Gerenciamento de Usuários

Gerencie usuários, grupos, permissões, acesso sudo, módulos PAM e integração LDAP em sistemas Linux. Inclui scripts práticos para operações em massa de usuários e auditoria de acesso.

Quando Usar

• Criar e gerenciar contas de usuário locais em servidores Linux
• Configurar acesso sudo com controles de privilégio granulares
• Configurar controle de acesso baseado em grupo para equipes
• Integrar hosts Linux com LDAP ou Active Directory para autenticação centralizada
• Auditar contas de usuário, permissões e padrões de acesso
• Automatizar o provisionamento e desprovisionamento em massa de usuários

Pré-requisitos

• Acesso root ou sudo no sistema alvo
• Pacote shadow-utils (fornece useradd, usermod, etc.) -- instalado por padrão
• libpam-modules para configuração PAM
• Para LDAP: pacotes sssd, realmd, libpam-ldapd ou nslcd
• Para auditoria: pacote auditd

Operações de Usuário

Criando Usuários

# Create a user with home directory, default shell, and comment
useradd -m -s /bin/bash -c "Jane Smith" jsmith

# Set the user's password interactively
passwd jsmith

# Create a user with a specific UID and primary group
useradd -m -s /bin/bash -u 1500 -g developers -c "Deploy Account" deploy

# Create a system account (no home, no login shell) for running services
useradd -r -s /usr/sbin/nologin -d /opt/myapp -c "MyApp Service Account" myapp

# Create a user with an expiration date (contractor access)
useradd -m -s /bin/bash -e 2025-12-31 -c "Contractor - Bob Lee" blee

# Create user and add to multiple supplementary groups at creation time
useradd -m -s /bin/bash -G docker,developers,ssh-users -c "Dev User" devuser

Modificando Usuários

# Add a user to a supplementary group (preserving existing groups with -a)
usermod -aG sudo jsmith
usermod -aG docker,developers jsmith

# Change the user's login shell
usermod -s /bin/zsh jsmith

# Change the user's home directory and move existing files
usermod -d /home/jsmith-new -m jsmith

# Lock a user account (disable login without deleting)
usermod -L jsmith

# Unlock a user account
usermod -U jsmith

# Set an account expiration date
usermod -e 2025-06-30 blee

# Change a user's login name
usermod -l jsmith-new jsmith

# Force password change on next login
chage -d 0 jsmith

# Set password aging: min 7 days, max 90 days, warn 14 days before
chage -m 7 -M 90 -W 14 jsmith

# View password aging info
chage -l jsmith

Excluindo Usuários

# Remove a user and their home directory
userdel -r jsmith

# Remove a user but keep their home directory (for auditing)
userdel jsmith

# Find and reassign files owned by a deleted user (by UID)
find / -uid 1500 -exec chown newowner:newgroup {} \;

Gerenciamento de Grupos

# Create a new group
groupadd developers

# Create a group with a specific GID
groupadd -g 2000 devops

# Add a user to a group
usermod -aG developers jsmith
# Alternative using gpasswd
gpasswd -a jsmith developers

# Remove a user from a group
gpasswd -d jsmith developers

# Set group administrators (can add/remove members without root)
gpasswd -A jsmith developers

# Delete a group
groupdel developers

# List all groups a user belongs to
groups jsmith
id jsmith

# List all members of a group
getent group developers

# Show all groups on the system
cat /etc/group | cut -d: -f1 | sort

Configuração do Sudo

# Always edit sudoers via visudo (syntax validation prevents lockout)
visudo

# Better: use drop-in files in /etc/sudoers.d/
visudo -f /etc/sudoers.d/developers

/etc/sudoers.d/developers

# Allow the developers group to restart specific services
%developers ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp, /usr/bin/systemctl status myapp

# Allow a deploy user full sudo with no password
deploy ALL=(ALL) NOPASSWD: ALL

# Allow ops team to run docker commands only
%ops ALL=(ALL) NOPASSWD: /usr/bin/docker, /usr/bin/docker-compose

# Allow a user to run commands as a specific service account
jsmith ALL=(myapp) NOPASSWD: /opt/myapp/bin/*

# Restrict to specific hosts (useful with centralized sudoers)
jsmith dbservers=(root) /usr/bin/systemctl restart postgresql

# Log all sudo commands to a dedicated file
Defaults log_output
Defaults!/usr/bin/sudoreplay !log_output
Defaults logfile="/var/log/sudo.log"

# Require password re-entry every 5 minutes (default is 15)
Defaults timestamp_timeout=5

# Require password for sudo even if user has NOPASSWD elsewhere
Defaults:jsmith !authenticate

…