x Wed Sep 16 13:26 - 13:42  (00:15)
[root@sanchuang-linux ~]# lastlog 	# Note: View the last login status of each user
Username           Port     From             Last login time
root             pts/0                     Fri Nov  6 15:18:46 +0800 2020
bin                                        **Never logged in**
shutdown                                   **Never logged in**