Freia Staff Page

Managing the user account on host freia

Password policy

Change in password policies

See Server World: Pwquality : Set Password Rules

Increase the password length to 16 from too low limit of 5 in /etc/login.defs ...

...
# Password aging controls:
#
#       PASS_MAX_DAYS   Maximum number of days a password may be used.
#       PASS_MIN_DAYS   Minimum number of days allowed between password changes.
#       PASS_MIN_LEN    Minimum acceptable password length.
#       PASS_WARN_AGE   Number of days warning given before a password expires.
#
PASS_MAX_DAYS   99999
PASS_MIN_DAYS   0
PASS_MIN_LEN    16
PASS_WARN_AGE   7
...

Update /etc/pam.d/system-auth to remember last 5 passwords ...

password    sufficient   pam_unix.so sha512 shadow nullok use_authtok remember=5

Update password 'quality' in /etc/security/pwquality.conf ...

# Changed, from 8, minimum length.
minlen = 16

# Changed, from 0, 'maximum number of allowed consecutive same characters'.
maxrepeat = 3

# Changed, from 0, to 'check for the words from the passwd entry GECOS string of
# the user'
gecoscheck = 1

Generate above policy-following password

Install apg package ...

dnf install apg

Generate one password (-n 1) between 16-24 characters (-m 16 -x 24) that is 'pronounceable' (-a 0) ...

apg -n 1 -m 16 -x 24 -a 0

... a wrapper script on the above has been installed in /root/src/rocky-linux.git/password/generate-password.sh. It is also in /usr/local/bin/make-password.sh.

Helper Software

Password

/root/src/rocky-linux.git/password/generate-password.sh

Generate 5 passwords of random letters.

/root/src/freia.git/guest-account/set-password.sh
Set password for a given account & make it expire immediately so that it would be changed by the account holder on login.

/root/src/freia.git/guest-account/set-password-not-expire.sh

Set the password but do not expire it.
Home directory

/root/src/freia.git/guest-account/reset-guest-home-dir.sh

Remove existing files for a given account; copy files from /aux1/guest_template/ directory.
Addition of guest account: Password + Home directory

/root/src/freia.git/guest-account/add-local-guest-account.sh

Adds guest account only if one does not already exist: password is set by freia.git/guest-account/set-password.sh & home directory is set up by freia.git/reset-guest-home-dir.sh.

/root/src/freia.git/guest-account/add-local-guest-account-no-expired-pasword.sh

Add guest account as above but password is not expired immediately.

Assigning an new account

See Helper Software section to set the passwords & to (re)seed the home directory.

As superuser: stop the VNC server; (re)set the home directory start the VNC server.

   ## Stop the user VNC server.
   systemctl stop    vncserver@:N.service

   ## (Re)Seed home directory.
   cd /aux1/fguestN

   find '/aux1/fguestN' -xdev -mindepth 1 \( -not -name '.' \) -print0 \
   | xargs -0 rm -frv

   ( cd /aux1/guest_template && tar cvf - . ) | tar xvf -

   ## Set password.
   # - Generate 5 passwords.
   apg -n 5 -m 18 -x 24 -a 0

   # - login password - Choose one from above list.
   passwd fguestN

   # - Change to guest user to set VNC password.
   #   Select 8-character string from above list other than the used for the
   #   login password
   su fguestN
   vncpasswd
   exit

   ## Start VNC server.
   systemctl enable vncserver@:N.service
   systemctl start  vncserver@:N.service

Log in via VNC and test
- disable screensaver & lock screen, display power management (Power Manager) via Applications -> Settings -> Screensaver.
Expire the above set password to force the user to set a new password ...
```
   passwd -e fguestN
```
Email user with (see email template for new account):
- account information;
- contact for help with login & VNC;
- contact for support scientist.

Passwords Transfer

Fill in the passwords template for SSH|login & VNC server passwords;
upload the filled version to UH FileDrop;
supply the email address of the new account holder as the recipient.

Account History

See account-use.

Deactivating an account

- Notify about the account already expired due removal (account holder also had not requested an extension), see the related mail template.
- And/Or, notify the user via email that account is about to expire & inform that account could be extend on request (see email template for account about to expire).
In case of account BEING EXTENDED: make a note under Current Users list and SKIP the NEXT step.
In case of account NOT being EXTENDED ...
1. Stop & disable the VNC server: systemctl stop vncserver@:N.service && systemctl disable vncserver@:N.service.
2. Change passwd, vncpasswd to deny access. (See agp ... command to generate a password.)
3. Remove the user via userdel fguestN command. You may need to kill(1) the processes if notified of something being in use during userdel(8).