Attributes of User and Role Accounts

Home Directory Setup

Warning When Removing User Accounts

User Initialization Files

Reserved UID Numbers

Attributes of User and Role Accounts

Each new user and role account has the following attributes defined when the account is added by the System Administrator:

Top ^

Each Trusted Solaris user and role account also has the following extended attributes:

-	A method for choosing a new password: either automatic (machine-generated passwords), or manual (user-chosen passwords) The password can be changed as follows: Any user or role can change his or her own password using the Change Password option in the TP Menu in the Front Panel. The System Administrator and Security Administrator roles can change their role passwords using the passwd(1) command. The Security Administrator can use the SMC Users tool, select the name of the user, then select Action->Properties to modify the Properties for any user or role account.
-	A set of password options expressed in days: User Must Keep: The number of days the user must keep the password before changing it User Must Change Within: The number of days the user can keep the password before it expires Before Change, Alert User: The number of days before expiration that a warning is to be sent Expires If Not Used For: How many days the password can be unused before it expires
-	A clearance (the highest label at which the user can work)
-	A minimum label (the lowest label at which the user can work) NOTE: The clearance and the minimum label together define the set of labels at which the user can work.
-	Two label viewing-related options that specify whether labels are shown or hidden overall, and if labels are shown, whether the user is allowed to see the administrative labels ADMIN_LOW and ADMIN_HIGH
-	An idle time, which specifies how long the workstation can remain inactive before the "idle command" (next item) is performed
-	An idle command, which specifies whether to lock the screen or logout if the workstation is idle more than the length of time specified in "idle time" (previous item)
-	A type, either "normal" or "role"
-	Optional: for users, one or more roles that the user can assume
-	Mandatory for roles and optional for users: one or more rights profiles

NOTE: Default values for most of the extended attributes are implictly applied to user accounts if the Security Administrator does not specify other values. The policy.conf(4) file contains system-wide defaults for the idle action and idle time, the label view, the method of password generation, and whether the account is locked after a specified number of failed login attempts with the wrong password. The default policy.conf file also assigns the Basic Solaris User rights profile to all users. If desired, Security Administrator can modify policy.conf to change the defaults or to assign one or more system-wide authorizations using the AUTHS_GRANTED= keyword.

The default label attributes (minimum label, clearance, default label view, and whether labels are hidden) are specified by the Security Administrator in the label_encodings(4) file.

Also see About User and Role Account Management, Getting Started With Users Tools, and Rights of Users and Roles.

Home Directory Setup

When you add a user or role, User Manager and Role Manager set up the user's or role's home directory by doing the following:

• Creating the directory on the server you specify (the server can be the account's local host or a remote file server)
• For users and all roles except the root (or Primary Administrator), creating the home directories as multilevel directories (MLDs)
  MLDs are used to transparently store files at different labels in separate subdirectories called SLDs. One SLD is created for each label at which the home directory is accessed. The root role's home directory is always the root / directory, which is a regular directory (not an MLD) at ADMIN_LOW because root only has the single label of ADMIN_LOW assigned.
• Setting the permissions on the directory, based on sharing options shown on the Home Directory properties dialog
• Copying initialization files to the home directory from the /etc/skel to the home directory
• Updating the auto_home database if the home directory is specified to be automounted. The home directory is then automatically mounted on a mount point that is usually named /home/username).

  NOTE: When you add a user, if the User Manager is unable to contact the specified home directory server, a message tells you the user was added but the home directory could not be created. See Home Directory Not Created in Troubleshooting.

Warning When Removing User Accounts

Even if the user account that is being deleted has one of these directories as its home directory, the following directories cannot be removed: /, /etc, /usr, /home, /var, /opt, /tmp, and /proc.

Top ^

NOTE:The user or role should create a copy_files(4) or link_files(4) file in the initial SLD to list the initialization files that need to be copied or linked into subsequent SLDs created for the user. Without the initialization files for the user's shell being available in the subsequent SLDs, the user's environment cannot be created properly when the user works at any other label.

The default files are copied and renamed as follows.

Trusted Solaris provides an /etc/skel/tsol directory for role's initialization files, which are copied to the role's home directories and renamed:

Original Name	Name After Copy
role.link_files	.link_files
role.profile	.profile

For additional information about user initialization files, see "Customizing a User's Work Environment" in the Solaris System Administration Guide. Several important differences exist in Trusted Solaris in how initialization files are used, as described in "Managing Startup Files" in the Trusted Solaris Administration Overview.

The initialization file sourced at login are:

The initialization files that are sourced when any terminal except dtterm(1) launches a shell are:

NOTE: To force dtterm to launch a new shell as a login shell, the administrator or the user can make sure that a .Xdefaults-<hostname> file (with "hostname" replaced with the hostname of the home directory server) is in the account's home directory with the following entry:

      Dtterm*/LoginShell: true

Any files added to the skeleton directory are copied without being renamed. Recommended additions are shown in the table below:

Top ^

User ID numbers 0 through 99 are reserved for system accounts. If you specify a new system account, you can assign it one of these UIDs, but you should not use these UIDs for regular user accounts.

By definition, root is always UID 0, daemon is UID 1, and pseudo-user bin has UID 2.

Top ^