mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-23 21:20:42 +08:00
Wenxuan Zhao
commit
3f772bd2ab
@ -1,168 +0,0 @@
|
||||
translating---imquanquan
|
||||
|
||||
How to Manage Users with Groups in Linux
|
||||
============================================================
|
||||
|
||||
### [group-of-people-1645356_1920.jpg][1]
|
||||
|
||||
|
||||
|
||||
Learn how to work with users, via groups and access control lists in this tutorial.
|
||||
|
||||
[Creative Commons Zero][4]
|
||||
|
||||
Pixabay
|
||||
|
||||
When you administer a Linux machine that houses multiple users, there might be times when you need to take more control over those users than the basic user tools offer. This idea comes to the fore especially when you need to manage permissions for certain users. Say, for example, you have a directory that needs to be accessed with read/write permissions by one group of users and only read permissions for another group. With Linux, this is entirely possible. To make this happen, however, you must first understand how to work with users, via groups and access control lists (ACLs).
|
||||
|
||||
We’ll start from the beginning with users and work our way to the more complex ACLs. Everything you need to make this happen will be included in your Linux distribution of choice. We won’t touch on the basics of users, as the focus on this article is about groups.
|
||||
|
||||
For the purpose of this piece, I’m going to assume the following:
|
||||
|
||||
You need to create two users with usernames:
|
||||
|
||||
* olivia
|
||||
|
||||
* nathan
|
||||
|
||||
You need to create two groups:
|
||||
|
||||
* readers
|
||||
|
||||
* editors
|
||||
|
||||
Olivia needs to be a member of the group editors, while nathan needs to be a member of the group readers. The group readers needs to only have read permission to the directory /DATA, whereas the group editors needs to have both read and write permission to the /DATA directory. This, of course, is very minimal, but it will give you the basic information you need to expand the tasks to fit your much larger needs.
|
||||
|
||||
I’ll be demonstrating on the Ubuntu 16.04 Server platform. The commands will be universal—the only difference would be if your distribution of choice doesn’t make use of sudo. If this is the case, you’ll have to first su to the root user to issue the commands that require sudo in the demonstrations.
|
||||
|
||||
### Creating the users
|
||||
|
||||
The first thing we need to do is create the two users for our experiment. User creation is handled with the useradd command. Instead of just simply creating the users we need to create them both with their own home directories and then give them passwords.
|
||||
|
||||
The first thing we do is create the users. To do this, issue the commands:
|
||||
|
||||
```
|
||||
sudo useradd -m olivia
|
||||
|
||||
sudo useradd -m nathan
|
||||
```
|
||||
|
||||
Next each user must have a password. To add passwords into the mix, you’d issue the following commands:
|
||||
|
||||
```
|
||||
sudo passwd olivia
|
||||
|
||||
sudo passwd nathan
|
||||
```
|
||||
|
||||
That’s it, your users are created.
|
||||
|
||||
### Creating groups and adding users
|
||||
|
||||
Now we’re going to create the groups readers and editors and then add users to them. The commands to create our groups are:
|
||||
|
||||
```
|
||||
addgroup readers
|
||||
|
||||
addgroup editors
|
||||
```
|
||||
|
||||
### [groups_1.jpg][2]
|
||||
|
||||
|
||||
|
||||
Figure 1: Our new groups ready to be used.
|
||||
|
||||
[Used with permission][5]
|
||||
|
||||
With our groups created, we need to add our users. We’ll add user nathan to group readers with the command:
|
||||
|
||||
```
|
||||
sudo usermod -a -G readers nathan
|
||||
```
|
||||
|
||||
```
|
||||
sudo usermod -a -G editors olivia
|
||||
```
|
||||
|
||||
### Giving groups permissions to directories
|
||||
|
||||
Let’s say you have the directory /READERS and you need to allow all members of the readers group access to that directory. First, change the group of the folder with the command:
|
||||
|
||||
```
|
||||
sudo chown -R :readers /READERS
|
||||
```
|
||||
|
||||
```
|
||||
sudo chmod -R g-w /READERS
|
||||
```
|
||||
|
||||
```
|
||||
sudo chmod -R o-x /READERS
|
||||
```
|
||||
|
||||
Let’s say you have the directory /EDITORS and you need to give members of the editors group read and write permission to its contents. To do that, the following command would be necessary:
|
||||
|
||||
```
|
||||
sudo chown -R :editors /EDITORS
|
||||
|
||||
sudo chmod -R g+w /EDITORS
|
||||
|
||||
sudo chmod -R o-x /EDITORS
|
||||
```
|
||||
|
||||
The problem with using this method is you can only add one group to a directory at a time. This is where access control lists come in handy.
|
||||
|
||||
### Using access control lists
|
||||
|
||||
Now, let’s get tricky. Say you have a single folder—/DATA—and you want to give members of the readers group read permission and members of the group editors read/write permissions. To do that, you must take advantage of the setfacl command. The setfacl command sets file access control lists for files and folders.
|
||||
|
||||
The structure of this command looks like this:
|
||||
|
||||
```
|
||||
setfacl OPTION X:NAME:Y /DIRECTORY
|
||||
```
|
||||
|
||||
```
|
||||
sudo setfacl -m g:readers:rx -R /DATA
|
||||
```
|
||||
|
||||
To give members of the editors group read/write permissions (while retaining read permissions for the readers group), we’d issue the command;
|
||||
|
||||
```
|
||||
sudo setfacl -m g:editors:rwx -R /DATA
|
||||
```
|
||||
|
||||
### All the control you need
|
||||
|
||||
And there you have it. You can now add members to groups and control those groups’ access to various directories with all the power and flexibility you need. To read more about the above tools, issue the commands:
|
||||
|
||||
* man usradd
|
||||
|
||||
* man addgroup
|
||||
|
||||
* man usermod
|
||||
|
||||
* man sefacl
|
||||
|
||||
* man chown
|
||||
|
||||
* man chmod
|
||||
|
||||
Learn more about Linux through the free ["Introduction to Linux" ][3]course from The Linux Foundation and edX.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linux.com/learn/intro-to-linux/2017/12/how-manage-users-groups-linux
|
||||
|
||||
作者：[Jack Wallen ]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[1]:https://www.linux.com/files/images/group-people-16453561920jpg
|
||||
[2]:https://www.linux.com/files/images/groups1jpg
|
||||
[3]:https://training.linuxfoundation.org/linux-courses/system-administration-training/introduction-to-linux
|
||||
[4]:https://www.linux.com/licenses/category/creative-commons-zero
|
||||
[5]:https://www.linux.com/licenses/category/used-permission
|
||||
@ -0,0 +1,183 @@
|
||||
如何在 Linux 系统中用用户组来管理用户
|
||||
============================================================
|
||||
|
||||
### [group-of-people-1645356_1920.jpg][1]
|
||||
|
||||
|
||||
|
||||
在本教程中了解如何通过用户组和访问控制表（ACL）来管理用户。
|
||||
|
||||
[创意共享协议][4]
|
||||
|
||||
当你需要管理一台容纳多个用户的 Linux 机器时，比起一些基本的用户管理工具所提供的方法，有时候你需要对这些用户采取更多的用户权限管理方式。特别是当你要管理某些用户的权限时，这个想法尤为重要。比如说，你有一个目录，一个用户组中的用户可以通过读和写的权限访问这个目录，而其他用户组中的用户对这个目录只有读的权限。通过 Linux 这是完全可以实现的。但是你首先必须了解如何通过用户组和访问控制表（ACL）来管理用户。
|
||||
|
||||
我们将从简单的用户开始，逐渐深入到复杂的访问控制表（ACL）。你所需要做的一切都将在你选择的 Linux 发行版中完成。本文的重点是用户组，所以不会涉及到关于用户的基础知识。
|
||||
|
||||
为了达到演示的目的，我将假设：
|
||||
|
||||
你需要用下面两个用户名新建两个用户：
|
||||
|
||||
* olivia
|
||||
|
||||
* nathan
|
||||
|
||||
你需要新建以下两个用户组：
|
||||
|
||||
* readers
|
||||
|
||||
* editors
|
||||
|
||||
olivia 属于 editors 用户组，而 nathan 属于 readers 用户组。reader 用户组对 ``/DATA`` 目录只有读的权限，而 editors 用户组则对 ``/DATA`` 目录同时有读和写的权限。当然，这是个非常小的任务，但它会给你基本的用法。你可以扩展这个任务以适应你其他更大的需求。
|
||||
|
||||
我将在 Ubuntu 16.04 Server 平台上进行演示。这些命令都是通用的，唯一不同的是，要是在你的发行版中不使用 sudo 命令，你必须切换到 root 用户来执行这些命令。
|
||||
|
||||
### 创建用户
|
||||
|
||||
我们需要做的第一件事是为我们的实验创建两个用户。可以用 ``useradd`` 命令来创建用户，我们不只是简单地创建一个用户，而需要同时创建用户和属于他们的家目录，然后给他们设置密码。
|
||||
|
||||
```
|
||||
sudo useradd -m olivia
|
||||
|
||||
sudo useradd -m nathan
|
||||
```
|
||||
|
||||
我们现在创建了两个用户，如果你看看 ``/home`` 目录，你可以发现他们的家目录（因为我们用了 -m 选项，可以帮在创建用户的同时创建他们的家目录。
|
||||
|
||||
之后，我们可以用以下命令给他们设置密码：
|
||||
|
||||
```
|
||||
sudo passwd olivia
|
||||
|
||||
sudo passwd nathan
|
||||
```
|
||||
|
||||
就这样，我们创建了两个用户。
|
||||
|
||||
### 创建用户组并添加用户
|
||||
|
||||
现在我们将创建 readers 和 editors 用户组，然后给它们添加用户。创建用户组的命令是：
|
||||
|
||||
```
|
||||
addgroup readers
|
||||
|
||||
addgroup editors
|
||||
```
|
||||
|
||||
（译者注：当你使用 CentOS 等一些 Linux 发行版时，可能系统没有 addgroup 这个命令，推荐使用 groupadd 命令来替换 addgroup 命令以达到同样的效果）
|
||||
|
||||
|
||||
### [groups_1.jpg][2]
|
||||
|
||||
|
||||
|
||||
图一：我们可以使用刚创建的新用户组了。
|
||||
|
||||
[Used with permission][5]
|
||||
|
||||
创建用户组后，我们需要给他们添加用户。我们用以下命令来将 nathan 添加到 readers 用户组：
|
||||
|
||||
```
|
||||
sudo usermod -a -G readers nathan
|
||||
```
|
||||
用以下命令将 olivia 添加到 editors 用户组：
|
||||
|
||||
```
|
||||
sudo usermod -a -G editors olivia
|
||||
```
|
||||
|
||||
现在我们已经准备好用用户组来管理用户了。
|
||||
|
||||
### 给用户组授予目录的权限
|
||||
|
||||
假设你有个目录 ``/READERS``，允许 readers 用户组的所有成员访问这个目录。首先，我们执行以下命令来更改目录所属用户组：
|
||||
|
||||
```
|
||||
sudo chown -R :readers /READERS
|
||||
```
|
||||
|
||||
接下来，执行以下命令收回目录所属用户组的写入权限：
|
||||
|
||||
```
|
||||
sudo chmod -R g-w /READERS
|
||||
```
|
||||
|
||||
然后我们执行下面的命令来收回其他用户对这个目录的访问权限（以防止任何不在读者组中的用户访问这个目录里的文件）：
|
||||
|
||||
```
|
||||
sudo chmod -R o-x /READERS
|
||||
```
|
||||
|
||||
这时候，只有目录的所有者（root）和用户组 reader 中的用户可以访问 ``/READES`` 中的文件。
|
||||
|
||||
假设你有个目录 ``/EDITORS`` ，你需要给用户组 editors 里的成员这个目录的读和写的权限。为了达到这个目的，执行下面的这些命令是必要的：
|
||||
|
||||
```
|
||||
sudo chown -R :editors /EDITORS
|
||||
|
||||
sudo chmod -R g+w /EDITORS
|
||||
|
||||
sudo chmod -R o-x /EDITORS
|
||||
```
|
||||
|
||||
此时 editors 用户组的所有成员都可以访问和修改其中的文件。除此之外其他用户（除了 root 之外）无法访问 ``/EDITORS`` 中的任何文件。
|
||||
|
||||
使用这个方法的问题在于，你一次只能操作一个组和一个目录而已。这时候访问控制表（ACL）就可以派得上用场了。
|
||||
|
||||
|
||||
### 使用访问控制表（ACL）
|
||||
|
||||
现在，让我们把这个问题变得棘手一点。假设你有一个目录 ``/DATA`` 并且你想给 readers 用户组的成员读取权限同时给 editors 用户组的成员读和写的权限。为此，你必须要用到 setfacl 命令。setfacl 命令可以为文件或文件夹设置一个访问控制表（ACL）。
|
||||
|
||||
这个命令的结构如下：
|
||||
|
||||
```
|
||||
setfacl OPTION X:NAME:Y /DIRECTORY
|
||||
```
|
||||
|
||||
其中 OPTION 是可选选项，X 可以是 u（用户）或者是 g （用户组），NAME 是用户或者用户组的名字，/DIRECTORY 是要用到的目录。我们将使用 -m 选项进行修改（modify）。因此，我们给 readers 用户组添加读取权限的命令是：
|
||||
|
||||
```
|
||||
sudo setfacl -m g:readers:rx -R /DATA
|
||||
```
|
||||
|
||||
现在 readers 用户组里面的每一个用户都可以读取 /DATA 目录里的文件了，但是他们不能修改里面的内容。
|
||||
|
||||
为了给 editors 用户组里面的用户读写权限，我们执行了以下的命令：
|
||||
|
||||
```
|
||||
sudo setfacl -m g:editors:rwx -R /DATA
|
||||
```
|
||||
上述命令将赋予 editors 用户组中的任何成员读取权限，同时保留 readers 用户组的只读权限。
|
||||
|
||||
### 更多的权限控制
|
||||
|
||||
使用访问控制表（ACL），你可以实现你所需的权限控制。你可以实现将用户添加到用户组，并且可靠灵活地控制这些用户组对每个目录的权限以达到你的需求。想要了解上述工具的更多信息，可以执行下列的命令：
|
||||
|
||||
* man usradd
|
||||
|
||||
* man addgroup
|
||||
|
||||
* man usermod
|
||||
|
||||
* man sefacl
|
||||
|
||||
* man chown
|
||||
|
||||
* man chmod
|
||||
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linux.com/learn/intro-to-linux/2017/12/how-manage-users-groups-linux
|
||||
|
||||
作者：[Jack Wallen ]
|
||||
译者：[imquanquan](https://github.com/imquanquan)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[1]:https://www.linux.com/files/images/group-people-16453561920jpg
|
||||
[2]:https://www.linux.com/files/images/groups1jpg
|
||||
[3]:https://training.linuxfoundation.org/linux-courses/system-administration-training/introduction-to-linux
|
||||
[4]:https://www.linux.com/licenses/category/creative-commons-zero
|
||||
[5]:https://www.linux.com/licenses/category/used-permission
|
||||
Loading…
Reference in New Issue
Block a user