User Setup

The default pi user has sudoer (super user) privileges which provides access to administrative functions which might be beyond the scope of the average user or even dangerous to the security of the system.

The best approach (one which I have not done until now) is to create user accounts for each individual user who will be using the shell and setting appropriate privileges to each user.  The following describes how this can be achieved for a new user called tykus:

$sudo useradd tykus

This has created a user, but we now need to set a password for this user:

$sudo passwd tykus
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
$

We are asked to enter a new UNIX password and to confirm it.  We're not quite done just yet because this method does not automatically create the new user's home directory, although it does assume it will be located at /home/tykus (in this case).  So our next step is to create that directory:

$sudo mkdir /home/tykus

If we run a list command ($ls -l), we are given information about the contents of the /home directory

$cd /home
$ls -l
total 8
drwxr-xr-x 16 pi   pi   4096 Jul  6 10:11 pi
drwxr-xr-x  2 root root 4096 Jul  6 11:29 tykus
$

The information provided tells use what is in the directory, who owns it and what permissions are associated with it, specifically each line tells us:

• Field 1: permission flags (10 of them!)
• Field 2: link count
• Field 3: owner of the file
• Field 4: associated group for the file
• Field 5: size in bytes
• Field 6-8: date of last modification
• Field 9: name of file

Currently, the /home/tykus directory is owned by the root user - if we were to login as tykus now, we would be unable to write to the directory although we (along with any other users) could read and execute the contents. For example, if we try to create a file new_file in /home/tykus as the pi user, we will not be allowed

$touch /home/tykus/new_file
touch: cannot touch `new_file': Permission denied
$

Whereas, if we try to execute a python script in the same directory (as pi), we can do that:

$python /home/tykus/hello.py
Hello World!
$

We need to give the directory to its rightful owner:

$sudo chown tykus:tykus /home/tykus

Note: if there were already contents in this directory (such as the python script above), we should include a -R option to recursively change permissions for all directories and files in the directory. For security reasons we will also change permissions so that only the owner can read, write and execute the home directory:

$sudo chmod 700 /home/tykus

Preferred Shell If we check the /etc/passwd file, our new user is added to the end; included details are colon (:) separated as follows: Username:Password:User ID:Group ID:Comment:Home directory:Shell (more information here)

tykus:x:1002:1002::/home/tykus:/bin/sh

So tykus will log in to the sh shell, whereas we prefer the Bourne shell (bash), so we can change /bin/sh to /bin/bash (or whatever shell is preferred) We can now login as tykus and keep all of our files private from other users!