Let’s look at the options we have when we add a new FreeBSD user with the adduser command: Full name of the new user. User ID. If left blank, it will be assigned it’s own uid starting in the range 1000+. User login group. At this step, the new user can be added to an existing login group or, if left blank,a new group having the same name as the user. We also have the possibility to add the new users other groups. Login class. FreeBSD login classes are security restrictive groups that limit users’ utilized resources, password format, and more. For more details look at /etc/login.conf file or at man login.conf. The next options are self explanatory, but they still ned to be read carefully.
$ adduser Username: vpsie1 Full name: Vpsie test user 1 Uid (Leave empty for default): ^C [[email protected] ~]$ adduser Username: vpsie1 Full name: FreeBSD VPSie user 1 Uid (Leave empty for default): Login group [vpsie1]: Login group is vpsie1. Invite vpsie1 into other groups? : Login class [default]: Shell (sh csh tcsh bash rbash git-shell nologin) [sh]: bash Home directory [/home/vpsie1]: Home directory permissions (Leave empty for default): Use password-based authentication? [yes]: Use an empty password? (yes/no) [no]: Use a random password? (yes/no) [no]: Enter password: Enter password again: Lock out the account after creation? [no]: Username : vpsie1 Password : ***** Full Name : FreeBSD VPSie user 1 Uid : 1004 Class : Groups : vpsie1 Home : /home/vpsie1 Home Mode : Shell : /usr/local/bin/bash Locked : no OK? (yes/no): y adduser: INFO: Successfully added (vpsie1) to the user database. Add another user? (yes/no): n Goodbye!
Let’s construct the one line command for adding the new user:
pw [-V etcdir] useradd [name|uid] [-C config] [-q] [-n name] [-u uid] [-c comment] [-d dir] [-e date] [-p date] [-g group] [-G grouplist] [-m] [-M mode] [-k dir] [-w method] [-s shell] [-o] [-L class] [-h fd | -H fd] [-N] [-P] [-Y] The following options apply to the useradd and usermod commands: -n name Specify the user/account name. -u uid Specify the user/account numeric id. -c comment This field sets the contents of the passwd GECOS field, which normally contains up to four comma-separated fields containing the user's full name, office or location, and work and home phone numbers. -d dir This option sets the account's home directory. Normally, you will only use this if the home directory is to be dif- ferent from the default determined from /etc/pw.conf - nor- mally /home with the account name as a subdirectory. -e date Set the account's expiration date. -g group Set the account's primary group to the given group. group may be defined by either its name or group number. -G grouplist Set additional group memberships for an account. grouplist is a comma, space or tab-separated list of group names or group numbers. -L class This option sets the login class for the user being cre- ated. See login.conf(5) and passwd(5) for more information on user login classes. -m This option instructs pw to attempt to create the user's home directory. -s shell Set or changes the user's login shell to shell. -h fd This option provides a special interface by which interac- tive scripts can set an account password using pw. Because the command line and environment are fundamentally insecure mechanisms by which programs can accept information, pw will only allow setting of account and group passwords via a file descriptor (usually a pipe between an interactive script and the program). sh, bash, ksh and perl all pos- sess mechanisms by which this can be done. Alternatively, pw will prompt for the user's password if -h 0 is given, nominating stdin as the file descriptor on which to read the password. Note that this password will be read only once and is intended for use by a script rather than for interactive use. If you wish to have new password confir- mation along the lines of passwd(1), this must be imple- mented as part of an interactive script that calls pw.
You will be prompted to provide the new user’s password.
$ sudo pw useradd -n newuser -e 01-09-2018 -m -s /usr/local/bin/bash -h 0 -L default -c "New user on FreeBSD" password for user newuser:
The above enforces the following to: – forces old password to be entered AND – 12 characters if they are from 3 character classes OR – 10 characters if they are from 4 character classes AND – denies new password if it is similar to old one AND – enforce the above restrictions for non-root users.
$ sudo cat /etc/pam.d/passwd password requisite pam_passwdqc.so min=disabled,disabled,disabled,12,10 similar=deny ask_oldauthtok enforce=users password required pam_unix.so no_warn try_first_pass nullok
$ sudo pw usershow newuser newuser:*:1005:1005:default:0:1535756400:New user on FreeBSD:/home/newuser:/usr/local/bin/bash
FreeBSD passwords are kept in /etc/master.passwd file. By locking a user, the system will add a *LOCKED* string in front of the password hash:
$ sudo pw lock newuser $ sudo su - newuser su: Sorry
Similarly, to unlock the user:
$ sudo pw unlock newuser
This should provide the basic understanding of user management under FreeBSD. Please post your comments if you disagree or wish to request a tutorial.
$ sudo pw userdel -n newuser
You can actually create this setup on our platform in few minutes utilizing our PCS (Private Cloud Solution) which allows you to have VPSie(s) on a private network – NAT – Port forward – traffic control for inbound and outbound – multiple gateway IPs which you could use for the load-balancing and failover.