هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.
$ مستخدم عادي# بصلاحية root (أو مع sudo)
المهارات في هذا الفصل
- إنشاء المستخدمين والمجموعات واستخدام sudo وضبط قواعد كلمات المرور
Know the kinds of users
Linux knows users by a number, the UID. The number decides the kind of user.
| Kind | UID | Example | Used for |
|---|---|---|---|
| Superuser | 0 | root | Full control over the system |
| System users | 1 – 999 | apache, sshd, chrony | Run services with few rights |
| Normal users | 1000 and up | anna, student | People |
id
uid=1000(student) gid=1000(student) groups=1000(student),10(wheel)
id apache
uid=48(apache) gid=48(apache) groups=48(apache)
ps -o user,pid,cmd -C sshdتذكّر
Services run as their own system user. If somebody breaks into the web server, he only gets the rights of apache, not of root.
Read the user database files
Local accounts live in four text files in /etc.
| File | What is in it | Who can read it |
|---|---|---|
/etc/passwd | Users: name, UID, GID, comment, home, shell | Everybody |
/etc/shadow | Password hashes and password-age rules | Only root |
/etc/group | Groups and their members | Everybody |
/etc/gshadow | Group passwords and group admins | Only root |
grep anna /etc/passwd
anna:x:1001:1001:Anna Admin:/home/anna:/bin/bash
grep anna /etc/shadow
anna:$y$j9T$Hd3...$Qx1...:20753:0:90:7:::
grep wheel /etc/group
wheel:x:10:student,anna
getent passwd annaThe 7 fields of /etc/passwd: name : x : UID : GID : comment : home : shell. The x means "the password is in /etc/shadow".
Become root with su and sudo
Work as a normal user. Get root rights only for the commands that need them: with sudo (one command) or su - (a root shell).
sudo dnf install -y tmux
[sudo] password for student:
sudo -i
whoami
root
exit
su -
Password:
exit
su - anna
sudo -l| Command | Asks for | Result |
|---|---|---|
sudo CMD | Your password | Runs one command as root, logged in /var/log/secure |
sudo -i | Your password | A root login shell |
su - | The root password | A root login shell |
su - anna | anna's password (nothing if you are root) | A login shell as anna |
sudo -l | Your password | Shows what you may run with sudo |
تذكّر
su - with the dash loads the full environment of the new user (PATH, home folder). Without the dash you keep your old environment — a common source of "command not found".
في العمل
Many companies lock the root password (passwd -l root) and let admins work only with sudo. Every action then has a name in the log.
Give admin rights with sudo
Members of the group wheel may run every command with sudo. For smaller rights, write a rule in /etc/sudoers.d/.
usermod -aG wheel anna
visudo -f /etc/sudoers.d/webteam
visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.d/webteam: parsed OK# The web team may manage Apache, nothing else
%webteam ALL=(root) /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd
# Backup user, no password (for scripts)
backup ALL=(root) NOPASSWD: /usr/bin/rsyncThe format: who where=(as whom) which commands. % before a name means a group.
انتبه
Always use visudo. It checks the syntax before it saves. One wrong character in a sudoers file can lock everybody out of sudo. More: Give limited admin rights with sudo.
Create, change and delete users
useradd creates, usermod changes and userdel deletes a user. passwd sets the password.
useradd anna
passwd anna
useradd -c "Omar Ali" -G wheel,webteam -s /bin/bash omar
useradd -u 2001 -d /srv/app -s /sbin/nologin appuser
usermod -c "Anna Admin" anna
usermod -aG webteam anna
usermod -L omar
usermod -U omar
userdel -r olduser| Option | Meaning |
|---|---|
-c "text" | Comment (often the full name) |
-G g1,g2 | Extra (supplementary) groups |
-aG g (usermod) | Add a group and keep the old ones |
-u UID / -g GROUP | Choose the UID / the primary group |
-d DIR / -m | Home folder / create it |
-s SHELL | Login shell (/sbin/nologin = no login) |
-L / -U | Lock / unlock the password |
userdel -r | Also delete the home folder and the mail spool |
انتبه
usermod -G webteam anna without -a removes anna from all her other extra groups. Always use -aG to add.
Defaults for new users come from /etc/login.defs and /etc/default/useradd. Files in /etc/skel are copied into every new home folder. Details: Set defaults for new users.
Manage groups
Groups give rights to many users at once. A user has one primary group (owner group of new files) and can be in many supplementary groups.
Set password rules
Use chage to force password changes and to lock old accounts. Use /etc/security/pwquality.conf for the length and the strength.
chage -l anna
Last password change : Oct 27, 2026
Password expires : Jan 25, 2027
Minimum number of days between password change : 0
Maximum number of days between password change : 90
Number of days of warning before password expires : 7
chage -M 90 -m 1 -W 7 anna
chage -d 0 anna
chage -E 2026-12-31 contractor
passwd -e omar| Option | Meaning |
|---|---|
-M 90 | The password must change every 90 days |
-m 1 | Wait at least 1 day before the next change |
-W 7 | Warn 7 days before it expires |
-I 14 | Lock the account 14 days after the password expired |
-d 0 | Force a new password at the next login |
-E DATE | The whole account expires on that date |
minlen = 12
minclass = 3
dictcheck = 1نصيحة للامتحان
For all new users, change PASS_MAX_DAYS in /etc/login.defs. chage changes only users who already exist. More: Set password aging.