Managing User Accounts in Gaia Clish

Important:

  • On Scalable Platforms (ElasticXL, Maestro, and Chassis), you must run the applicable commands in Gaia gClish of the applicable Security Group.

  • After you add, configure, or delete features, run the "save config" command to save the settings permanently. Scalable Platforms save the changes automatically.

Note - You can use the "add user" command to add new users, but you must use the "set user <username> password" command to configure the password and allow the user to log on to the system.

Syntax

add user <UserName> uid <User ID> homedir <Path>

add user <UserName> uid 0 homedir <Path>

set user <UserName>

      force-password-change {yes | no}

      gid <System Group ID>

      homedir <Path>

      lock-out off

      newpass <Password>

      password

      password-hash <Password Hash>

      realname <Name>

      shell <Login Shell>

      uid <User ID>

Note - For the default users admin and monitor, you can only change the Shell and Roles.

show users

show user <UserName>

      [force-password-change]

      [gid]

      [homedir]

      [lock-out]

      [realname]

      [shell]

      [uid]

delete user <User ID>

Note - You cannot delete the default users admin and monitor.

Parameters

Parameter

Description

user <UserName>

Configures unique login username - an alphanumeric string, from 1 to 32 characters long, that can contain dashes (-) and underscores (_), but not spaces: a-z A-Z 0-9 - _

uid <User ID>

Optional. Configures unique User ID to identify permissions of the user:

  • 0 for administrator users and RADIUS user account (this is the default option)

  • An integer between 103 and 65533 for non-administrator user

    Notes:

    • Configure this UID for users with the default shell /usr/bin/scponly - see sk88981.

    • If you do not enter a value, Gaia OS automatically assigns the next free sequential number.

homedir <Path>

Configures user's home directory.

This is the full Linux path name of a directory, to which the user will log in.

Must be a sub-directory of the /home/ directory.

If the sub-directory does not already exist, it is created.

force-password-change {yes | no}

If you wish to force the user to change the configured password during the next login, use the value "yes".

Note - If the user does not log in within the time limit configured by the "set password-controls expiration-lockout-days" command, the user may not be able to log in at all.

gid <System Group ID>

Configures System Group ID (0-65535) for the primary group, to which a user belongs.

The default is 100.

You can add the user to several groups.

Use the "add group" and "set group" commands to manage the groups.

lock-out off

Unlocks the user, if the user was locked out.

The password expiration date is adjusted, if necessary.

newpass <Password>

Configures a new password for the user.

Gaia does not ask to verify the new password.

The password you enter shows on the terminal command line in plain text, and is stored in the command history as plain text.

password

Configures a password for the new user.

The command runs in interactive mode.

You must enter the password twice, to verify it.

The password you enter is not visible on the terminal command line.

password-hash <Password Hash>

The password as an MD5, SHA256, or SHA512 salted hash instead of plain text (the password string must contain at least 6 characters).

Use this option when you upgrade or restore using backup scripts.

You can generate the hash of the password with the "cpopenssl" command (run: cpopenssl passwd -help).

To configure the default hash algorithm, see:

Best Practice - Do not use MD5 hash because it is not secure.

Notes:

  • Format:

    $<Hash Standard>$<Salt>$<Encrypted>

  • The length of this hash string must be less than 128 characters.

  • <Hash Standard>

    One of these digits:

    • 1 = MD5

    • 5 = SHA256

    • 6 = SHA512

  • <Salt>

    A string of these characters:

    a-z A-Z 0-9 . / [ ] _ ` ^

    The length of this string must be between 2 and 16 characters.

  • <Encrypted>

    A string of these characters:

    a-z A-Z 0-9 . / [ ] _ ` ^

    The length of this string must be:

    • For MD5, less than 22 characters.

    • For SHA256, less than 43 characters.

    • For SHA512, less than 86 characters.

realname <Name>

Configures user's description - most commonly user's real name.

This is an alphanumeric string that can contain spaces.

The default is the username with the capitalized first letter.

shell <Login Shell>

Configures the user's default login shell.

See the explanations in the "Login Shells" section below.

Shell

Description

/etc/cli.sh

This is the default option.

Lets the user work with the full Gaia Clish.

By default, some basic networking commands (such as ping) are also available.

The Extended Commands in the assigned roles makes it possible to add more Linux commands that can be used (see List of Available Extended Commands in Roles).

User can run the expert command to enter the Bash shell (Expert mode).

/bin/bash

BASH Linux shell.

Lets the user work with the Expert mode.

User can run the clish command to enter the Gaia Clish.

/bin/csh

CSH Linux shell.

User can run the clish command to enter the Gaia Clish.

/bin/sh

SH Linux shell.

User can run the clish command to enter the Gaia Clish.

/bin/tcsh

TCSH Linux shell.

User can run the clish command to enter the Gaia Clish.

/usr/bin/scponly

User is not allowed to log in to Gaia.

User can only connect to Gaia over SCP and transfer files to and from the system.

Other commands are forbidden.

/sbin/nologin

User is not allowed to log in to Gaia.