Base info for User Accounts

The Login name is the name of the account and is usually all lowercase letters. First or last names, initials or some combination thereof are fairly common login names. For a user named John T. Smith, smith, john, jts, or jsmith would be common user names. Of course spike or something else works just fine, too. You can also use numbers, so jts2 would be fine if you had a second person with the same initials. There is no default for this field.

The Full name is the name of the user or the account. For an individual, it would be their name, John T. Smith for example. If the account represents a position rather than a person, the full name might be the title. So an account called webmaster might have a full name of Red Hat Webmaster or just Webmaster. There is no default for this field.

Since Red Hat Linux uses the User Private Group scheme, each user will be assigned to a default group consisting only of the user. For more information on User Private Groups, see the section called User Private Groups in Chapter 2.

In the Supplementary groups field, you can specify additional groups. Group names should be separated by spaces. The default for this field is blank, meaning no supplementary groups are specified.

The Home directory specifies the home or login directory for the account. The default is /home/login, where login is replaced by the login name. A home directory is your starting point in the directory structure when you log in, or if in X, for each Xterm window opened. This is also where account specific preference files are stored.

The Command interpreter is the default shell for the account. The bash shell is the default shell for Red Hat Linux.

The User ID (UID) is the number associated with each user account. This is automatically generated by the system when the account is created, so just leave this field blank. The system uses the UID to identify an account.

Mail settings for User Accounts

The Redirect messages to field sets the system to forward e-mail messages sent to the user to this address instead.

An E-mail alias is a supplemental e-mail address that will be accepted by the system and forwarded on to the user. For example, you could add the alias jane_smith@yourdomain.com to user smitj's account. Then, e-mail sent to jane_smith@yourdomain.com would automatically be forwarded to smitj@yourdomain.com.

Privileges for User Accounts

In the Privileges section, you can grant access and/or control over various aspects of system configuration. As a default, regular users are denied all privileges on this screen. You may instead choose to grant or to silently grant them specific privileges. The difference between Granted and Granted/silent is that if the privilege is granted, linuxconf will ask for the user's password before allowing them the privilege. If the privilege is granted silently, linuxconf will not prompt for their password.

Generally, careful system administrators won't grant users any system configuration privileges unless it is absolutely necessary. If you do grant privileges, be careful when granting them silently. If a user with silently granted privileges logs in to his/her machine and walks away, their privileges are wide open for the next person who sits down at their desk. Silently granted privileges are less risky if used on machines in a physically restricted area.

May use linuxconf: the user is allowed to access all of linuxconf's capabilities, and they can set up or change linuxconf parameters. Note that use of linuxconf is separate from the privilege of activating configuration changes. System administrators might want to grant the use of linuxconf, but deny the activation privilege, so that the sysadmin has a final "yes/no" on whether to activate any configuration changes.

May activate config changes: After you change a parameter in linuxconf, at some point you'll have to indicate to linuxconf that the changes you made should be applied. Depending upon the flavor of linuxconf that you're using, you might do this by clicking on an Activate the changes button in GUI linuxconf, or clicking on an Accept button in Web-based linuxconf, or selecting an Accept button in text-mode linuxconf, etc.

You can grant the privilege of activating changes to a user. In that case, the user will be able to activate any changed system configuration parameters in linuxconf.

May shutdown: A user can be granted the right to shutdown the system. Note that Red Hat Linux is set in /etc/inittab to cleanly shutdown following the [Ctrl]-[Alt]-[Del] keystroke combination.

Once you have entered the login name and any other desired information select the Accept button at the bottom of the screen. If you decide against creating a new user, select Cancel instead.

When you click on Accept linuxconf will prompt you to enter the password, as in Figure 3-5. You'll have to re-type the password, to prevent unusable passwords caused by typos. Passwords must be at least six characters in length, but you can increase the required length and set other parameters for users' passwords at the Users Accounts => Password & Account Policies screen.

Good passwords contain a combination of letters, numbers, and special characters. It should use both upper case and lower case letters. Don't use your username, your anniversary, your social security number, your dog's name, your middle name or the word root. Don't use any variation of a word associated with your account or with yourself. Don't use a word that can be found in a dictionary; dictionary words are easy to crack.

A simple technique for creating a password is to use the first letters from each word of a phrase that is familiar to you (a line from a favorite song might be appropriate). Make a few letters uppercase, and insert a few numbers and/or special characters in place of letters and you'll have a decent password.

Press the Accept button again when finished. The system will let you know if it thinks the password is easy to crack; if you get a warning message, don't use the password.

Creating a Group

To create a new group:

• Open Config => Users accounts => Normal => Group definition.

You may see a filter screen, depending upon the settings in Control => Filters. Either provide a filter, or select Accept to bypass the filter.

Select Add at the bottom of the User groups screen.

Enter a group name. You may also wish to specify members of the group and can do so in the Alternate members field. The list of users should be space delimited, meaning that each username must have a space between it and the next one. Leave the Group name field blank, so that the system will assign a Group ID (GID) to your new group. When you're finished, select Accept and the group will be created.

Deleting a Group

To delete a group:

• Open Config => Users accounts => Normal => Group definitions.

  You may see a filter screen, depending upon the filter setting in Control => Features. You can use the filter to narrow your choice of groups by specifying a prefix.

• With or without a prefix select Accept at the bottom of the screen.

• On the User groups screen (see Figure 3-8) select the group you wish to delete.

• You'll be presented with the Group specification screen (see Figure 3-9).

• Select Del to delete the group. Linuxconf will then prompt you to confirm the deletion. Choose yes to delete the group.

The group's files will still remain and their respective owners will still have sole control over them. The group name will be replaced with the deleted group's ID. The files may be assigned to a new group by using the chgrp command. More information on chgrp can be found by typing the command info chgrp or man chgrp at the shell prompt. If a new group is created and the deleted group's ID is specified then the new group will have access to the deleted group's files. Don't worry, linuxconf doesn't recycle old group numbers any more than it does old user IDs, so it won't happen by accident.

Modifying Group Membership

There are two ways to modify the list of users that belong to a group. You can either update each user account itself, or you can update the group definitions. In general, the fastest way is to update each of the group definitions. If you're planning on changing more information for each user than just the group information, then updating each user account may prove easier.

We'll start by detailing the group definitions method.

• Start linuxconf by typing linuxconf at the shell prompt.

• Open Config => Users accounts => Normal => Group definitions.

  Depending on the filter settings in Control => Features, you may see a filter screen. Use the filter to narrow the list, or just select Accept to bypass the filter.

• Select the group you wish to modify. This will open the Group specification screen (see Figure 3-9).

• Add or remove each user from the Alternate members field. Make sure that all of the user names are separated by a space character.

• Select Accept, which can be found at the bottom of the screen.

This will automatically update each user account with the group showing up in the Supplementary groups field if added or absent if removed.

Adding and removing groups can also be done by modifying each individual user account.

• Start linuxconf by typing linuxconf at the shell prompt.

• Open Config => Users accounts => Normal => User accounts.

  You may see a filter screen, depending on the settings in Control => Features. Use the filter to narrow the list or select Accept to bypass the filter.

• On the User accounts screen (see Figure 3-3), select a user that you wish to update. You will be presented with the User information screen.

• Add or remove the desired groups from the Supplementary groups field. Each group should be separated by a space character.

• Once you've made all the changes you'd like, select Accept at the bottom of the screen.

This will automatically update the group definitions. Repeat the process for each user.

Reviewing Your Current Filesystem

We'll start by looking at your current directory structure.

• Open Config => File systems => Access local drive.

The fields, as shown in Figure 3-10, are:

• Source: The physical hardware; hd indicates an IDE hard drive, fd indicates a diskette drive, and cdrom typically indicates a CD-ROM drive. If your system has a SCSI drive, you will see an sd instead. More than one drive of a type are listed by letters, so hda represents the first IDE drive, while hdb would be the second. In some cases, you'll see numbers following these letters; on hard drives, the numbers represent the partitions on that drive, while for diskette drives, this number refers to the actual unit.

• Mount point: This is where in the system the drive is accessible from when mounted.

• FsType: The type of filesystem. A standard Linux partition uses the ext2 filesystem type. A filesystem type of vfat indicates a DOS filesystem with long filename support, while a fat filesystem type is for DOS filesystems supporting traditional 8.3 filenames. The iso9660 filesystem type indicates a CD-ROM drive.

  	Please Note
  	Red Hat Linux 6.2 can access FAT32 filesystems using the vfat filesystem type.

• Size: Size may indicate the size of the filesystem in megabytes (M), or it may not be filled in.

• Partition type: A description of the filesystem used on that partition (may not be filled in).

• Status: Whether the device is mounted or not.

Filesystems from other machines on a network may also be available. These can range from single small directories to entire volumes. No information on Size or Partition type is available for these partitions, either. Additional information on NFS filesystems (should you have any available) will be contained under:

Config => File systems => Access nfs volume

The screen (see Figure 3-11 is similar to the Local volume screen, with some notable differences in the information provided for each entry:

• Source: This will be the name of the machine serving the filesystem, followed by the remote directory. For example: foo:/var/spool/mail where foo is the machine serving the directory, and /var/spool/mail is the directory being served.

• FsType -- This will always be "nfs."

Adding NFS Mounts

NFS (Network File System) is a way for computers to share sections of their local filesystem across a network. These sections may be as small as a single directory, or include thousands of files in a vast hierarchy of directories. For example, many companies will have a single mail server with individuals' mail files served as an NFS mount to each users' local systems.

To add an NFS mount:

• Open Config => File systems => Access nfs volume.

• On the NFS volume screen, select Add.

The three fields on the Base tab are what you'll need to concern yourself with next (see Figure 3-12).

• Server: The host name of the machine the desired filesystem resides on. For example, foo.bar.com.

• Volume: The filesystem you wish to add. For example, /var/spool/mail.

• Mount point: Where in your system you want the remote file system accessible from. For example, /mnt/mail.

This is all you need to get the mount created. Linuxconf will update your /etc/fstab file accordingly. If you are aware of additional requirements, please read the help file on the Volume specification screen and see the mount man page for more information.

Once you have entered the information, select Accept.

Adding Modem/PPP/SLIP connections

Red Hat Linux 6.2 uses the utility called RP3, or the RH PPP Dialer, a graphical tool which helps users configure and monitor network accounts -- particularly PPP accounts. (To read more about RP3, see the related chapter in the Official Red Hat Linux Getting Started Guide.) However, you can still depend on linuxconf to set up network configuration.

There are several pieces of information you will need to get from your ISP (Internet Service Provider) or systems administrator before getting your PPP or SLIP account working. In the case of some providers, you may have to sort through directions on how to set up a PPP connection on a Linux system. Some ISPs are ill-equipped to handle individuals using Linux. Don't worry, you can still get connected; you just need some additional information from your ISP.

The following is what you need for a connection with Red Hat Linux. The ISP representatives may respond that you don't need this information, or may suggest that you need more than this. Red Hat has streamlined the information needed using intelligent defaults and tools such as linuxconf to simplify this process for you. Unless they have a document specifically for Red Hat Linux, just request the information below and go from there. Specifically, you'll need:

• The IP address for the ISP's domain name server

• The telephone number to dial

• Your login and password

• An IP address for your machine if the network you are connecting to isn't going to provide you with a dynamic one

• Information about whether your ISP uses an authentication method such as PAP, CHAP or MS-CHAP. If so, you will need a "secret" to enable authentication. The secret will be a word or sequence of characters. CHAP and MS-CHAP are not currently supported using linuxconf, and are rarely used.

Additional information which may be helpful, but isn't necessary includes a secondary name server address, and a search domain. Once you have all this information, you're ready to get connected.

• Open Config => Networking => Client tasks => PPP/SLIP/PLIP.

• Select Add.

Initially there won't be any configurations specified. When you select Add you will be given a choice between PPP, SLIP and PLIP.

PPP is the most commonly used interface and is the default. To set up a PPP connection select PPP and select Accept.

You'll see the following fields:

• Phone number -- The number your modem will need to dial to access your ISP or the remote system

• Modem port -- Indicates where your modem is and should already be set

• Use PAP authentication check box -- Check if you know that the system you are dialing into requires this

• Login name -- Your login name for the PPP account

• Password -- Your password for the PPP account

Notice that the title bar is PPP interface ppp0. ppp0 is the first PPP interface, ppp1 would be the second and so on. It's important to keep track of which interface you're using if you have more than one. SLIP connections use sl instead of ppp for their interface prefix. With the exception of a PAP authentication option, the entry screens for adding a PPP or a SLIP account are identical.

Enter the complete phone number for the remote machine, and make sure to include any numbers required to access outside lines.

For example, if you need to dial 9 and then the number, and the computer you're connecting to has a telephone number of 555-0111, then you'd enter 95550111.

The next information you're asked for is the modem port. This is a drop down box of available ports. If you're using a dual-boot Linux/Windows system and you know the COM port your modem is on, the following map may be of use:

Map to Windows COM ports are as follows:

• ttyS0 -- COM1: under MS-DOS;

• ttyS1 -- COM2: under MS-DOS;

• ttyS2 -- COM3: under MS-DOS;

• ttyS3 -- COM4: under MS-DOS.

The login name is the one for the PPP account. The password you enter will be shown in plain text, so be careful who you have around when you enter it! If you will be using PAP authentication, check the box; when you've entered the other required information, select the Customize button at the bottom of the screen.

If you're using PAP, select the PAP tab and enter your username and then the secret the ISP has provided you in the Secret field. The other defaults should be sufficient, but if you need to, you can edit the initial settings using the Customize option.

Modifying a PPP or SLIP Configuration

You can edit an existing configuration as well as delete it by selecting it from the list on the PPP/SLIP/PLIP configurations screen.

• Open Config => Networking => Client tasks => PPP/SLIP/PLIP.

• You will then be presented with the PPP/SLIP/PLIP configurations screen (see Figure 3-13). Select the configuration you would like to modify or delete.

  This will open the appropriate interface screen for your configuration. If you wish to delete the configuration, select Del at the bottom of the screen. The Modem port is on the Hardware tab and is a drop down menu. If you want to change the other settings you entered when you originally created the configuration, select the Communication tab. The first Send field contains your login, and the next Send field contains your password. The Expect fields correspond to the login: and password: prompts, which explains the ogin: and ord: entries.

  	Please Note
  	The ogin: and ord: entries may not be the same for your system. Different ISP/PPP servers may use different text and should be changed to fit the needs of whatever server type you are logging in to. Instead, you may see such prompts as User ID and authentification.

Once you have made your changes, you can test to see if your configuration is working. Select Connect from the bottom of the screen. This will attempt to connect you to the remote system using the information you've entered.

Other Network Connections

Setting up a network connection over Ethernet requires an entirely different type of setup. Network connections to Token Ring or ARCnet networks follow a similar procedure, but will not be discussed here.

• First you will need to have an Ethernet card installed.

• Start linuxconf by typing linuxconf at the shell prompt.

• Open Config => Networking => Client tasks => Basic host information. The Host name tab will request a host name, which should be specified by default unless you did not setup your networking during the installation process. If it is not already specified, please take the time now to configure it. It should be specified as localhost.localdomain. Skip this tab. Select the tab for Adaptor 1.

The first item on this screen is a check box to indicate whether this adaptor is enabled or not. It should be checked if this is the one you intend to use. Below that is a choice of Config modes. Manual means that you will be providing all the information and entering it yourself. Dhcp and Bootp mean that your machine will be getting its network configuration information from a remote DHCP or BOOTP server. If you're not sure what option to choose, talk to your network administrator.

Required fields for DHCP or BOOTP:

• Net device -- The type of network card you are using; for example, eth0 would be the appropriate entry to use the first Ethernet card.

• Kernel module -- The correct module based on your network card; for further information see the list below.

For DHCP and bootp configurations you only need to specify the Net device and the Kernel module. For the Net device, you will choose from a list where the eth prefix represents Ethernet cards, arc specifies an ARCnet card and tr specifies Token Ring cards. A complete list of network cards and their respective modules can be found in Appendix A. For the most up-to-date list, please see our website at:

http://www.redhat.com/support/hardware

The netmask information may be set by default, although depending on what kind of network you are setting up, or becoming a part of, you may need to specify this. If you are connecting to an ISP, ask them for the information. Most likely it will be 255.255.255.0.

Required fields for manual configuration:

• Primary name + domain -- The primary name is the name of your computer, while the domain is how your network is specified. For example, foo.bar.com; foo is the primary name and bar.com is the domain.

• IP address -- The address of the machine and will follow the pattern of x.x .x.x. For example, 192.168.0.13.

• Net device -- The type of network card you are using; eth0 would be the appropriate entry to use the first Ethernet card.

• Kernel module -- The correct module based on your network card.

Information on net devices and kernel modules is described above. The appropriate primary name + domain and IP address will depend on whether you are adding the computer to an existing network or creating a new network. For connecting to an existing network, contact your network administrator for the information. Getting a network connected to the Internet is beyond the scope of this book, and we recommend the following starting point:

TCP/IP Network Administration, 2nd Edition, by Craig Hunt (O'Reilly and Associates).

If you're setting up a private network that won't ever be connected to the Internet, then you can choose any primary name + domain name you would like and have several choices for IP addresses (See Table 3-1).

The three sets of numbers above correspond to class a, b, and c networks respectively. The classes are used to describe the number of IP addresses available as well as the range of numbers. The numbers above have been set aside for private networks.

	Please Note
	You should not use these IP addresses if you connect to the Internet since 192.168.0.* and 192.168.255.* are not reliably considered private. If you want your network to be connected to the Internet, or think you might want to at some point in the future, do yourself a favor and get yourself non-private addresses now.

Name Server Specification

A name server and default domain are also needed to establish a network connection. The name server is used to translate host names such as private.network.com to their corresponding IP address such as 192.168.7.3.

The default domain tells the computer where to look if a fully qualified hostname isn't specified. Fully qualified means that the full address is given, so foo.redhat.com is the fully qualified hostname, while the hostname is simply foo. If you specified your default domain as redhat.com, then you could use just the hostname to connect successfully. For example ftp foo would be sufficient if your search domain is redhat.com, while ftp foo.redhat.com would be required if it wasn't.

To specify the nameserver, open Config => Networking => Client tasks => Name server specification (DNS).

Nameservers are ranked according to the order in which they are accessed, so it's not unusual to see nameservers referred to as primary, secondary, tertiary and so on down the list if more than one is specified. Each of these must be an IP address and not a name, since the computer has no way to resolve the name until it connects to a nameserver.

In addition to a default domain, you can also specify search domains. Search domains work differently; they progress from one to six in a similar manner to the nameserver. However, they all take precedence over the default domain! Keep this in mind when specifying search domains. Search domains are not commonly used.

The one item not yet covered is the check box for DNS usage. If you are running a small private network with no Internet connection, then using /etc/hosts files and keeping them all synchronized will work. As you add more and more machines, the complexity increases until it is easier to have a single machine run a DNS than to continue to sync /etc/hosts files.

Another reason for not using DNS is if your network is going to use NIS instead. Note that NIS can be used in conjunction with DNS. So to sum it all up, unless you know why using /etc/hosts or NIS would be best for your situation, DNS is probably going to be your best choice.

You can add, modify, or delete entries from the /etc/hosts file using linuxconf. Open Config => Networking => Misc => Information about other hosts.

To modify or delete an entry select it. To delete the entry, select Del at the bottom of the host/network definition screen.

To modify it, change the information as necessary. To add a new entry, select Add at the bottom of the /etc/hosts screen. This will also open the host/network definition screen.

Required Fields:

• Primary name + domain -- The primary name is the name of the computer, while the domain is how the network it is attached to is specified. For example, given foo.bar.com, foo is the primary name and bar.com is the domain.

• IP number -- Also referred to as IP address; this is the address of the machine and will follow the pattern of x.x. x.x. For example, 192.168.0.13.

Optional Fields:

• Aliases -- A shorthand for the fully qualified domain name. This is often the same as the primary name. So, for example, if the fully qualified domain name is foo.bar.com, you could select foo as the alias.

• Comment -- A comment on the machine. For example, "The remote nameserver."

Once finished, select Accept.