| blob | ba78ca74a8e2702225ad607296fa56e2faf38ac6 |
1 '\" te
2 .\" Copyright 1989 AT&T Copyright (c) 2004, 2009, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH USERMOD 1M "Feb 22, 2008"
7 .SH NAME
8 usermod \- modify a user's login information on the system
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBusermod\fR [\fB-u\fR \fIuid\fR [\fB-o\fR]] [\fB-g\fR \fIgroup\fR] [\fB-G\fR \fIgroup\fR [, \fIgroup\fR...]]
13 [\fB-d\fR \fIdir\fR [\fB-m\fR [\fB-z|-Z\fR]]] [\fB-s\fR \fIshell\fR] [\fB-c\fR \fIcomment\fR] [\fB-l\fR \fInew_name\fR]
14 [\fB-f\fR \fIinactive\fR] [\fB-e\fR \fIexpire\fR]
15 [\fB-A\fR \fIauthorization\fR [, \fIauthorization\fR]]
16 [\fB-P\fR \fIprofile\fR [, \fIprofile\fR]] [\fB-R\fR \fIrole\fR [, \fIrole\fR]]
17 [\fB-K\fR \fIkey=value\fR] \fIlogin\fR
18 .fi
20 .SH DESCRIPTION
21 .LP
22 The \fBusermod\fR utility modifies a user's login definition on the system. It
23 changes the definition of the specified login and makes the appropriate
24 login-related system file and file system changes.
25 .sp
26 .LP
27 The system file entries created with this command have a limit of 512
28 characters per line. Specifying long arguments to several options might exceed
29 this limit.
30 .SH OPTIONS
31 .LP
32 The following options are supported:
33 .sp
34 .ne 2
35 .na
36 \fB\fB-A\fR \fIauthorization\fR\fR
37 .ad
38 .sp .6
39 .RS 4n
40 One or more comma separated authorizations as defined in \fBauth_attr\fR(4).
41 Only a user or role who has \fBgrant\fR rights to the \fBauthorization\fR can
42 assign it to an account. This replaces any existing authorization setting. If
43 no authorization list is specified, the existing setting is removed.
44 .RE
46 .sp
47 .ne 2
48 .na
49 \fB\fB-c\fR \fIcomment\fR\fR
50 .ad
51 .sp .6
52 .RS 4n
53 Specify a comment string. \fIcomment\fR can be any text string. It is generally
54 a short description of the login, and is currently used as the field for the
55 user's full name. This information is stored in the user's \fB/etc/passwd\fR
56 entry.
57 .RE
59 .sp
60 .ne 2
61 .na
62 \fB\fB-d\fR \fIdir\fR\fR
63 .ad
64 .sp .6
65 .RS 4n
66 Specify the new home directory of the user. It defaults to
67 \fIbase_dir/login\fR, where \fIbase_dir\fR is the base directory for new login
68 home directories, and \fBlogin\fR is the new login.
69 .RE
71 .sp
72 .ne 2
73 .na
74 \fB\fB-e\fR \fIexpire\fR\fR
75 .ad
76 .sp .6
77 .RS 4n
78 Specify the expiration date for a login. After this date, no user will be able
79 to access this login. The expire option argument is a date entered using one of
80 the date formats included in the template file \fB/etc/datemsk\fR. See
81 \fBgetdate\fR(3C).
82 .sp
83 For example, you may enter \fB10/6/90\fR or \fBOctober 6, 1990\fR. A value of
84 \fB`` ''\fR defeats the status of the expired date.
85 .RE
87 .sp
88 .ne 2
89 .na
90 \fB\fB-f\fR \fIinactive\fR\fR
91 .ad
92 .sp .6
93 .RS 4n
94 Specify the maximum number of days allowed between uses of a login \fBID\fR
95 before that login \fBID\fR is declared invalid. Normal values are positive
96 integers. A value of \fB0\fR defeats the status.
97 .RE
99 .sp
100 .ne 2
101 .na
102 \fB\fB-g\fR \fIgroup\fR\fR
103 .ad
104 .sp .6
105 .RS 4n
106 Specify an existing group's integer \fBID\fR or character-string name. It
107 redefines the user's primary group membership.
108 .RE
110 .sp
111 .ne 2
112 .na
113 \fB\fB-G\fR \fIgroup\fR\fR
114 .ad
115 .sp .6
116 .RS 4n
117 Specify an existing group's integer "ID" "," or character string name. It
118 redefines the user's supplementary group membership. Duplicates between
119 \fIgroup\fR with the \fB-g\fR and \fB-G\fR options are ignored. No more than
120 \fBNGROUPS_UMAX\fR groups may be specified as defined in \fB<param.h>\fR\&.
121 .RE
123 .sp
124 .ne 2
125 .na
126 \fB\fB-K\fR \fIkey=value\fR\fR
127 .ad
128 .sp .6
129 .RS 4n
130 Replace existing or add to a user's \fIkey=value\fR pair attributes. Multiple
131 \fB-K\fR options can be used to replace or add multiple \fIkey=value\fR pairs.
132 However, keys must not be repeated. The generic \fB-K\fR option with the
133 appropriate key can be used instead of the specific implied key options
134 (\fB-A\fR, \fB-P\fR, \fB-R\fR, \fB-p\fR). See \fBuser_attr\fR(4) for a list of
135 valid \fIkey\fRs. Values for these keys are usually found in man pages or other
136 sources related to those keys. For example, see \fBproject\fR(4) for guidance
137 on values for the \fBproject\fR key. Use the command \fBppriv\fR(1) with the
138 \fB-v\fR and \fB-l\fR options for a list of values for the keys
139 \fBdefaultpriv\fR and \fBlimitpriv\fR.
140 .sp
141 The keyword \fBtype\fR can be specified with the value \fBrole\fR or the value
142 \fBnormal\fR. When using the value \fBrole\fR, the account changes from a
143 normal user to a role; using the value \fBnormal\fR keeps the account a normal
144 user.
145 .sp
146 As a \fBrole\fR account, no roles (\fB-R\fR or \fIroles=value\fR) can be
147 present.
148 .RE
150 .sp
151 .ne 2
152 .na
153 \fB\fB-l\fR \fInew_logname\fR\fR
154 .ad
155 .sp .6
156 .RS 4n
157 Specify the new login name for the user. See \fBpasswd\fR(4) for the
158 requirements for usernames.
159 .RE
161 .sp
162 .ne 2
163 .na
164 \fB\fB-m\fR\fR [\fB-z|-Z\fR]
165 .ad
166 .sp .6
167 .RS 4n
168 Move the user's home directory to the new directory specified with the \fB-d\fR
169 option. If the directory already exists, it must have permissions
170 read/write/execute by \fIgroup\fR, where \fIgroup\fR is the user's primary
171 group.
172 .sp
173 If the user's old home directory was located on a separate \fBZFS\fR file system
174 and the \fB/etc/default/useradd\fR file contains the parameter \fBMANAGE_ZFS\fR
175 set to the value \fBYES\fR, the file system will be destroyed after the home
176 directory is moved. If the parent directory of the user's new home directory is
177 located on a separate \fBZFS\fR filesystem and the \fB/etc/default/useradd\fR
178 file contains the parameter \fBMANAGE_ZFS\fR set to the value \fBYES\fR, a new
179 \fBZFS\fR file system will be created.
180 .sp
181 If the \fB-z\fR option is specified, \fBusermod\fR will always try to create a
182 new file system for the home directory and destroy the old one.
183 .sp
184 If the \fB-Z\fR option is specified, a new file system will never be created,
185 and the old one will never be destroyed.
186 .RE
188 .sp
189 .ne 2
190 .na
191 \fB\fB-o\fR\fR
192 .ad
193 .sp .6
194 .RS 4n
195 This option allows the specified \fBUID\fR to be duplicated (non-unique).
196 .RE
198 .sp
199 .ne 2
200 .na
201 \fB\fB-P\fR \fIprofile\fR\fR
202 .ad
203 .sp .6
204 .RS 4n
205 One or more comma-separated rights profiles defined in \fBprof_attr\fR(4). This
206 replaces any existing profile setting in \fBuser_attr\fR(4). If an empty
207 profile list is specified, the existing setting is removed.
208 .RE
210 .sp
211 .ne 2
212 .na
213 \fB\fB-R\fR \fIrole\fR\fR
214 .ad
215 .sp .6
216 .RS 4n
217 One or more comma-separated roles (see \fBroleadd\fR(1M)). This replaces any
218 existing role setting. If no role list is specified, the existing setting is
219 removed.
220 .RE
222 .sp
223 .ne 2
224 .na
225 \fB\fB-s\fR \fIshell\fR\fR
226 .ad
227 .sp .6
228 .RS 4n
229 Specify the full pathname of the program that is used as the user's shell on
230 login. The value of \fIshell\fR must be a valid executable file.
231 .RE
233 .sp
234 .ne 2
235 .na
236 \fB\fB-u\fR \fIuid\fR\fR
237 .ad
238 .sp .6
239 .RS 4n
240 Specify a new \fBUID\fR for the user. It must be a non-negative decimal integer
241 less than \fBMAXUID\fR as defined in \fB<param.h>\fR\&. The \fBUID\fR
242 associated with the user's home directory is not modified with this option; a
243 user will not have access to their home directory until the \fBUID\fR is
244 manually reassigned using \fBchown\fR(1).
245 .RE
247 .SH OPERANDS
248 .LP
249 The following operands are supported:
250 .sp
251 .ne 2
252 .na
253 \fB\fBlogin\fR\fR
254 .ad
255 .sp .6
256 .RS 4n
257 An existing login name to be modified.
258 .RE
260 .SH EXAMPLES
261 .LP
262 \fBExample 1 \fRAssigning Privileges to a User
263 .sp
264 .LP
265 The following command adds the privilege that affects high resolution times to
266 a user's initial, inheritable set of privileges.
268 .sp
269 .in +2
270 .nf
271 # \fBusermod -K defaultpriv=basic,proc_clock_highres jdoe\fR
272 .fi
273 .in -2
274 .sp
276 .sp
277 .LP
278 This command results in the following entry in \fBuser_attr\fR:
280 .sp
281 .in +2
282 .nf
283 jdoe::::type=normal;defaultpriv=basic,proc_clock_highres
284 .fi
285 .in -2
287 .LP
288 \fBExample 2 \fRRemoving a Privilege from a User's Limit Set
289 .sp
290 .LP
291 The following command removes the privilege that allows the specified user to
292 create hard links to directories and to unlink directories.
294 .sp
295 .in +2
296 .nf
297 # \fBusermod -K limitpriv=all,!sys_linkdir jdoe\fR
298 .fi
299 .in -2
300 .sp
302 .sp
303 .LP
304 This command results in the following entry in \fBuser_attr\fR:
306 .sp
307 .in +2
308 .nf
309 jdoe::::type=normal;defaultpriv=basic,limitpriv=all,!sys_linkdir
310 .fi
311 .in -2
313 .LP
314 \fBExample 3 \fRRemoving a Privilege from a User's Basic Set
315 .sp
316 .LP
317 The following command removes the privilege that allows the specified user to
318 examine processes outside the user's session.
320 .sp
321 .in +2
322 .nf
323 # \fBusermod -K defaultpriv=basic,!proc_session jdoe\fR
324 .fi
325 .in -2
326 .sp
328 .sp
329 .LP
330 This command results in the following entry in \fBuser_attr\fR:
332 .sp
333 .in +2
334 .nf
335 jdoe::::type=normal;defaultpriv=basic,!proc_session;limitpriv=all
336 .fi
337 .in -2
339 .LP
340 \fBExample 4 \fRAssigning a Role to a User
341 .sp
342 .LP
343 The following command assigns a role to a user. The role must have been created
344 prior to this command, either through use of the Solaris Management Console GUI
345 or through \fBroleadd\fR(1M).
347 .sp
348 .in +2
349 .nf
350 # \fBusermod -R mailadm jdoe\fR
351 .fi
352 .in -2
353 .sp
355 .sp
356 .LP
357 This command results in the following entry in \fBuser_attr\fR:
359 .sp
360 .in +2
361 .nf
362 jdoe::::type=normal;roles=mailadm;defaultpriv=basic;limitpriv=all
363 .fi
364 .in -2
366 .LP
367 \fBExample 5 \fRRemoving All Profiles from a User
368 .sp
369 .LP
370 The following command removes all profiles that were granted to a user
371 directly. The user will still have any rights profiles that are granted by
372 means of the \fBPROFS_GRANTED\fR key in \fBpolicy.conf\fR(4).
374 .sp
375 .in +2
376 .nf
377 # \fBusermod -P "" jdoe\fR
378 .fi
379 .in -2
380 .sp
382 .SH EXIT STATUS
383 .LP
384 In case of an error, \fBusermod\fR prints an error message and exits with one
385 of the following values:
386 .sp
387 .ne 2
388 .na
389 \fB\fB2\fR\fR
390 .ad
391 .sp .6
392 .RS 4n
393 The command syntax was invalid. A usage message for the \fBusermod\fR command
394 is displayed.
395 .RE
397 .sp
398 .ne 2
399 .na
400 \fB\fB3\fR\fR
401 .ad
402 .sp .6
403 .RS 4n
404 An invalid argument was provided to an option.
405 .RE
407 .sp
408 .ne 2
409 .na
410 \fB\fB4\fR\fR
411 .ad
412 .sp .6
413 .RS 4n
414 The \fIuid\fR given with the \fB-u\fR option is already in use.
415 .RE
417 .sp
418 .ne 2
419 .na
420 \fB\fB5\fR\fR
421 .ad
422 .sp .6
423 .RS 4n
424 The password files contain an error. \fBpwconv\fR(1M) can be used to correct
425 possible errors. See \fBpasswd\fR(4).
426 .RE
428 .sp
429 .ne 2
430 .na
431 \fB\fB6\fR\fR
432 .ad
433 .sp .6
434 .RS 4n
435 The login to be modified does not exist, the \fIgroup\fR does not exist, or the
436 login shell does not exist.
437 .RE
439 .sp
440 .ne 2
441 .na
442 \fB\fB8\fR\fR
443 .ad
444 .sp .6
445 .RS 4n
446 The login to be modified is in use.
447 .RE
449 .sp
450 .ne 2
451 .na
452 \fB\fB9\fR\fR
453 .ad
454 .sp .6
455 .RS 4n
456 The \fInew_logname\fR is already in use.
457 .RE
459 .sp
460 .ne 2
461 .na
462 \fB\fB10\fR\fR
463 .ad
464 .sp .6
465 .RS 4n
466 Cannot update the \fB/etc/group\fR or \fB/etc/user_attr\fR file. Other update
467 requests will be implemented.
468 .RE
470 .sp
471 .ne 2
472 .na
473 \fB\fB11\fR\fR
474 .ad
475 .sp .6
476 .RS 4n
477 Insufficient space to move the home directory (\fB-m\fR option). Other update
478 requests will be implemented.
479 .RE
481 .sp
482 .ne 2
483 .na
484 \fB\fB12\fR\fR
485 .ad
486 .sp .6
487 .RS 4n
488 Unable to complete the move of the home directory to the new home directory.
489 .RE
491 .SH FILES
492 .ne 2
493 .na
494 \fB\fB/etc/default/useradd\fR\fR
495 .ad
496 .sp .6
497 .RS 4n
498 useradd, usermod and userdel configuration file
499 .RE
501 .sp
502 .ne 2
503 .na
504 \fB\fB/etc/group\fR\fR
505 .ad
506 .sp .6
507 .RS 4n
508 system file containing group definitions
509 .RE
511 .sp
512 .ne 2
513 .na
514 \fB\fB/etc/datemsk\fR\fR
515 .ad
516 .sp .6
517 .RS 4n
518 system file of date formats
519 .RE
521 .sp
522 .ne 2
523 .na
524 \fB\fB/etc/passwd\fR\fR
525 .ad
526 .sp .6
527 .RS 4n
528 system password file
529 .RE
531 .sp
532 .ne 2
533 .na
534 \fB\fB/etc/shadow\fR\fR
535 .ad
536 .sp .6
537 .RS 4n
538 system file containing users' encrypted passwords and related information
539 .RE
541 .sp
542 .ne 2
543 .na
544 \fB\fB/etc/user_attr\fR\fR
545 .ad
546 .sp .6
547 .RS 4n
548 system file containing additional user and role attributes
549 .RE
551 .SH ATTRIBUTES
552 .LP
553 See \fBattributes\fR(5) for descriptions of the following attributes:
554 .sp
556 .sp
557 .TS
558 box;
559 c | c
560 l | l .
561 ATTRIBUTE TYPE ATTRIBUTE VALUE
562 _
563 Interface Stability Committed
564 .TE
566 .SH SEE ALSO
567 .LP
568 \fBchown\fR(1), \fBpasswd\fR(1), \fBusers\fR(1B), \fBgroupadd\fR(1M),
569 \fBgroupdel\fR(1M), \fBgroupmod\fR(1M), \fBlogins\fR(1M), \fBpwconv\fR(1M),
570 \fBroleadd\fR(1M), \fBroledel\fR(1M), \fBrolemod\fR(1M), \fBuseradd\fR(1M),
571 \fBuserdel\fR(1M), \fBgetdate\fR(3C), \fBauth_attr\fR(4), \fBpasswd\fR(4),
572 \fBpolicy.conf\fR(4), \fBprof_attr\fR(4), \fBuser_attr\fR(4),
573 \fBattributes\fR(5), \fBzfs\fR(1M)
574 .SH NOTES
575 .LP
576 The \fBusermod\fR utility modifies \fBpasswd\fR definitions only in the local
577 \fB/etc/passwd\fR and \fB/etc/shadow\fR files. If a network nameservice such as
578 \fBNIS\fR or \fBNIS+\fR is being used to supplement the local files with
579 additional entries, \fBusermod\fR cannot change information supplied by the
580 network nameservice. However \fBusermod\fR will verify the uniqueness of user
581 name and user \fBID\fR against the external nameservice.
582 .sp
583 .LP
584 The \fBusermod\fR utility uses the \fB/etc/datemsk\fR file, available with
585 SUNWaccr, for date formatting.