Users and groups

"Accounts" are kept in /etc/passwd, /etc/group and /etc/shadow, and are managed with the busybox tools adduser, deluser, addgroup, delgroup, passwd and chpasswd. The tools are located in /rod/init/bin, which is not on the PATH of a login shell, so the examples below use the full path. You may add the directory to PATH with export PATH=$PATH:/rod/init/bin in ~/.profile.

Accounts

`root`	uid 0, with the shell `/rod/profile/bin/bash`. The installer sets the password, and so does `setup --root-password-stdin`. A stage that is unpacked by hand has an empty root password until `passwd root` is run.
`sshd`	uid 74, home `/var/empty`, shell `false`.
`nobody`	uid 65534, shell `false`.

The groups are root (0), wheel (10) and nogroup (65534). uranium-desktop USER adds the user to video and input.

doas

/etc/doas.conf holds one rule:

permit persist :wheel

The package is doas-uranium, which is built without PAM and with timestamp support. A program in the store cannot be setuid, so the build copies doas to /rod/wrappers/doas with mode 4755. The copy is made when the stage is built, and rod does not refresh it when the package is upgraded. doas -C FILE checks a configuration file.

doas says it is not installed setuid	The `doas` from the profile ran instead of the wrapper, because `PATH` does not contain `/rod/wrappers`, as in a command that is given to `ssh`.
doas says a terminal is required	The rule requires a password, and there is no terminal.
doas says the operation is not permitted	No rule allows the user or the command.

Root cannot log in over ssh. See ssh.

Adding a user

# echo 'secret1' | setup --user ann --password-stdin
chpasswd: password for 'ann' changed
user ann, in the wheel group, can use doas

Without options, setup asks for the name and the password. The name of a user must begin with a lower case letter or _ and may have at most 32 characters, each of which is a lower case letter, a digit, _ or -. The same may be done by hand:

# /rod/init/bin/adduser -D -s /rod/profile/bin/bash -G wheel ann
# /rod/init/bin/passwd ann

-G wheel makes wheel the primary group. Without it the user recieves a group of the same name and has no administrator rights. The first uid is 1000, and the account remains locked until a password is set.

Passwords

setup and the installer store passwords with chpasswd, which writes a traditional DES hash unless it is told otherwise. chpasswd -c sha512 writes a SHA-512 hash.

# echo 'ann:secret' | /rod/init/bin/chpasswd -c sha512

Groups and removal

# /rod/init/bin/adduser bob wheel
# /rod/init/bin/delgroup bob wheel
# /rod/init/bin/deluser --remove-home bob

adduser USER GROUP adds a user to a group, and delgroup USER GROUP removes the user from it. deluser does not accept a group argument. --remove-home deletes the home directory.

The shell

The login shell is bash. A login shell reads /etc/profile, and then the first of ~/.bash_profile, ~/.bash_login and ~/.profile. Other interactive shells read ~/.bashrc. /etc/profile sets:

LANG=C.UTF-8, EDITOR=avtty, PAGER=less, LESS=-R, SVDIR=/etc/service, HISTSIZE=5000 and HISTCONTROL=ignoredups;
PATH=/rod/wrappers:/rod/bin:/rod/profile/bin, MANPATH, XDG_DATA_DIRS and NIX_SSL_CERT_FILE;
the aliases ls, ll, la and grep with colour, a red prompt for root and bash completion. A login also prints fastfetch and a random line from /rod/share/tips.

The console login banner is /etc/issue.