2 - Raspberry PI Community Projects

8.4.3. Modifying an Existing Account or Password
The following commands allow modification of the information stored in specific fields of the
user databases: passwd permits a regular user to change their password, which in turn, updates
the /etc/shadow file; chfn (CHange Full Name), reserved for the super-user (root), modifies the
GECOS field. chsh (CHange SHell) allows the user to change their login shell, however available
choices will be limited to those listed in /etc/shells; the administrator, on the other hand, is
not bound by this restriction and can set the shell to any program of their choosing.
Finally, the chage (CHange AGE) command allows the administrator to change the password
expiration settings (the -l user option will list the current settings). You can also force the
expiration of a password using the passwd -e user command, which will require the user to
change their password the next time they log in.
8.4.4. Disabling an Account
You may find yourself needing to “disable an account” (lock out a user), as a disciplinary measure,
for the purposes of an investigation, or simply in the event of a prolonged or definitive
absence of a user. A disabled account means the user cannot login or gain access to the machine.
The account remains intact on the machine and no files or data are deleted; it is simply
inaccessible. This is accomplished by using the command passwd -l user (lock). Re-enabling
the account is done in similar fashion, with the -u option (unlock).
GOING FURTHER
NSS and system databases
Instead of using the usual files to manage lists of users and groups, you could
use other types of databases, such as LDAP or db, by using an appropriate
NSS (Name Service Switch) module. The modules used are listed in the
/etc/nsswitch.conf file, under the passwd, shadow and group entries. See
Section 11.7.3.1, “Configuring NSS” (page 290) for a specific example of the
use of an NSS module by LDAP.
8.4.5. Group List: /etc/group
Groups are listed in the /etc/group file, a simple textual database in a format similar to that of
the /etc/passwd file, with the following fields:
• group name
• password (optional): This is only used to join a group when one is not a usual member
(with the newgrp or sg commands, see sidebar);
• gid: unique group identification number
• list of members: list of names of users who are members of the group, separated by commas.
156 The Debian Administrator's Handbook