Diversity and Inclusion vi

Authentication in Oracle Linux 1-1

Profiles and Supported Features 1-1

About the authselect Utility 1-3

Displaying Profile Information 2-1

Configuring Profile Features 2-1

About Pluggable Authentication Modules 3-4

About User and Group Accounts 4-1

Where User and Group Information Is Stored Locally 4-1

Creating User Accounts 4-2

Locking an Account 4-3

Modifying or Deleting User Accounts 4-3

About Administrative Access on Oracle Linux 5-1

Using the sudo Command 5-2

Using the visudo Command 5-3

Adding User Authorizations in the sudoers.d Directory 5-4

Adding User Authorizations in the sudoers File 5-4

Using Groups to Manage User Authorizations 5-5

Oracle Linux 9: Setting Up System Users and Authentication provides information about how

The following text conventions are used in this document:

Conformance Report at https://www.oracle.com/corporate/accessibility/templates/

t2-11535.html.

Oracle customers that have purchased support have access to electronic support through My

Oracle Support. For information, visit https://www.oracle.com/corporate/accessibility/learning-

support.html#support-tab.

Oracle is fully committed to diversity and inclusion. Oracle respects and values having

a diverse workforce that increases thought leadership and innovation. As part of our

take time and external cooperation.

Authentication is a way of implementing system security by verifying the identity of an entity,

such as a user, to a system. A user logs in by providing a username and a password, and the

OS authenticates the user's identity by comparing this information to data stored on the

authenticated and can successfully access the system.

The following profiles are available:

•

authentication, Kerberos, and so on.

System authentication isn't restricted to using only the profiles in Oracle Linux. If preferred,

you can also use profiles that might be supplied by vendors. You can also create customized

profiles to enforce authentication that complies organizational requirements.

As an added flexibility, you can also reconfigure profiles by revising their active features. For

example, you can set the profile to use various different backend directory services such as

LDAP, FreeIPA, and Active Directory. Also, you can use SSSD with a directory service to

centralize and simplify user and group management in an environment where many users

and systems with different access requirements exist.

The following tables shows the profiles and their corresponding supported features:

The

The System Security Services Daemon (SSSD) feature provides access on a client system to

remote identity and authentication providers. The SSSD acts as an intermediary between

local clients and any back-end provider that you configure.

The benefits of configuring SSSD include the following:

• Reduced system load

• Offline authentication

• Single sign-on access

managing access and authentication on a system. No further configuration is required, unless

you wish to use different authentication services or wish to customize the configuration to use

alternative values to the default settings.

See https://sssd.io/ for more information about SSSD.

By default the SSSD service used by the

(PAM) and the Name Service Switch (NSS) for managing access and authentication on a

system. As you enable additional features for the profile to customize SSSD authentication,

you must also configure SSSD for the enabled feature.

You customize an SSSD configuration by creating configuration files within the /etc/sssd/

LDAP provider with Kerberos configured:

1. Create a configuration file for the feature and store it in /etc/sssd/conf.d, for

type, a control flag, the name of a module such as

or the name of an included

authentication modules as shared libraries in /usr/lib64/security.

For a particular operation type, PAM reads the stack from top to bottom and calls the modules

listed in the configuration file. Each module generates a success or failure result when called.

The following operation types are defined for use:

The module tests whether a user is authenticated or authorized to use a service or

application. For example, the module might request and verify a password. Such modules

can also set credentials, such as a group membership or a Kerberos ticket.

The module tests whether an authenticated user is allowed access to a service or

unmounting a user's home directory.

If the operation type is preceded with a dash (

), PAM does not add an create a system log

entry if the module is missing.

Except for

The following control flags are defined for use:

The module is required for authentication if it's the only module listed for a service.

The module must succeed for access to be granted. PAM continues to mprocess the

remaining modules in the stack whether the module succeeds or fails. PAM doesn't

If the module succeeds, PAM doesn't process any remaining modules of the same operation

type. If the module fails, PAM processes the remaining modules of the same operation type

to determine overall success or failure.

The control flag field can also define one or more rules that specify the action that PAM takes

depending on the value that a module returns. Each rule takes the form

, and

the rules are enclosed in square brackets, for example:

action, or, if there is no match, it uses the default action.

The

specified as the argument.

By default, a new installation of Oracle Linux uses local user and group accounts for

authentication, permissions handling, and access to resources. When working with local

accounts for users and groups, you use three main commands:

, and

and groups, as well as modify user or group settings.

To implement system authentication, Oracle Linux uses two types of accounts: user and

group. Together, these accounts hold information such as passwords, home directories for

users, login shells, group settings and memberships, and so on. The information is used to

ensure that only authorized logins are granted access to the system. Users without

credentials, or whose credentials do not match the information in these accounts, are locked

out of the system.

By default, user and group information is located locally in the system. However, in an

enterprise environment that might have hundreds of servers and thousands of users, user

Unless you select a different authentication mechanism during installation or use the

authselect command to create an authentication profile, Oracle Linux verifies a user's

identity by using the information that is stored in the /etc/passwd and /etc/shadow files.

The /etc/passwd file stores account information for each user such as his or her unique

user ID (or UID, which is an integer), username, home directory, and login shell. A user logs

in using his or her username, but the operating system uses the associated UID. When the

user logs in, he or she is placed in his or her home directory and his or her login shell runs.

The /etc/group file stores information about groups of users. A user also belongs to one or

more groups, and each group can contain one or more users. If you can grant access

privileges to a group, all members of the group receive the same access privileges. Each

password files are readable only by the administraor. The administrator can set a group

not have a password, a user can only join the group if the administrator adds that user

as a member.

A user can use the newgrp command to log into a new group or to change the current

group ID during a login section. If the user has a password, he or she can add group

membership on a permanent basis. See the

manual page.

The /etc/login.defs file defines parameters for password aging and related

security policies.

For more information about the content of these files, see the

,

,

manual pages.

as the user's

A maxmimum of 32 characters can be used for a username.

Usernames can begin with lowercase (a-z) and uppercase (A-Z) letters,

digits (0-9), or underscores (_).

Usernames can contain all starting characters but can also contain

dashes (-) and can end with a dollar character ($).

Fully numeric usernames and usernames containing only a period (.) or

double period (..) are disallowed.

For more information, see the

,

manual pages.

To create users by using the web-based GUI, see Oracle Linux: Using the Cockpit Web

Console.

To lock a user's account, use the passwd -l command.

For example, to add a user to a supplementary group (other than the user's default login

group):

You can use the groups command to display the groups to which a user belongs, for

example:

To delete a user's account, use the userdel command:

For more information, see the

,

and

manual pages.

To display the default settings for a user account, use the following command:

page. You can create aliases in the following format:

In addition, you can also add several comma separated aliases on the same line. For

packages:

Instead of specifying different levels of

optionally manage

access at group level by adding the

symbol to the group name.

For example, to define permissions for an existing group called

in the /etc/

sudoers.d/ directory and then add the user

to that group:

1. Create the /etc/sudoers.d/example file by using the

2. Grant the

user

2. Remove the comment

symbol from the beginning of the following line in

3. Add the

user to the

group to grant them full