|
 |
|
| |
5.3 Additional Options for User Accounts
In addition to the settings for a default user account, openSUSE®
offers further options, such as options to enforce password policies, to
use encrypted home directories or to define disk quotas for users and
groups.
5.3.1 Automatic Login and Passwordless Login
If you use KDE or GNOME desktop environment you can configure
Auto Login for a certain user as well as
Passwordless Login for all users. Auto login causes
a user to become automatically logged in to the desktop environment on
boot. This functionality can only be activated for one user at a time.
Login without password allows all users to log in to the system after
they have entered their username in the login manager.
WARNING: Security Risk
Enabling Auto Login or Passwordless
Login on a machine that can be accessed by more than one
person is a security risk. Without the need to authenticate, any user
can gain access to your system and your data. If your system contains
confidential data, do not use this functionality.
If you want to activate auto login or login without password, access
these functions in the YaST with .
5.3.2 Enforcing Password Policies
On any system with multiple users, it is a good idea to enforce at least
basic password security policies. Users should change their passwords
regularly and use strong passwords that cannot easily be exploited. For
local users, proceed as follows:
Configuring Password Settings
-
Open the YaST
dialog and select the tab.
-
Select the user for which to change the password options and click
.
-
Switch to the tab.
-
To make the user change his password at next login, activate
.
-
To enforce password rotation, set a and a .
-
To remind the user to change his password before it expires, set a
number of .
-
To restrict the period of time the user can log in after his password
has expired, change the value in .
-
You can also specify a certain expiration date for a password. Enter
the in
YYYY-MM-DD format.
-
For more information about the options and about the default values,
click .
-
Apply your changes with .
5.3.3 Managing Encrypted Home Directories
To protect data in home directories against theft and hard disk removal,
you can create encrypted home directories for users. These are encrypted
with LUKS (Linux Unified Key Setup), which results in an image and an
image key generated for the user. The image key is protected with the
user's login password. When the user logs in to the system, the
encrypted home directory is mounted and the contents are made available
to the user.
NOTE: Fingerprint Reader Devices and Encrypted Home Directories
If you want to use a fingerprint reader device, you must not use
encrypted home directories. Otherwise logging in will fail, because
decrypting during login is not possible in combination with an active
fingerprint reader device.
With YaST, you can create encrypted home directories for new or
existing users. To encrypt or modify encrypted home directories of
already existing users, you need to know the user's current login
password. By default, all existing user data is copied to the new
encrypted home directory, but it is not deleted from the unencrypted
directory.
WARNING: Security Restrictions
Encrypting a user's home directory does not provide strong security
from other users. If strong security is required, the system should not
be physically shared.
Find background information about encrypted home directories and which
actions to take for stronger security in
Section 36.2, Using Encrypted Home Directories, (↑ Reference ).
Creating Encrypted Home Directories
-
Open the YaST dialog
and click the tab.
-
To encrypt the home directory of an existing user, select the user and
click .
Otherwise, click to create a new user account
and enter the appropriate user data on the first tab.
-
In the tab, activate . With , specify the size of the encrypted image file to be
created for this user.
-
Apply your settings with .
-
Enter the user's current login password to proceed if YaST prompts
for it.
-
Click to save all changes without
exiting the administration dialog. Or click
to close the administration dialog and to save the changes.
Modifying or Disabling Encrypted Home Directories
Of course, you can also disable the encryption of a home directory or
change the size of the image file at any time.
-
Open the YaST
dialog in the view.
-
Select a user from the list and click .
-
If you want to disable the encryption, switch to the
tab and disable .
If you need to enlarge or reduce the size of the encrypted image file
for this users, change the .
-
Apply your settings with .
-
Enter the user's current login password to proceed if YaST prompts
for it.
-
Click to save all changes without
exiting the dialog.
Or click to close the administration dialog
and to save the changes.
5.3.4 Using Fingerprint Authentication
If your system includes a fingerprint reader you can use biometric
authentication in addition to standard authentication via login and
password. After registering their fingerprint, users can log in to the
system either by swiping a finger on the fingerprint reader or by typing
in a password.
Fingerprints can be registered with YaST. Find detailed information
about configuration and use of fingerprint authentication in
Section 32.0, Using the Fingerprint Reader, (↑ Reference ). For a list of supported devices, refer to
https://reactivated.net/fprint/wiki/Supported_devices.
5.3.5 Managing Quotas
To prevent system capacities from being exhausted without notification,
system administrators can set up quotas for users or groups. Quotas can
be defined for one or more file systems and restrict the amount of disk
space that can be used and the number of inodes (index notes) that can
be created there. Inodes are data structures on a file system that store
basic information about a regular file, directory, or other file system
object. They store all attributes of a file system object (like user and
group ownership, read, write, or execute permissions), except file name
and contents.
openSUSE allows usage of soft and
hard quotas. Soft quotas usually define a warning
level at which users are informed they are nearing their limit, whereas
hard quotas define the limit at which write requests are denied.
Additionally, grace intervals can be defined that allow users or groups
to temporarily violate their quotas by certain amounts.
Enabling Quota Support for a Partition
In order to configure quotas for certain users and groups, you need to
enable quota support for the respective partition in the YaST Expert
Partitioner first.
-
In YaST, select and click
to proceed.
-
In the , select the partition for
which to enable quotas and click .
-
Click and activate . If the quota package
is not already installed, it will be installed if you confirm the
respective message with .
-
Confirm your changes and leave the .
Setting Up Quotas for Users or Groups
Now you can define soft or hard quotas for specific users or groups and
set time periods as grace intervals.
-
In the YaST , select
the user or the group you want to set the quotas for and click
.
-
On the tab, select the quota entry and
click to open the dialog.
-
From , select the partition to which the
quota should apply.
-
Below , restrict the amount of disk
space. Enter the number of 1 KB blocks the user or group may have on
this partition. Specify a and a
value.
-
Additionally, you can restrict the number of inodes the user or group
may have on the partition. Below ,
enter a and .
-
You can only define grace intervals if the user or group has already
exceeded the soft limit specified for size or inodes. Otherwise, the
time-related input fields are not activated. Specify the time period
for which the user or group is allowed to exceed the limits set above.
-
Confirm your settings with .
-
Click to save all changes without
exiting the dialog.
Or click to close the administration dialog
and to save the changes.
openSUSE also ships command line tools like
repquota or warnquota with which
system administrators can control the disk usage or send e-mail
notifications to users exceeding their quota. With
quota_nld, administrators can also forward kernel
messages about exceeded quotas to D-BUS. For more information, refer to
the repquota, the
warnquota and the quota_nld
man page (root password needed).
|
|
|
