AIX User Config | |
| The following document contains a description of the user management functions available through the System Management Interface Tool (smit). Before configuring any person as a user, a unique User ID number must be obtained for each user. This number must be between 1100 and 4,294,967,295 and should be unique for this user enterprise wide. This document assumes the following have been performed for each person to be configured as a user:
Login to the AIX system where you wish to manage users. The users management smit menu should automatically appear, but if not, run the following command at the command prompt to start the smit menu:
Notice the key definitions at the bottom of the screen. If you are using a "VT100" terminal emulation, which you probably are if you have used telnet to gain access to the system, then you will only be able to use the first four function keys. Other functions may be executed by pressing the " ESC" key and a number key in quick succession.To add a user to this AIX system, select the menu item labeled " Add a User" and press the key associated with the "Do" function.
Enter the user information for the following fields:The rest of the fields for the user definition should default to the values shown above. If not, set them as shown. When finished, press the key associated with the " Do" function.The " User Name" field is an enterprise wide unique name for this person which is formulated from the first letter of the persons first name, the first four letters of the persons last name (or in the event their last name is less than four letters, then use their entire last name), plus a two digit number maintained by the information security group.The " User ID" field is a calculated value using the following script which is on all Mt Xia's Fort Worth AIX systems:mkuid" script, enter the full path name of the script followed by the user name of the person being configured. For example, to determine the UID of the user "John Doe", enter the following at an AIX command prompt:
This script will return a single line of output which contains the user name you supplied on the command line, followed by a colon, followed by a numeric value which represents the User ID (UID) for this user name. For the user " jdoe00", the script will return the following output:jdoe00:11505355 The "Primary GROUP" field must be assigned by the person requesting the new user, the application administrator, and the opensystems group.The " Group SET" field must also be assigned by the person requesting the new user, the application administrator, and the opensystems group.The " HOME Directory" field should contain the full path name of the users home directory. The home directory of each users will vary and should be determined as specified in the Special Requirements document.The " User INFORMATION" field should contain the users first and last names, followed my their phone number. The syntax of entering this information should be as follows:User INFORMATION" should be entered as:If the user is created successfully, the " Command:" field in the upper left corner of the screen will show an "OK" status. If not, it will show a "FAILED" status. When finished, press the key associated with the "Cancel" function.After creating a new user, the password must be initialized in order to allow the user to login. Or if the user has forgotten his/her password, their password can be reset by a user administrator. Whenever the password is reset by an administrator, the user will be prompted to change that password the first time they login after the password reset. Normally you will only be able to reset your own password using this menu selection. To initialize or change another users password, go to the section of this document titled "Initializing Passwords". In order to user the SMIT menus to change a users password, the users old password must be known. If you know the users old password and want to change it, select the menu option labeled " Change a User's Password" and press the key associated with the "Do" function.Enter the user name of the person who requires a password initialization or reset. When finished, press the key associated with the " Do" function.Enter a password for this user. As you are entering the password, the characters will NOT be echoed to the screen while you are typing. This is to prevent an observer from seeing the password. Since you will not be able to see any typing mistakes you may have made while entering the password, you will be required to enter the password twice. If the two instances of the password match, the password will be initialized/reset. If the two instances do not match, you will be informed of this and permitted to re-enter the password. You may enter another user name to initialize/reset their password, or return to the previous menu by pressing the key associated with the " Cancel" function.If for some reason a mistake was made while creating a user, or the user information has changed, you will need to change the characteristics associated with that user on EVERY machine to which that user has access. To change the characteristics of a user, select the menu item labeled " Change / Show Characteristics of a User" and press the key associated with the "Do" function.Enter the user name of the person for whom you wish to change their user characteristics. When finished, press the key associated with the " Do" function.Change all fields which require modification. Do NOT change the " User ID" field. If the "User ID" field requires modification, contact the opensystems on-call person to assist with this modification. When finished, press the key associated with the "Do" function.If the user is changed successfully, the " Command:" field in the upper left corner of the screen will show an "OK" status. If not, it will show a "FAILED" status. When finished, press the key associated with the "Cancel" function.Press the key associated with the " Cancel" function.Allows a system administrator to lock or unlock a user's account. When a user's account is locked, no one can login to that account. When a user's account is unlocked, anyone who knows the correct password can login to the account. This option will NOT unlock a user's account that was locked as a result of too many failed login attempts. Note: To unlock a user's account that was locked because of too many failed logins, the system administrator can use the Reset User's Failed Login Count menu item under the Users menu item of the Security & Users menu. When an account is locked, it can only be unlocked by a user administrator. There will be requirements to intentionally lock users accounts on backup systems which are part of an HACMP cluster. To lock or unlock a users account user, select the menu item labeled " Lock / Unlock a User's Account" and press the key associated with the "Do" function.Enter the user name of the person whose account you wish to lock or unlock, and press the key associated with the " Do" function.Move the cursor to the field associate with the prompt which says " Is this user ACCOUNT LOCKED?" and press the key associated with the "List" function.A selection list will appear which provides you with the ability to select " true" or "false" as your response to the prompt. If this users account is currently locked and you wish to unlock it, select "true". If this users account is currenty unlocked and you wish to lock it, select "false". When finished selecting the appropriate response, press the key associated with the "Do" function.The selection list will disappear and your selection will be reflected in the entry field associated with the prompt " Is this user ACCOUNT LOCKED?". Press the key associated with the "Do" function.If the user account is successfully locked, the " Command:" field in the upper left corner of the screen will show an "OK" status. If not, it will show a "FAILED" status. When finished, press the key associated with the "Cancel" function.You may enter another user name to lock or unlock their account, or return to the previous menu by pressing the key associated with the " Cancel" function.When the count of consecutive unsuccessful login attempts exceeds the number allowed (currently set to three attempts), the account is locked and the user cannot login. When an account is locked, it can only be unlocked by a user administrator. To reset the count of consecutive unsuccessful login attempts on a user's account, which will allow the user to try to login again, select the menu item labeled " Reset User's Failed Login Count" and press the key associated with the "Do" function.Enter the user name of the person whose account you wish to reset the count of consecutive unsuccessful login attempts, and press the key associated with the " Do" function.If the unsuccessful login count is successfully reset for this user name, the " Command:" field in the upper left corner of the screen will show an "OK" status. If not, it will show a "FAILED" status. When finished, press the key associated with the "Cancel" function.You may enter another user name to reset the unsuccessful login count, or return to the previous menu by pressing the key associated with the " Cancel" function.Removing a user account deletes the attributes defined for a user, but does NOT remove the user's home directory or files the user owns. Whenever a user is removed from a system, the opensystems group should be notified in order to clean-up and reassign file ownership of the removed users files. To remove a user account from the system, select the menu item labeled " Remove a User" and press the key associated with the "Do" function.Enter the user name of the person whose account you wish to remove from the system. By answering " yes" in the "Remove Authentication Information?" option, the system will remove the user's password and other user authentication information. Press the key associated with the "Do" function to remove the user.Press the " Enter" key to continueIf the user name is successfully removed from the system, the " Command:" field in the upper left corner of the screen will show an "OK" status. If not, it will show a "FAILED" status. When finished, press the key associated with the "Cancel" function.You may enter another user name to remove from the system, or return to the previous menu by pressing the key associated with the " Cancel" function.To obtain a list of all users which currently exist on the system, select the menu item labeled " List All Users" and press the key associated with the "Do" function.select the When finished view the list of users, return to the previous menu by pressing the key associated with the " Cancel" function.To exit the user administration menu, press the key associated with the " Cancel" function.Initializing PasswordsTo initialize a users password or if the old password of the user is not known, use the following method to reset a users password. From a command prompt:
Where <USER NAME> represents the user name of the person for whom you wish to change their password. For more information about the " pwdadm" command see the manual page.For example, to change the password of the user " jdoe00":
Note: The system will require the user administrator to enter their password in order to confirm their identity, before allowing them to change the users password. Root users and members of the security group should not change their personal password with this command. These users should use the " passwd" command. For more information about the "passwd" command see the manual page.If a password is entered that does not conform to the MSB accepted standards, a message similar to the following will be displayed:
User Administration
Required AIX Commands |