本文档风哥主要介绍Linux用户管理相关知识，包括useradd命令创建用户、usermod命令修改用户、userdel命令删除用户、用户配置文件管理、批量用户管理等内容，参考Red Hat Enterprise Linux 10官方文档，适合运维人员在学习和测试中使用，如果要应用于生产环境则需要自行确认。更多视频教程www.fgedu.net.cn
Part01-基础概念与理论知识
1.1 Linux用户管理概念
Linux是一个多用户多任务的操作系统，用户管理是系统管理的基础。每个用户都有一个唯一的用户ID（UID），系统通过UID来识别用户。用户管理包括用户的创建、修改、删除以及用户属性的管理。
- 系统安全：通过用户权限控制访问
- 资源隔离：不同用户拥有独立的资源
- 审计追踪：记录用户操作行为
- 权限管理：精细化权限控制
1.2 Linux用户类型
Linux用户分为三种类型：
- 超级用户（root）：UID为0，拥有系统最高权限
- 系统用户：UID为1-999，用于运行系统服务
- 普通用户：UID从1000开始，用于日常操作
# cat /etc/passwd | awk -F: ‘{print $3}’ | sort -n | head -n 10
0
1
2
3
4
5
6
7
8
11
# 查看普通用户
# cat /etc/passwd | awk -F: ‘$3 >= 1000 {print $1, $3}’
nobody 65534
fgedu 1000
user1 1001
user2 1002
# 查看root用户信息
# cat /etc/passwd | grep “^root”
root:x:0:0:root:/root:/bin/bash
1.3 Linux用户相关文件
Linux用户管理涉及的主要配置文件：
- /etc/passwd：用户账户信息文件
- /etc/shadow：用户密码信息文件
- /etc/group：用户组信息文件
- /etc/gshadow：用户组密码信息文件
- /etc/login.defs：用户创建默认配置
- /etc/default/useradd：useradd命令默认配置
- /etc/skel/：用户家目录模板目录
# head -n 3 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
# 字段说明：
# 用户名:密码占位符:UID:GID:描述信息:家目录:登录shell
# 查看/etc/shadow文件格式
# head -n 3 /etc/shadow
root:$6$rounds=4096$xxx:19500:0:99999:7:::
bin:*:19500:0:99999:7:::
daemon:*:19500:0:99999:7:::
# 字段说明：
# 用户名:加密密码:上次修改密码天数:密码最小使用天数:密码最大使用天数:密码过期警告天数:密码过期后账户禁用天数:账户过期日期:保留字段
# 查看/etc/login.defs配置
# grep -E “^UID_MIN|^UID_MAX|^GID_MIN|^GID_MAX” /etc/login.defs
UID_MIN 1000
UID_MAX 60000
GID_MIN 1000
GID_MAX 60000
# 查看/etc/default/useradd配置
# cat /etc/default/useradd
# useradd defaults file
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes
Part02-生产环境规划与建议
2.1 用户命名规范
在生产环境中，用户命名应遵循统一的规范：
# 1. 命名规则
– 长度：1-32个字符
– 字符：小写字母、数字、下划线、连字符
– 格式：部门-姓名-序号 或 姓名-部门
– 示例：dev-zhangsan-01, lisi-ops
# 2. 禁止使用的用户名
– root, admin, administrator
– test, guest, demo
– 系统保留用户名
# 3. 用户命名示例
# 按部门分类
dev-zhangsan-01
dev-lisi-02
ops-wangwu-01
dba-zhaoliu-01
# 按项目分类
projectA-dev01
projectA-dev02
projectB-ops01
# 按功能分类
app-mysql-01
app-nginx-01
app-redis-01
2.2 用户管理策略
生产环境用户管理策略：
# 1. 密码策略
# 编辑/etc/login.defs
PASS_MAX_DAYS 90 # 密码最大使用天数
PASS_MIN_DAYS 7 # 密码最小使用天数
PASS_MIN_LEN 8 # 密码最小长度
PASS_WARN_AGE 7 # 密码过期警告天数
# 2. 密码复杂度要求
# 安装密码质量检查模块
# dnf install -y libpwquality
# 编辑/etc/security/pwquality.conf
minlen = 8 # 最小长度
minclass = 4 # 至少包含4类字符
dcredit = -1 # 至少1个数字
ucredit = -1 # 至少1个大写字母
lcredit = -1 # 至少1个小写字母
ocredit = -1 # 至少1个特殊字符
# 3. 登录失败锁定策略
# 编辑/etc/pam.d/system-auth
auth required pam_faillock.so preauth silent deny=5 unlock_time=900
auth sufficient pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900
# 4. 用户会话超时
# 编辑/etc/profile
export TMOUT=1800 # 30分钟超时
# 5. 命令历史记录
# 编辑/etc/profile
export HISTSIZE=1000
export HISTFILESIZE=2000
export HISTTIMEFORMAT=”%F %T ”
2.3 用户安全建议
生产环境用户安全建议：
- 禁止root用户直接SSH登录
- 使用sudo进行权限管理
- 定期审计用户账户
- 及时删除离职员工账户
- 使用SSH密钥认证
- 定期检查异常登录
# 1. 禁止root SSH登录
# 编辑/etc/ssh/sshd_config
PermitRootLogin no
# 重启SSH服务
# systemctl restart sshd
# 2. 配置sudo权限
# 编辑/etc/sudoers或使用visudo
# 用户组sudo权限
%wheel ALL=(ALL) ALL
# 特定用户特定命令权限
fgedu ALL=(ALL) /usr/bin/systemctl, /usr/bin/dnf
# 免密sudo
fgedu ALL=(ALL) NOPASSWD: ALL
# 3. 检查空密码账户
# awk -F: ‘$2 == “” {print $1}’ /etc/shadow
# 4. 检查UID为0的账户
# awk -F: ‘$3 == 0 {print $1}’ /etc/passwd
root
# 5. 检查未设置密码的账户
# awk -F: ‘$2 == “!!” || $2 == “!” {print $1}’ /etc/shadow | head -n 10
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
# 6. 锁定长期未登录账户
# 查看用户最后登录时间
# lastlog | head -n 20
Username Port From Latest
root pts/0 192.168.1.100 Fri Apr 2 10:00:00 +0800 2026
bin **Never logged in**
daemon **Never logged in**
Part03-生产环境项目实施方案
3.1 useradd命令创建用户
useradd命令用于创建新用户，是用户管理的基础命令。
# 1. 创建基本用户
# useradd fgedu
# id fgedu
uid=1000(fgedu) gid=1000(fgedu) groups=1000(fgedu)
# 查看用户信息
# grep “fgedu” /etc/passwd
fgedu:x:1000:1000::/home/fgedu:/bin/bash
# 查看用户家目录
# ls -la /home/fgedu/
total 12
drwx——. 2 fgedu fgedu 62 Apr 2 10:00 .
drwxr-xr-x. 3 root root 17 Apr 2 10:00 ..
-rw-r–r–. 1 fgedu fgedu 18 Apr 2 10:00 .bash_logout
-rw-r–r–. 1 fgedu fgedu 141 Apr 2 10:00 .bash_profile
-rw-r–r–. 1 fgedu fgedu 492 Apr 2 10:00 .bashrc
# 2. 创建用户并设置密码
# useradd user1
# echo “Password123” | passwd –stdin user1
Changing password for user user1.
passwd: all authentication tokens updated successfully.
# 3. 创建用户并指定UID
# useradd -u 2000 user2
# id user2
uid=2000(user2) gid=2000(user2) groups=2000(user2)
# 4. 创建用户并指定主组
# groupadd developers
# useradd -g developers user3
# id user3
uid=2001(user3) gid=1001(developers) groups=1001(developers)
# 5. 创建用户并指定附加组
# useradd -G wheel,developers user4
# id user4
uid=2002(user4) gid=2002(user4) groups=2002(user4),10(wheel),1001(developers)
# 6. 创建用户并指定家目录
# useradd -d /data/appuser appuser
# grep “appuser” /etc/passwd
appuser:x:2003:2003::/data/appuser:/bin/bash
# 7. 创建用户并指定登录shell
# useradd -s /sbin/nologin serviceuser
# grep “serviceuser” /etc/passwd
serviceuser:x:2004:2004::/home/serviceuser:/sbin/nologin
# 8. 创建用户并指定注释
# useradd -c “Application Service Account” appservice
# grep “appservice” /etc/passwd
appservice:x:2005:2005:Application Service Account:/home/appservice:/bin/bash
# 9. 创建用户并设置过期时间
# useradd -e 2026-12-31 tempuser
# chage -l tempuser
Last password change : Apr 02, 2026
Password expires : never
Password inactive : never
Account expires : Dec 31, 2026
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
# 10. 创建系统用户
# useradd -r -s /sbin/nologin systemapp
# id systemapp
uid=996(systemapp) gid=994(systemapp) groups=994(systemapp)
# 11. 创建用户并指定家目录权限
# useradd -m -k /etc/skel -d /home/customuser customuser
# ls -la /home/customuser/
total 12
drwx——. 2 customuser customuser 62 Apr 2 10:00 .
drwxr-xr-x. 3 root root 17 Apr 2 10:00 ..
-rw-r–r–. 1 customuser customuser 18 Apr 2 10:00 .bash_logout
-rw-r–r–. 1 customuser customuser 141 Apr 2 10:00 .bash_profile
-rw-r–r–. 1 customuser customuser 492 Apr 2 10:00 .bashrc
# 12. 创建用户时不创建家目录
# useradd -M nouserhome
# ls -la /home/nouserhome
ls: cannot access ‘/home/nouserhome’: No such file or directory
# 13. 创建用户并指定用户组
# useradd -g developers -G wheel,docker devuser
# id devuser
uid=2008(devuser) gid=1001(developers) groups=1001(developers),10(wheel),993(docker)
# 14. 创建用户并指定初始组ID
# useradd -K UID_MIN=5000 -K UID_MAX=6000 highuiduser
# id highuiduser
uid=5000(highuiduser) gid=5000(highuiduser) groups=5000(highuiduser)
# 15. 创建用户并设置密码过期天数
# useradd -f 30 inactiveuser
# grep “inactiveuser” /etc/shadow
inactiveuser:!!:19500:0:99999:7:30::
3.2 usermod命令修改用户
usermod命令用于修改已有用户的属性。
# 1. 修改用户登录名
# usermod -l newfgedu fgedu
# id newfgedu
uid=1000(newfgedu) gid=1000(fgedu) groups=1000(fgedu)
# 2. 修改用户UID
# usermod -u 3000 newfgedu
# id newfgedu
uid=3000(newfgedu) gid=1000(fgedu) groups=1000(fgedu)
# 3. 修改用户主组
# usermod -g developers newfgedu
# id newfgedu
uid=3000(newfgedu) gid=1001(developers) groups=1001(developers)
# 4. 添加用户到附加组
# usermod -aG wheel newfgedu
# id newfgedu
uid=3000(newfgedu) gid=1001(developers) groups=1001(developers),10(wheel)
# 5. 修改用户家目录
# usermod -d /data/newfgedu -m newfgedu
# grep “newfgedu” /etc/passwd
newfgedu:x:3000:1001::/data/newfgedu:/bin/bash
# 6. 修改用户登录shell
# usermod -s /bin/sh newfgedu
# grep “newfgedu” /etc/passwd
newfgedu:x:3000:1001::/data/newfgedu:/bin/sh
# 7. 修改用户注释
# usermod -c “System Administrator” newfgedu
# grep “newfgedu” /etc/passwd
newfgedu:x:3000:1001:System Administrator:/data/newfgedu:/bin/sh
# 8. 锁定用户账户
# usermod -L newfgedu
# grep “newfgedu” /etc/shadow
newfgedu:!$6$rounds=4096$xxx:19500:0:99999:7:::
# 9. 解锁用户账户
# usermod -U newfgedu
# grep “newfgedu” /etc/shadow
newfgedu:$6$rounds=4096$xxx:19500:0:99999:7:::
# 10. 设置用户过期时间
# usermod -e 2026-06-30 newfgedu
# chage -l newfgedu
Last password change : Apr 02, 2026
Password expires : never
Password inactive : never
Account expires : Jun 30, 2026
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
# 11. 修改用户组名
# groupmod -n newdevelopers developers
# id newfgedu
uid=3000(newfgedu) gid=1001(newdevelopers) groups=1001(newdevelopers),10(wheel)
# 12. 移动用户家目录内容
# mkdir -p /home/newfgedu
# usermod -d /home/newfgedu -m newfgedu
# ls -la /home/newfgedu/
total 12
drwx——. 2 newfgedu newdevelopers 62 Apr 2 10:00 .
drwxr-xr-x. 3 root root 17 Apr 2 10:00 ..
-rw-r–r–. 1 newfgedu newdevelopers 18 Apr 2 10:00 .bash_logout
-rw-r–r–. 1 newfgedu newdevelopers 141 Apr 2 10:00 .bash_profile
-rw-r–r–. 1 newfgedu newdevelopers 492 Apr 2 10:00 .bashrc
# 13. 修改用户密码过期天数
# usermod -f 60 newfgedu
# grep “newfgedu” /etc/shadow
newfgedu:$6$rounds=4096$xxx:19500:0:99999:7:60::
# 14. 批量修改用户附加组
# usermod -G wheel,docker,developers newfgedu
# id newfgedu
uid=3000(newfgedu) gid=1001(newdevelopers) groups=1001(newdevelopers),10(wheel),993(docker),1001(newdevelopers)
# 15. 修改用户为系统用户
# usermod -r newfgedu
（注意：此操作会修改用户UID为系统用户范围）
3.3 userdel命令删除用户
userdel命令用于删除用户账户。
# 1. 删除用户（保留家目录）
# userdel user1
# ls -la /home/user1/
total 12
drwx——. 2 user1 user1 62 Apr 2 10:00 .
drwxr-xr-x. 3 root root 17 Apr 2 10:00 ..
-rw-r–r–. 1 user1 user1 18 Apr 2 10:00 .bash_logout
-rw-r–r–. 1 user1 user1 141 Apr 2 10:00 .bash_profile
-rw-r–r–. 1 user1 user1 492 Apr 2 10:00 .bashrc
# 2. 删除用户及家目录
# userdel -r user2
# ls -la /home/user2
ls: cannot access ‘/home/user2’: No such file or directory
# 3. 强制删除用户（即使用户已登录）
# userdel -f user3
（注意：此操作可能导致数据丢失）
# 4. 删除用户前备份家目录
# tar -czf /backup/user3-home.tar.gz /home/user3
# userdel -r user3
# 5. 删除用户并保留邮件
# userdel user4
# ls -la /var/spool/mail/user4
-rw-rw—-. 1 user4 mail 0 Apr 2 10:00 /var/spool/mail/user4
# 6. 删除用户并删除邮件
# userdel -r user5
# ls -la /var/spool/mail/user5
ls: cannot access ‘/var/spool/mail/user5’: No such file or directory
# 7. 批量删除用户
# for user in user6 user7 user8; do
userdel -r $user
done
# 8. 删除用户前检查进程
# ps -u user9
PID TTY TIME CMD
1234 pts/0 00:00:00 bash
1235 pts/0 00:00:00 vim
# 终止用户进程
# pkill -u user9
# userdel -r user9
# 9. 删除用户前检查cron任务
# crontab -u user10 -l
no crontab for user10
# 删除用户cron任务
# crontab -u user10 -r
# userdel -r user10
# 10. 删除用户前检查at任务
# atq
1 Fri Apr 2 11:00:00 2026 a user11
# 删除用户at任务
# atrm 1
# userdel -r user11
# 11. 删除用户前检查sudo权限
# grep “user12” /etc/sudoers
user12 ALL=(ALL) ALL
# 删除sudo权限
# visudo
（删除相关行）
# userdel -r user12
# 12. 删除用户前检查文件所有权
# find /home -user user13 -ls
1234567 4 -rw-r–r– 1 user13 user13 1234 Apr 2 10:00 /home/user13/file.txt
# 更改文件所有权
# find /home -user user13 -exec chown root:root {} \;
# userdel -r user13
# 13. 删除用户并归档数据
# mkdir -p /archive/users
# tar -czf /archive/users/user14-$(date +%Y%m%d).tar.gz /home/user14 /var/spool/mail/user14
# userdel -r user14
# 14. 检查用户是否已删除
# id user15
id: ‘user15’: no such user
# 15. 删除用户组（如果组内无其他用户）
# grep “user16” /etc/group
user16:x:2016:
# groupdel user16
Part04-生产案例与实战讲解
4.1 批量创建用户案例
在生产环境中，经常需要批量创建用户，以下是一个完整的批量创建用户脚本。
# 1. 创建用户列表文件
# cat > /tmp/userlist.txt << EOF
dev001,Development Team,developers,wheel
dev002,Development Team,developers,wheel
ops001,Operations Team,ops,wheel
ops002,Operations Team,ops,wheel
dba001,DBA Team,dba,wheel
EOF
# 2. 批量创建用户脚本
# cat > /tmp/batch_create_users.sh << 'EOF'
#!/bin/bash
USERLIST="/tmp/userlist.txt"
LOGFILE="/tmp/user_creation.log"
# 创建日志文件
echo "User Creation Log - $(date)" > $LOGFILE
# 读取用户列表
while IFS=’,’ read -r username comment group groups; do
# 检查用户是否存在
if id $username &>/dev/null; then
echo “User $username already exists” | tee -a $LOGFILE
continue
fi
# 检查组是否存在
if ! grep “^$group:” /etc/group &>/dev/null; then
groupadd $group
echo “Group $group created” | tee -a $LOGFILE
fi
# 创建用户
useradd -c “$comment” -g $group -G $groups -m $username
# 设置初始密码
echo “Welcome@123” | passwd –stdin $username
# 强制用户首次登录修改密码
chage -d 0 $username
echo “User $username created successfully” | tee -a $LOGFILE
done < $USERLIST
echo "User creation completed" | tee -a $LOGFILE
EOF
# 3. 执行脚本
# chmod +x /tmp/batch_create_users.sh
# /tmp/batch_create_users.sh
User Creation Log - Fri Apr 2 10:00:00 CST 2026
Group developers created
User dev001 created successfully
User dev002 created successfully
Group ops created
User ops001 created successfully
User ops002 created successfully
Group dba created
User dba001 created successfully
User creation completed
# 4. 验证用户创建
# tail -n 10 /etc/passwd
dev001:x:2000:1001:Development Team:/home/dev001:/bin/bash
dev002:x:2001:1001:Development Team:/home/dev002:/bin/bash
ops001:x:2002:1002:Operations Team:/home/ops001:/bin/bash
ops002:x:2003:1002:Operations Team:/home/ops002:/bin/bash
dba001:x:2004:1003:DBA Team:/home/dba001:/bin/bash
# 5. 验证用户组
# id dev001
uid=2000(dev001) gid=1001(developers) groups=1001(developers),10(wheel)
# 6. 批量设置SSH密钥
# cat > /tmp/setup_ssh_keys.sh << 'EOF'
#!/bin/bash
for user in dev001 dev002 ops001 ops002 dba001; do
# 创建.ssh目录
mkdir -p /home/$user/.ssh
# 生成SSH密钥对
ssh-keygen -t rsa -b 4096 -f /home/$user/.ssh/id_rsa -N "" -C "$user@fgedu.net"
# 创建authorized_keys文件
touch /home/$user/.ssh/authorized_keys
# 设置权限
chmod 700 /home/$user/.ssh
chmod 600 /home/$user/.ssh/id_rsa
chmod 644 /home/$user/.ssh/id_rsa.pub
chmod 600 /home/$user/.ssh/authorized_keys
# 更改所有权
chown -R $user:$user /home/$user/.ssh
echo "SSH keys configured for $user"
done
EOF
# chmod +x /tmp/setup_ssh_keys.sh
# /tmp/setup_ssh_keys.sh
SSH keys configured for dev001
SSH keys configured for dev002
SSH keys configured for ops001
SSH keys configured for ops002
SSH keys configured for dba001
4.2 用户迁移案例
在服务器迁移或系统升级时，需要迁移用户账户和数据。
# 1. 源服务器导出用户信息
# 导出用户账户
# awk -F: ‘$3 >= 1000 && $3 != 65534 {print}’ /etc/passwd > /tmp/passwd.export
# cat /tmp/passwd.export
fgedu:x:1000:1000::/home/fgedu:/bin/bash
dev001:x:2000:1001:Development Team:/home/dev001:/bin/bash
dev002:x:2001:1001:Development Team:/home/dev002:/bin/bash
# 导出用户密码
# awk -F: ‘$1 != “root” && $1 != “nobody” {print}’ /etc/shadow > /tmp/shadow.export
# 导出用户组
# awk -F: ‘$3 >= 1000 && $3 != 65534 {print}’ /etc/group > /tmp/group.export
# cat /tmp/group.export
fgedu:x:1000:
developers:x:1001:
ops:x:1002:
dba:x:1003:
# 导出用户组密码
# awk -F: ‘$1 != “root” {print}’ /etc/gshadow > /tmp/gshadow.export
# 2. 打包用户家目录
# tar -czf /tmp/home.tar.gz /home
# 3. 打包用户邮件
# tar -czf /tmp/mail.tar.gz /var/spool/mail
# 4. 传输文件到目标服务器
# scp /tmp/*.export /tmp/*.tar.gz root@target-server:/tmp/
# 5. 目标服务器导入用户信息
# 导入用户组
# while read line; do
groupname=$(echo $line | cut -d: -f1)
if ! grep “^$groupname:” /etc/group &>/dev/null; then
echo $line >> /etc/group
fi
done < /tmp/group.export
# 导入用户账户
# while read line; do
username=$(echo $line | cut -d: -f1)
if ! grep "^$username:" /etc/passwd &>/dev/null; then
echo $line >> /etc/passwd
fi
done < /tmp/passwd.export
# 导入用户密码
# while read line; do
username=$(echo $line | cut -d: -f1)
if grep "^$username:" /etc/shadow &>/dev/null; then
sed -i “/^$username:/d” /etc/shadow
fi
echo $line >> /etc/shadow
done < /tmp/shadow.export
# 6. 解压用户家目录
# tar -xzf /tmp/home.tar.gz -C /
# 7. 解压用户邮件
# tar -xzf /tmp/mail.tar.gz -C /
# 8. 恢复SELinux上下文
# restorecon -Rv /home
# restorecon -Rv /var/spool/mail
# 9. 验证用户迁移
# id fgedu
uid=1000(fgedu) gid=1000(fgedu) groups=1000(fgedu)
# 10. 测试用户登录
# su - fgedu
Last login: Fri Apr 2 10:00:00 CST 2026 on pts/0
[fgedu@server ~]$
4.3 用户审计案例
定期审计用户账户是系统安全的重要环节。
# 1. 创建用户审计脚本
# cat > /tmp/user_audit.sh << 'EOF'
#!/bin/bash
REPORT="/tmp/user_audit_report.txt"
echo "========================================" > $REPORT
echo “User Audit Report – $(date)” >> $REPORT
echo “========================================” >> $REPORT
echo “” >> $REPORT
# 1. 统计用户总数
echo “1. User Statistics” >> $REPORT
echo “——————-” >> $REPORT
total_users=$(cat /etc/passwd | wc -l)
normal_users=$(awk -F: ‘$3 >= 1000 && $3 != 65534 {print}’ /etc/passwd | wc -l)
system_users=$(awk -F: ‘$3 < 1000 {print}' /etc/passwd | wc -l)
echo "Total users: $total_users" >> $REPORT
echo “Normal users: $normal_users” >> $REPORT
echo “System users: $system_users” >> $REPORT
echo “” >> $REPORT
# 2. 检查UID为0的账户
echo “2. UID 0 Accounts (Root Privileges)” >> $REPORT
echo “————————————” >> $REPORT
awk -F: ‘$3 == 0 {print $1}’ /etc/passwd >> $REPORT
echo “” >> $REPORT
# 3. 检查空密码账户
echo “3. Empty Password Accounts” >> $REPORT
echo “—————————” >> $REPORT
awk -F: ‘$2 == “” {print $1}’ /etc/shadow >> $REPORT
if [ $(awk -F: ‘$2 == “” {print}’ /etc/shadow | wc -l) -eq 0 ]; then
echo “No accounts with empty passwords found” >> $REPORT
fi
echo “” >> $REPORT
# 4. 检查未设置密码的账户
echo “4. Accounts Without Password Set” >> $REPORT
echo “——————————–” >> $REPORT
awk -F: ‘$2 == “!!” || $2 == “!” {print $1}’ /etc/shadow | head -n 10 >> $REPORT
echo “” >> $REPORT
# 5. 检查密码即将过期的账户
echo “5. Accounts with Password Expiring Soon (within 7 days)” >> $REPORT
echo “——————————————————–” >> $REPORT
for user in $(awk -F: ‘$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
chage -l $user | grep “Password expires” | grep -v “never” >> $REPORT
done
echo “” >> $REPORT
# 6. 检查账户即将过期的用户
echo “6. Accounts Expiring Soon (within 30 days)” >> $REPORT
echo “——————————————-” >> $REPORT
for user in $(awk -F: ‘$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
chage -l $user | grep “Account expires” | grep -v “never” >> $REPORT
done
echo “” >> $REPORT
# 7. 检查sudo权限用户
echo “7. Users with Sudo Privileges” >> $REPORT
echo “——————————” >> $REPORT
grep -v “^#” /etc/sudoers | grep -v “^$” | grep -v “^Defaults” >> $REPORT
echo “” >> $REPORT
# 8. 检查最近登录的用户
echo “8. Recent Login Activity (Last 10)” >> $REPORT
echo “———————————–” >> $REPORT
last | head -n 10 >> $REPORT
echo “” >> $REPORT
# 9. 检查失败登录尝试
echo “9. Failed Login Attempts” >> $REPORT
echo “————————-” >> $REPORT
lastb | head -n 10 >> $REPORT 2>/dev/null || echo “No failed login attempts recorded” >> $REPORT
echo “” >> $REPORT
# 10. 检查用户家目录权限
echo “10. Home Directory Permissions Check” >> $REPORT
echo “————————————-” >> $REPORT
for user in $(awk -F: ‘$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
home_dir=$(awk -F: -v u=$user ‘$1 == u {print $6}’ /etc/passwd)
if [ -d “$home_dir” ]; then
perms=$(stat -c “%a” $home_dir)
owner=$(stat -c “%U” $home_dir)
if [ “$owner” != “$user” ]; then
echo “$home_dir: Owner mismatch (expected $user, found $owner)” >> $REPORT
fi
if [ “$perms” != “700” ]; then
echo “$home_dir: Permission is $perms (recommended 700)” >> $REPORT
fi
fi
done
echo “” >> $REPORT
echo “Audit completed. Report saved to $REPORT”
EOF
# 2. 执行审计脚本
# chmod +x /tmp/user_audit.sh
# /tmp/user_audit.sh
Audit completed. Report saved to /tmp/user_audit_report.txt
# 3. 查看审计报告
# cat /tmp/user_audit_report.txt
========================================
User Audit Report – Fri Apr 2 10:00:00 CST 2026
========================================
1. User Statistics
——————-
Total users: 45
Normal users: 5
System users: 40
2. UID 0 Accounts (Root Privileges)
————————————
root
3. Empty Password Accounts
—————————
No accounts with empty passwords found
4. Accounts Without Password Set
——————————–
bin
daemon
adm
lp
sync
shutdown
halt
mail
operator
games
5. Accounts with Password Expiring Soon (within 7 days)
——————————————————–
6. Accounts Expiring Soon (within 30 days)
——————————————-
7. Users with Sudo Privileges
——————————
root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL
8. Recent Login Activity (Last 10)
———————————–
root pts/0 192.168.1.100 Fri Apr 2 10:00 still logged in
reboot system boot 5.14.0-70.el10 Fri Apr 2 09:00 still running
9. Failed Login Attempts
————————-
No failed login attempts recorded
10. Home Directory Permissions Check
————————————-
Part05-风哥经验总结与分享
5.1 用户管理最佳实践
# 1. 用户创建规范
– 使用统一的命名规范
– 设置强密码策略
– 配置密码过期时间
– 设置账户过期时间（临时用户）
– 添加用户描述信息
– 配置合适的用户组
– 设置正确的家目录权限
# 2. 用户权限管理
– 最小权限原则
– 使用sudo代替root
– 定期审计sudo权限
– 禁止root直接SSH登录
– 使用SSH密钥认证
# 3. 用户生命周期管理
– 入职：创建账户、设置权限、配置环境
– 在职：定期审计、权限调整
– 离职：禁用账户、备份数据、删除账户
# 4. 用户安全审计
– 定期检查用户列表
– 检查异常登录
– 检查sudo使用记录
– 检查用户权限变更
– 检查密码策略合规性
# 5. 用户管理自动化
– 使用脚本批量创建用户
– 使用配置管理工具（Ansible）
– 建立用户管理流程
– 记录用户变更日志
– 定期生成审计报告
5.2 常见问题与解决
# 问题1：用户创建失败
# useradd testuser
useradd: user ‘testuser’ already exists
# 解决：检查用户是否存在
# id testuser
# grep “testuser” /etc/passwd
# 问题2：用户无法登录
# su – testuser
This account is currently not available.
# 解决：检查用户shell
# grep “testuser” /etc/passwd
testuser:x:1000:1000::/home/testuser:/sbin/nologin
# 修改用户shell
# usermod -s /bin/bash testuser
# 问题3：用户密码无法修改
# passwd testuser
Changing password for user testuser.
passwd: Authentication token manipulation error
# 解决：检查文件权限
# ls -l /etc/passwd /etc/shadow
-rw-r–r–. 1 root root 1234 Apr 2 10:00 /etc/passwd
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/shadow
# 修复权限
# chmod 644 /etc/passwd
# chmod 600 /etc/shadow
# 问题4：用户家目录丢失
# ls -la /home/testuser
ls: cannot access ‘/home/testuser’: No such file or directory
# 解决：重建家目录
# mkdir -p /home/testuser
# cp -r /etc/skel/. /home/testuser/
# chown -R testuser:testuser /home/testuser
# chmod 700 /home/testuser
# 问题5：用户组丢失
# id testuser
id: cannot find name for group ID 1000
# 解决：重建用户组
# groupadd -g 1000 testuser
# 问题6：用户被锁定
# su – testuser
Account locked due to failed logins
# 解决：解锁用户
# usermod -U testuser
# faillock –user testuser –reset
# 问题7：用户磁盘配额超限
# edquota testuser
（调整配额限制）
# 问题8：用户进程无法终止
# pkill -u testuser
（进程仍在运行）
# 解决：强制终止
# pkill -9 -u testuser
# 问题9：用户cron任务失效
# crontab -u testuser -l
no crontab for testuser
# 解决：检查cron服务
# systemctl status crond
# systemctl restart crond
# 问题10：用户邮件无法接收
# ls -la /var/spool/mail/testuser
ls: cannot access ‘/var/spool/mail/testuser’: No such file or directory
# 解决：创建邮件文件
# touch /var/spool/mail/testuser
# chown testuser:mail /var/spool/mail/testuser
# chmod 660 /var/spool/mail/testuser
5.3 用户管理工具推荐
- 命令行工具：useradd, usermod, userdel, passwd, chage
- 图形化工具：system-config-users（RHEL）
- 配置管理：Ansible user module
- 集中管理：LDAP, FreeIPA, Active Directory
- 审计工具：last, lastb, lastlog, ausearch
# 1. 创建Ansible playbook
# cat > /tmp/manage_users.yml << 'EOF'
---
- name: Manage Users
hosts: all
become: yes
vars:
users:
- name: dev001
comment: "Development User 001"
group: developers
groups: wheel,docker
shell: /bin/bash
password: "{{ 'Welcome@123' | password_hash('sha512') }}"
expires: 1735689600 # 2025-01-01
- name: ops001
comment: "Operations User 001"
group: ops
groups: wheel
shell: /bin/bash
password: "{{ 'Welcome@123' | password_hash('sha512') }}"
tasks:
- name: Create groups
group:
name: "{{ item }}"
state: present
loop:
- developers
- ops
- dba
- name: Create users
user:
name: "{{ item.name }}"
comment: "{{ item.comment }}"
group: "{{ item.group }}"
groups: "{{ item.groups }}"
shell: "{{ item.shell }}"
password: "{{ item.password }}"
expires: "{{ item.expires | default(omit) }}"
state: present
loop: "{{ users }}"
- name: Force password change on first login
command: chage -d 0 {{ item.name }}
loop: "{{ users }}"
changed_when: false
- name: Setup SSH authorized keys
authorized_key:
user: "{{ item.name }}"
key: "{{ lookup('file', '/tmp/' + item.name + '.pub') }}"
state: present
loop: "{{ users }}"
when: item.ssh_key is defined
EOF
# 2. 执行Ansible playbook
# ansible-playbook -i inventory /tmp/manage_users.yml
# 3. 使用Ansible ad-hoc命令创建用户
# ansible all -m user -a "name=testuser comment='Test User' shell=/bin/bash" -b
# 4. 使用Ansible删除用户
# ansible all -m user -a "name=testuser state=absent remove=yes" -b
本文由风哥教程整理发布,仅用于学习测试使用,转载注明出处:http://www.fgedu.net.cn/10327.html
联系我们
在线咨询：
微信号：itpux-com
工作日：9:30-18:30，节假日休息
