documentation/docs/engineering-guide/accounts-and-groups.md

Accounts and Groups

Linux accounts are generally stored and managed in Active Directory.

Account Types

There are several types of accounts, which are usually indicated by a prefix or suffix:

• Normal Account - No prefix or suffix. Older accounts are just last names, newer accounts are LASTNAME_X, where X is the first letter of the given name.
• Global Account (gac-accounts) - These have a gac- prefix. These are shared accounts where several people know the password. Note that some global accounts were originally experiment accounts and share the properties of experiment accounts

!!! warning GAC accounts must not be used for administrative tasks (also see: AW-95-17-02 Logical Access Control). Therefore membership in groups granting such privileges is not permitted.

• Administrator Account - Marked with an -adm suffix.
• External Users - These accounts start with an ext- prefix and are provided to external users, ie. those who are not PSI employees.
• Experiment Account (e-accounts) - These start with e followed by the uid (+ some global accounts which where renamed later). These are managed by the Digital User Office (DUO). The password is shared by all users involved in the experiment.
• Service Account - These come with an svcusr- prefix and are used for running services.

Official documentation on PSI IT account naming convention can be found here

To be able to easily distinguish between the different account types, a user shall be assigned to

Unix Group	Account Type	Test User
unx-lx_users	normal user	lx_test
unx-lx_adm_users	administrator accounts for normal users	lx_test-adm
unx-lx_gac_users	global accounts	gac-lx_test
unx-lx_ext_users	external accounts	ext-lx_test
unx-lx_ext_adm	external adm accounts (group should actually be named unx-lx_ext_adm_users but because of character limitations we abbreviated)	ext-lx_test-adm
unx-lx_e_users	experiment accounts	e22284
unx-lx_svc_users	service accounts	svcusr-lx_test

The passwords for all these users are found in the Shared Core Linux Secret Store, except for e22284 which is found in the PSI e-account Password Manager.

!!! note unx-lx_ext_users - this group does not yet contain all ext accounts (only the ones that are currently in the scope of IAM

GAC-Account

A GAC account is a:

• General, impersonal account for operation at specific system​(s)
• As any user has a personal drive (i.e. U: drive)​
• Is not allowed to access systems via SSH, RDP, NX, …​
• The owner of the gac account is responsible and liable for any potential damage caused by this account! ​
• The owner is oblidged to:​
  • Ensure the account is used according to the IT Security and other policies​
  • Ensure the password is kept secret and only is known by authorized people​
  • Ensure the password cannot be guessed, is according to password policies and is changed regularly

GAC accounts must not be used for administrative tasks (also see: AW-95-17-02 Logical Access Control). Therefore membership in groups granting such privileges is not permitted.

UID Allocation

UID	GID
0 - 1000	100 - 1000	local users / groups manually
1000 - 9999	110 - 9999	old AD accounts manually
10000 - 29999	10000 - 29999	e-accounts / p-groups Experiment prov. tool
30000 - 61183	30000 - 61183	new AD users / groups /external AD accounts OM
61184–65519	61184–65519	systemd Dynamic Users
70000 - 120000	70000 - 120000	e-accounts / p-groups Experiment prov. tool
123458 - 150000	-10000 - -4294967296	local AFS users / groups AFS
200000 - 400000	200000 - 400000	new AD users / groups /external AD accounts IAM
2000000000 - 4294967296	2000000000 - 4294967296	sub UID / GID for containers local Linux systems / local Windows subsystems for Linux

AD Attribute Mapping

For the sssd-ldap(5) provider following mapping is used

passwd attribute	AD attribute
username	msSFU30Name
UID	msSFU30UidNumber
GID	msSFU30GidNumber
home	msSFU30HomeDirectory
shell	msSFU30LoginShell

We are on the process to move to the sssd-ad(5) provider. There we need following attributes:

passwd attribute	AD attribute
username	sAMAccountName
UID	uidNumber
GID	gidNumber
home	unixHomeDirectory
gecos	gecos

Note that the loginShell attribute for the shell shall not be set as we only want to support Bash as login shell in the future.

Finally the gecos field shall be generated from other already existing AD attributes:

<givenName> <sn>,<physicalDeliveryOfficeName>,<telephoneNumber>,,<mail>

example:

Konrad Bucheli,OBBA/230,+41563102724,,konrad.bucheli@psi.ch

Note the field 4 (home/mobile number) we do not set, thus we have an empty field with two commas in a row. And we cannot simply use DisplayName as it contains a comma.

For technical users or experiment accounts the login name itself should be set as first element.

Primary Groups

By default the primary user group is unx-nogroup (710). The exception are experiment accounts, where the primary group is the corresponding g-group.

Except for the default unx-nogroup, a user shall always also be explicit member of his primary group (e.g. member of the g-group for experiment accounts).

At PSI the user-private group scheme (UPG), the default on Red Hat distributions, is not used.

Low GIDs

A number of groups have very low GIDs (<500), in particular:

unx-fkt:*:101:
unx-lke:*:110:
unx-abe:*:120:stingelin
unx-aea:*:130:
unx-lmu:*:140:
unx-lem:*:141:
unx-muesr:*:150:
unx-asm:*:210:
unx-lrp:*:220:
unx-zrp:*:221:
unx-ash:*:230:
unx-ppt:*:280:
unx-pmr:*:290:
unx-cmt:*:301:
unx-lfk:*:310:
unx-lch:*:320:
unx-lns:*:330:
unx-lap:*:340:
unx-lmn:*:350:
unx-asq:*:360:
unx-crpp:*:370:
unx-psq:*:380:
unx-psz:*:390:
unx-gabe:*:402:
unx-lrs:*:410:
unx-lth:*:420:
unx-lwv:*:430:
unx-les:*:440:
unx-dtp:*:451:
unx-lsu:*:490:

Special Accounts

linux_ldap: query LDAP

The linux_ldap account has read-only permissions on a limited subset of the LDAP attributes. It is used by nslcd, for example, to query LDAP for users' uid, gid, etc.

The password should not be shared unnecessarily, but it does not need to be specifically protected either. In fact, in earlier releases of Scientific Linux it was necessary to have /etc/nslcd.conf, which contains the password, world-readable.

This account must not be given additional access or privileges.

linuxadjoin.psi.ch@D.PSI.CH

This account is a pure AD account (ie it doesn't have Unix attributes like uid), which is used to manage computer objects in AD automatically. In particular, it is used to precreate computer objects to allow password-less AD joins.

The account is only used on the Puppet server and has no (known) password. Instead a keytab is used to get a valid Kerberos ticket.