96 lines
3.5 KiB
XML
96 lines
3.5 KiB
XML
|
<chapter xmlns="http://docbook.org/ns/docbook"
|
|||
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|||
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|||
|
|
version="5.0"
|
|||
|
|
xml:id="sec-user-management">
|
|||
|
|
|
|||
|
|
<title>User Management</title>
|
|||
|
|
|
|||
|
|
<para>NixOS supports both declarative and imperative styles of user
|
|||
|
|
management. In the declarative style, users are specified in
|
|||
|
|
<filename>configuration.nix</filename>. For instance, the following
|
|||
|
|
states that a user account named <literal>alice</literal> shall exist:
|
|||
|
|
|
|||
|
|
<programlisting>
|
|||
|
|
users.extraUsers.alice =
|
|||
|
|
{ createHome = true;
|
|||
|
|
home = "/home/alice";
|
|||
|
|
description = "Alice Foobar";
|
|||
|
|
extraGroups = [ "wheel" "networkmanager" ];
|
|||
|
|
useDefaultShell = true;
|
|||
|
|
openssh.authorizedKeys.keys = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
|
|||
|
|
};
|
|||
|
|
</programlisting>
|
|||
|
|
|
|||
|
|
Note that <literal>alice</literal> is a member of the
|
|||
|
|
<literal>wheel</literal> and <literal>networkmanager</literal> groups,
|
|||
|
|
which allows her to use <command>sudo</command> to execute commands as
|
|||
|
|
<literal>root</literal> and to configure the network, respectively.
|
|||
|
|
Also note the SSH public key that allows remote logins with the
|
|||
|
|
corresponding private key. Users created in this way do not have a
|
|||
|
|
password by default, so they cannot log in via mechanisms that require
|
|||
|
|
a password. However, you can use the <command>passwd</command> program
|
|||
|
|
to set a password, which is retained across invocations of
|
|||
|
|
<command>nixos-rebuild</command>.</para>
|
|||
|
|
|
|||
|
|
<para>If you set users.mutableUsers to false, then the contents of /etc/passwd
|
|||
|
|
and /etc/group will be congruent to your NixOS configuration. For instance,
|
|||
|
|
if you remove a user from users.extraUsers and run nixos-rebuild, the user
|
|||
|
|
account will cease to exist. Also, imperative commands for managing users
|
|||
|
|
and groups, such as useradd, are no longer available.</para>
|
|||
|
|
|
|||
|
|
<para>A user ID (uid) is assigned automatically. You can also specify
|
|||
|
|
a uid manually by adding
|
|||
|
|
|
|||
|
|
<programlisting>
|
|||
|
|
uid = 1000;
|
|||
|
|
</programlisting>
|
|||
|
|
|
|||
|
|
to the user specification.</para>
|
|||
|
|
|
|||
|
|
<para>Groups can be specified similarly. The following states that a
|
|||
|
|
group named <literal>students</literal> shall exist:
|
|||
|
|
|
|||
|
|
<programlisting>
|
|||
|
|
users.extraGroups.students.gid = 1000;
|
|||
|
|
</programlisting>
|
|||
|
|
|
|||
|
|
As with users, the group ID (gid) is optional and will be assigned
|
|||
|
|
automatically if it’s missing.</para>
|
|||
|
|
|
|||
|
|
<warning><para>Currently declarative user management is not perfect:
|
|||
|
|
<command>nixos-rebuild</command> does not know how to realise certain
|
|||
|
|
configuration changes. This includes removing a user or group, and
|
|||
|
|
removing group membership from a user.</para></warning>
|
|||
|
|
|
|||
|
|
<para>In the imperative style, users and groups are managed by
|
|||
|
|
commands such as <command>useradd</command>,
|
|||
|
|
<command>groupmod</command> and so on. For instance, to create a user
|
|||
|
|
account named <literal>alice</literal>:
|
|||
|
|
|
|||
|
|
<screen>
|
|||
|
|
$ useradd -m alice</screen>
|
|||
|
|
|
|||
|
|
The flag <option>-m</option> causes the creation of a home directory
|
|||
|
|
for the new user, which is generally what you want. The user does not
|
|||
|
|
have an initial password and therefore cannot log in. A password can
|
|||
|
|
be set using the <command>passwd</command> utility:
|
|||
|
|
|
|||
|
|
<screen>
|
|||
|
|
$ passwd alice
|
|||
|
|
Enter new UNIX password: ***
|
|||
|
|
Retype new UNIX password: ***
|
|||
|
|
</screen>
|
|||
|
|
|
|||
|
|
A user can be deleted using <command>userdel</command>:
|
|||
|
|
|
|||
|
|
<screen>
|
|||
|
|
$ userdel -r alice</screen>
|
|||
|
|
|
|||
|
|
The flag <option>-r</option> deletes the user’s home directory.
|
|||
|
|
Accounts can be modified using <command>usermod</command>. Unix
|
|||
|
|
groups can be managed using <command>groupadd</command>,
|
|||
|
|
<command>groupmod</command> and <command>groupdel</command>.</para>
|
|||
|
|
|
|||
|
|
</chapter>
|