About User and Role Accounts

Attributes of User and Role Accounts

Home Directory Setup

Warning When Removing User Accounts

User Initialization Files

Reserved UID Numbers

Attributes of User and Role Accounts

Each new user and role account has the following attributes defined when the account is added by the System Administrator:

- A login name (the username) and identification number (the UID)
- A home directory (a location where the user stores files)
- A password that authenticates a user or role.
The user enters the user account's password to gain access to the system. Roles do not log in directly. After logging in, an authorized user must enter the role's password in order to be able to assume the role. The initial user's or role's password is either typed in or chosen from a generated list by the administrator.
- A login shell
Roles always have an adminstrator's shell assigned. (An administrator's shell is any of the profile shells described on the pfexec(1M) man page.) By default, user accounts have the Bourne shell, sh(1), assigned when the account is created using the Add User Wizard. The System Administrator can create a template that assigns another shell, either by choosing C Shell, Korn Shell, BASH, T Shell, Z Shell, or Other from the menu. Selecting Other allows the administrator to type in the pathname of one of the profile shells, /bin/pfsh, /bin/pfcsh, or /bin/pfksh, or of any other shell.
- A mailbox (a file on the mail server that holds unread mail--the "inbox")
- Membership in a primary group and in optional supplementary groups

Top ^

Each Trusted Solaris user and role account also has the following extended attributes:
- A method for choosing a new password: either automatic (machine-generated passwords), or manual (user-chosen passwords) The password can be changed as follows:
  • Any user or role can change his or her own password using the Change Password option in the TP Menu in the Front Panel.
  • The System Administrator and Security Administrator roles can change their role passwords using the passwd(1) command.
  • The Security Administrator can use the SMC Users tool, select the name of the user, then select Action->Properties to modify the Properties for any user or role account.
- A set of password options expressed in days:
  • User Must Keep: The number of days the user must keep the password before changing it
  • User Must Change Within: The number of days the user can keep the password before it expires
  • Before Change, Alert User: The number of days before expiration that a warning is to be sent
  • Expires If Not Used For: How many days the password can be unused before it expires
- A clearance (the highest label at which the user can work)
- A minimum label (the lowest label at which the user can work)
NOTE: The clearance and the minimum label together define the set of labels at which the user can work.
- Two label viewing-related options that specify whether labels are shown or hidden overall, and if labels are shown, whether the user is allowed to see the administrative labels ADMIN_LOW and ADMIN_HIGH
- An idle time, which specifies how long the workstation can remain inactive before the "idle command" (next item) is performed
- An idle command, which specifies whether to lock the screen or logout if the workstation is idle more than the length of time specified in "idle time" (previous item)
- A type, either "normal" or "role"
- Optional: for users, one or more roles that the user can assume
- Mandatory for roles and optional for users: one or more rights profiles

NOTE: Default values for most of the extended attributes are implictly applied to user accounts if the Security Administrator does not specify other values. The policy.conf(4) file contains system-wide defaults for the idle action and idle time, the label view, the method of password generation, and whether the account is locked after a specified number of failed login attempts with the wrong password. The default policy.conf file also assigns the Basic Solaris User rights profile to all users. If desired, Security Administrator can modify policy.conf to change the defaults or to assign one or more system-wide authorizations using the AUTHS_GRANTED= keyword.

The default label attributes (minimum label, clearance, default label view, and whether labels are hidden) are specified by the Security Administrator in the label_encodings(4) file.

For more about any of the above terms and concepts, see the Solaris System Administration Guide and the Trusted Solaris Administration Overview, Administrator's Procedures, and Label Administration manuals, which are available on the AnswerBook CDs shipped with the system and at http://docs.sun.com.

Also see About User and Role Account Management, Getting Started With Users Tools, and Rights of Users and Roles.

Top ^

Home Directory Setup

When you add a user or role, User Manager and Role Manager set up the user's or role's home directory by doing the following:

Top ^

Warning When Removing User Accounts

When you attempt to delete a user's account, a Warning dialog box appears. The dialog informs you that the user's entries are being removed from local files or the directory service's databases and that the user's name is being removed from groups. The dialog also gives you the option to delete the user's home directory and mailbox.

Even if the user account that is being deleted has one of these directories as its home directory, the following directories cannot be removed: /, /etc, /usr, /home, /var, /opt, /tmp, and /proc.

Top ^

User Initialization Files

Every user's home directory needs one or more initialization files whose primary purpose is to define the user's work environment by setting the search path, windowing environment, environment variables, and so forth. The /etc/skel directory contains default initialization files to be copied into the account's home directory. The administrator can modify the files in the directory or add additional files. In Trusted Solaris, any files in the skeleton directory are copied into the first SLD created at the account's minimum label. The user or role can then modify the files.

NOTE:The user or role should create a copy_files(4) or link_files(4) file in the initial SLD to list the initialization files that need to be copied or linked into subsequent SLDs created for the user. Without the initialization files for the user's shell being available in the subsequent SLDs, the user's environment cannot be created properly when the user works at any other label.

The default files are copied and renamed as follows.

Original Name Name After Copy
local.login .login
local.cshrc .cshrc
local.profile .profile

Trusted Solaris provides an /etc/skel/tsol directory for role's initialization files, which are copied to the role's home directories and renamed:

Original Name Name After Copy
role.link_files .link_files
role.profile .profile

For additional information about user initialization files, see "Customizing a User's Work Environment" in the Solaris System Administration Guide. Several important differences exist in Trusted Solaris in how initialization files are used, as described in "Managing Startup Files" in the Trusted Solaris Administration Overview.

Top ^

The initialization file sourced at login are:

Shells Initialization Files

C shell, csh(1M), and Adminstrator's C shell, pfcsh(1M) /etc/.login and $HOME/.login
Bourne shell, sh(1M), Korn shell, ksh(1M), Adminstrator's Bourne shell, pfsh(1M), and Administrator's Korn shell, pfksh(1M) /etc/.profile and $HOME/.profile
Top ^

The initialization files that are sourced when any terminal except dtterm(1) launches a shell are:

Shells Initialization Files

C shell, csh(1M), and Adminstrator's C shell, pfcsh(1M) $HOME/.cshrc and $HOME/.login
Bourne shell, sh(1M), and Adminstrator's Bourne shell, pfsh(1M) $HOME/.profile
Korn shell, ksh(1M), and Administrator's Korn shell, pfksh(1M) $HOME/.profile, and file specified with ENV variable

NOTE: To force dtterm to launch a new shell as a login shell, the administrator or the user can make sure that a .Xdefaults-<hostname> file (with "hostname" replaced with the hostname of the home directory server) is in the account's home directory with the following entry:

      Dtterm*/LoginShell: true

Any files added to the skeleton directory are copied without being renamed. Recommended additions are shown in the table below:

File What to Include in the Files

.Xdefaults-<hostname> Dtterm*LoginShell: true
.copy_files
.link_files
List the .Xdefaults-<hostname> and any other files that should be copied or linked to subsequent home directory SLDs.

Top ^

Reserved UID Numbers

User ID numbers 0 through 99 are reserved for system accounts. If you specify a new system account, you can assign it one of these UIDs, but you should not use these UIDs for regular user accounts.

By definition, root is always UID 0, daemon is UID 1, and pseudo-user bin has UID 2.

In addition, UID 60001 is nobody, UID 60002 is noaccess, and UID 65534 is nobody4.

Top ^