mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-23 21:20:42 +08:00
translated
This commit is contained in:
Brooke Lau
parent
4f1536686a
commit
243e8f0246
@ -7,59 +7,55 @@
|
||||
[#]: via: (https://opensource.com/article/19/10/linux-useradd-command)
|
||||
[#]: author: (Alan Formy-Duval https://opensource.com/users/alanfdoss)
|
||||
|
||||
Intro to the Linux useradd command
|
||||
Linux useradd 命令介绍
|
||||
======
|
||||
Add users (and customize their accounts as needed) with the useradd
|
||||
command.
|
||||
使用 useradd 命令来添加用户（并且根据需要修改账号）。
|
||||
![people in different locations who are part of the same team][1]
|
||||
|
||||
Adding a user is one of the most fundamental exercises on any computer system; this article focuses on how to do it on a Linux system.
|
||||
任何计算机系统中，添加用户都是最重要的事之一；本文着重介绍如何在 Linux 系统中添加用户。
|
||||
|
||||
Before getting started, I want to mention three fundamentals to keep in mind. First, like with most operating systems, Linux users need an account to be able to log in. This article specifically covers local accounts, not network accounts such as LDAP. Second, accounts have both a name (called a username) and a number (called a user ID). Third, users are typically placed into a group. Groups also have a name and group ID.
|
||||
|
||||
As you'd expect, Linux includes a command-line utility for adding users; it's called **useradd**. You may also find the command **adduser**. Many distributions have added this symbolic link to the **useradd** command as a matter of convenience.
|
||||
正式开始之前，我先提三个概念。首先，跟大多数操作系统一样，Linux 用户也需要一个账号才能登录。本文只介绍本地账号，不涉及网络账号，如 LDAP。其次，每个账号都有一个名字（username）和一个对应的数字（用户 ID）。最后，每个用户通常都在一个组内，每个组都有一个名字和一个组 ID。
|
||||
|
||||
你可能已经想到了，Linux 提供了添加用户的命令行工具，就是 `useradd` 命令。有些版本也叫 `adduser`。为了方便使用，很多发行版上这个命令是一个指向 `useradd` 命令的符号链接。
|
||||
|
||||
```
|
||||
$ file `which adduser`
|
||||
/usr/sbin/adduser: symbolic link to useradd
|
||||
```
|
||||
|
||||
Let's take a look at **useradd**.
|
||||
来看一下 `useradd`。
|
||||
|
||||
> Note: The defaults described in this article reflect those in Red Hat Enterprise Linux 8.0. You may find subtle differences in these files and certain defaults on other Linux distributions or other Unix operating systems such as FreeBSD or Solaris.
|
||||
> 注意：本文描述的默认环境是 Red Hat Enterprise Linux 8.0。你可能会发现本文描述的这些文件和某些默认值与某些 Linux 发行版或其他 Unix 操作系统（FreeBSD 或 Solaris）偶尔会有差异。
|
||||
|
||||
### Default behavior
|
||||
### 默认处理
|
||||
|
||||
The basic usage of **useradd** is quite simple: A user can be added just by providing their username.
|
||||
`useradd` 的基本用法相当简单：通过一个用户名就可以添加一个用户
|
||||
|
||||
|
||||
```
|
||||
`$ sudo useradd sonny`
|
||||
```bash
|
||||
$ sudo useradd sonny
|
||||
```
|
||||
|
||||
In this example, the **useradd** command creates an account called _sonny_. A group with the same name is also created, and _sonny_ is placed in it to be used as the primary group. There are other parameters, such as language and shell, that are applied according to defaults and values set in the configuration files **/etc/default/useradd** and **/etc/login.defs**. This is generally sufficient for a single, personal system or a small, one-server business environment.
|
||||
在本例中，`useradd` 命令创建了一个名为 *sonny* 的账号。此命令同时创建了一个同名的组，*sonny* 被放进了这个组，这个组也是 *sonny* 账号的主组。命令执行时，根据配置文件 `/etc/default/useradd` 和 `/etc/login.defs` 中的不同设置，也会有其他的参数处理，如语言和 shell。对于一个私人系统或微小的单服务商业环境，这些参数已经足够了。
|
||||
|
||||
While the two files above govern the behavior of **useradd**, user information is stored in other files found in the **/etc** directory, which I will refer to throughout this article.
|
||||
上面两个文件控制 `useradd` 的处理，用户的信息保存在 `/etc` 目录下的一些其他文件中，关于这些信息的讲解会贯穿全文。
|
||||
|
||||
File | Description | Fields (bold—set by useradd)
|
||||
---|---|---
|
||||
passwd | Stores user account details | **username**:unused:**uid**:**gid**:**comment**:**homedir**:**shell**
|
||||
shadow | Stores user account security details | **username**:password:lastchange:minimum:maximum:warn:**inactive**:**expire**:unused
|
||||
group | Stores group details | **groupname**:unused:**gid**:**members**
|
||||
| 文件 | 描述 | 域 (加粗的表示由 useradd 命令设置) |
|
||||
| ------ | ------------------------------------ | ------------------------------------------------------------ |
|
||||
| passwd | Stores user account details | **username**:unused:**uid**:**gid**:**comment**:**homedir**:**shell** |
|
||||
| shadow | Stores user account security details | **username**:password:lastchange:minimum:maximum:warn:**inactive**:**expire**:unused |
|
||||
| group | Stores group details | **groupname**:unused:**gid**:**members** |
|
||||
|
||||
### Customizable behavior
|
||||
### 自定义处理
|
||||
|
||||
The command line allows customization for times when an administrator needs finer control, such as to specify a user's ID number.
|
||||
当管理员需要更好地控制账号时，可以使用命令行来自定义，如指定一个用户的 ID。
|
||||
|
||||
#### User and group ID numbers
|
||||
#### 用户和组 ID
|
||||
|
||||
By default, **useradd** tries to use the same number for the user ID (UID) and primary group ID (GID), but there are no guarantees. Although it's not necessary for the UID and GID to match, it's easier for administrators to manage them when they do.
|
||||
`useradd` 默认主组 ID（GID）与用户 ID（UID）相同，但也不完全是。虽然 UID 与 GID 相同不是必须的，但如果相同，会更方便管理员管理。
|
||||
|
||||
I have just the scenario to explain. Suppose I add another account, this time for Timmy. Comparing the two users, _sonny_ and _timmy_, shows that both users and their respective primary groups were created by using the **getent** command.
|
||||
下面的场景就是一个 GID 与 UID 不同的 例子。现在我添加另一账号，名为 Timmy。通过使用 `getent` 命令来比较 *sonny* 和 *timmy* 两个账号，显示两个用户和对应的主组。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ getent passwd sonny timmy
|
||||
sonny❌1001:1002:Sonny:/home/sonny:/bin/bash
|
||||
timmy❌1002:1003::/home/timmy:/bin/bash
|
||||
@ -69,18 +65,16 @@ sonny❌1002:
|
||||
timmy❌1003:
|
||||
```
|
||||
|
||||
Unfortunately, neither users' UID nor primary GID match. This is because the default behavior is to assign the next available UID to the user and then attempt to assign the same number to the primary group. However, if that number is already used, the next available GID is assigned to the group. To explain what happened, I hypothesize that a group with GID 1001 already exists and enter a command to confirm.
|
||||
不幸的是，两者的 UID 和 GID 都不相同。因为默认的处理是，创建用户时，把下一个可用的 UID 赋给用户，然后把同一个数字作为主组 ID 赋给它。然而，当要使用的 ID 已经被使用时，就再把下一个可用的 GID 赋给它。为了弄清细节，我猜想 1001 这个 GID 已经被使用了，用一个命令确认了一下。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ getent group 1001
|
||||
book❌1001:alan
|
||||
```
|
||||
|
||||
The group _book_ with the ID _1001_ has caused the GIDs to be off by one. This is an example where a system administrator would need to take more control of the user-creation process. To resolve this issue, I must first determine the next available user and group ID that will match. The commands **getent group** and **getent passwd** will be helpful in determining the next available number. This number can be passed with the **-u** argument.
|
||||
*book* 的 ID 是 *1001*，因此新创建的用户的 GID 都有偏移量 1。这就是为什么系统管理员在用户创建过程中需要多设置一些值的一个实例。为了解决这个问题，我必须先确定下一个可用的 UID 和 GID 是否相同。确定下一个可用值时，可以使用 `getent group` 和 `getent passwd` 命令，通过 `-u` 参数传递要确认的值。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -u 1004 bobby
|
||||
|
||||
$ getent passwd bobby; getent group bobby
|
||||
@ -88,64 +82,59 @@ bobby❌1004:1004::/home/bobby:/bin/bash
|
||||
bobby❌1004:
|
||||
```
|
||||
|
||||
Another good reason to specify the ID is for users that will be accessing files on a remote system using the Network File System (NFS). NFS is easier to administer when all client and server systems have the same ID configured for a given user. I cover this in a bit more detail in my article on [using autofs to mount NFS shares][2].
|
||||
另一个需要指定 ID 的场景是，通过 NFS 访问远程系统上的文件时。对于一个给定的用户，当 NFS 所有客户端和服务系统的 ID 都一样时，管理员更容易控制。在我的文章 [使用 autofs 挂载 NFS][2] 中有详细介绍。
|
||||
|
||||
### More customization
|
||||
### 更多自定义
|
||||
|
||||
Very often though, other account parameters need to be specified for a user. Here are brief examples of the most common customizations you may need to use.
|
||||
一些其他的指定用户信息的参数也用得比较频繁。这里是一些你会经常用到的参数的概括例子。
|
||||
|
||||
#### Comment
|
||||
#### 注释
|
||||
|
||||
The comment option is a plain-text field for providing a short description or other information using the **-c** argument.
|
||||
注释选项是通过 `-c` 参数指定的一个解释文本字段，可以提供一段简短的描述或其他信息。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -c "Bailey is cool" bailey
|
||||
$ getent passwd bailey
|
||||
bailey❌1011:1011:Bailey is cool:/home/bailey:/bin/bash
|
||||
```
|
||||
|
||||
#### Groups
|
||||
#### 组
|
||||
|
||||
A user can be assigned one primary group and multiple secondary groups. The **-g** argument specifies the name or GID of the primary group. If it's not specified, **useradd** creates a primary group with the user's same name (as demonstrated above). The **-G** (uppercase) argument is used to pass a comma-separated list of groups that the user will be placed into; these are known as secondary groups.
|
||||
一个用户可以被指定一个主组和多个次组。 `-g` 参数指定主组名称或 GID。如果不指定，`useradd` 会以用户名创建一个主组（前面演示过）。`-G`（大写）参数用一个逗号分隔的组列表来指定此用户所属的组，这些组就是次组。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -G tgroup,fgroup,libvirt milly
|
||||
$ id milly
|
||||
uid=1012(milly) gid=1012(milly) groups=1012(milly),981(libvirt),4000(fgroup),3000(tgroup)
|
||||
```
|
||||
|
||||
#### Home directory
|
||||
#### 家目录
|
||||
|
||||
The default behavior of **useradd** is to create the user's home directory in **/home**. However, different aspects of the home directory can be overridden with the following arguments. The **-b** sets another directory where user homes can be placed. For example, **/home2** instead of the default **/home**.
|
||||
`useradd` 的默认处理是，在 `/home` 目录下创建用户的家目录。然而，下面的参数可以改写家目录的 base 目录。`-b` 设置另一个可以创建家目录的 base 目录。例如 指定 `/home2` 而不是 `/home`。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -b /home2 vicky
|
||||
$ getent passwd vicky
|
||||
vicky❌1013:1013::/home2/vicky:/bin/bash
|
||||
```
|
||||
|
||||
The **-d** lets you specify a home directory with a different name from the user.
|
||||
`-d` 参数可以指定一个与用户名不同的家目录。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -d /home/ben jerry
|
||||
$ getent passwd jerry
|
||||
jerry❌1014:1014::/home/ben:/bin/bash
|
||||
```
|
||||
|
||||
#### The skeleton directory
|
||||
#### skeleton 目录
|
||||
|
||||
The **-k** instructs the new user's new home directory to be populated with any files in the **/etc/skel** directory. These are usually shell configuration files, but they can be anything that a system administrator would like to make available to all new users.
|
||||
`-k` 参数指定创建新用户时，会复制 `/etc/skel` 目录下的所有文件到家目录中。这些文件通常是 shell 配置文件，当然也可以是系统管理员想在新建用户时使用的任何文件。
|
||||
|
||||
#### Shell
|
||||
|
||||
The **-s** argument can be used to specify the shell. The default is used if nothing else is specified. For example, in the following, shell **bash** is defined in the default configuration file, but Wally has requested **zsh**.
|
||||
`-s` 参数可以指定 shell。如果不指定，则使用默认的 shell。例如，下面的例子中 ，配置文件中定义的 shell 是 `bash`，但 `Wally` 这个用户指定的是 `zsh`。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ grep SHELL /etc/default/useradd
|
||||
SHELL=/bin/bash
|
||||
|
||||
@ -154,42 +143,38 @@ $ getent passwd wally
|
||||
wally❌1004:1004::/home/wally:/usr/bin/zsh
|
||||
```
|
||||
|
||||
#### Security
|
||||
#### 安全
|
||||
|
||||
Security is an essential part of user management, so there are several options available with the **useradd** command. A user account can be given an expiration date, in the form YYYY-MM-DD, using the **-e** argument.
|
||||
安全是用户管理的重中之重，因此 `useradd` 命令也提供了很多关于安全的选项。可以使用 `-e` 参数，以 YYYY-MM-DD 的格式指定一个用户的过期时间。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -e 20191231 sammy
|
||||
$ sudo getent shadow sammy
|
||||
sammy:!!:18171:0:99999:7::20191231:
|
||||
```
|
||||
|
||||
An account can also be disabled automatically if the password expires. The **-f** argument will set the number of days after the password expires before the account is disabled. Zero is immediate.
|
||||
当密码过期时，一个账号也可以自动失效。`-f` 参数指定密码过期后经过几天账号失效。如果设为 0，则立即失效。
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -f 30 willy
|
||||
$ sudo getent shadow willy
|
||||
willy:!!:18171:0:99999:7:30::
|
||||
```
|
||||
|
||||
### A real-world example
|
||||
### 实例
|
||||
|
||||
In practice, several of these arguments may be used when creating a new user account. For example, if I need to create an account for Perry, I might use the following command:
|
||||
生产中，创建一个用户账号时会用到多个参数。例如，我要创建一个 Perry 账号，可能会用下面的命令：
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ sudo useradd -u 1020 -c "Perry Example" \
|
||||
-G tgroup -b /home2 \
|
||||
-s /usr/bin/zsh \
|
||||
-e 20201201 -f 5 perry
|
||||
```
|
||||
|
||||
Refer to the sections above to understand each option. Verify the results with:
|
||||
查看前面的内容来理解每个选项。用下面的命令确认结果：
|
||||
|
||||
|
||||
```
|
||||
```bash
|
||||
$ getent passwd perry; getent group perry; getent shadow perry; id perry
|
||||
perry❌1020:1020:Perry Example:/home2/perry:/usr/bin/zsh
|
||||
perry❌1020:
|
||||
@ -197,9 +182,9 @@ perry:!!:18171:0:99999:7:5:20201201:
|
||||
uid=1020(perry) gid=1020(perry) groups=1020(perry),3000(tgroup)
|
||||
```
|
||||
|
||||
### Some final advice
|
||||
### 一点小建议
|
||||
|
||||
The **useradd** command is a "must-know" for any Unix (not just Linux) administrator. It is important to understand all of its options since user creation is something that you want to get right the first time. This means having a well-thought-out naming convention that includes a dedicated UID/GID range reserved for your users across your enterprise, not just on a single system—particularly when you're working in a growing organization.
|
||||
`useradd` 命令是所有 Unix（不仅仅是 Linux）系统管理员都必知必会的命令。由于用户创建不能出错，需要第一次就正确，所以理解它的每一个选项很重要。这意味着你需要有一套深思熟虑的命名约定，包括为整个企业环境而不仅仅是一个单系统预留一个专用的 UID/GID 范围，尤其是你为一个成长中的组织工作时。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user