Release 3.2  Copyright ã1993 by NeXT Computer, Inc.  All Rights Reserved.

5	Managing User Accounts and User Groups

When several people use a standalone computer, or a group of computers on a network, some mechanism is needed to control access to the data and hardware. To restrict access to computers and files, users are generally required to log in with a user account.

Another way to control access to files is with user groups. As the name implies, a user group is a set of users that can be given common access to files.

Managing User Accounts

Chapter 2, ªSetting Up a NetInfo Network,º describes how to add simple user accounts to your network. However, if you want to add a user with a special home directory, add accounts to specific user groups, modify an existing account, or delete an account, you need the procedures discussed in this section.

Planning User Accounts

Before you begin adding new user accounts, it's a good idea to plan how those accounts will be configured. Some things to consider while you plan your user accounts follow.

Local or Network Accounts

A local account is available only on a particular computer. A network account is available on several (or all) of the computers on the network. Decide if you want your users to be restricted to a single computer, or to be able to log into more than one computer on the network. 

Each user account should exist in only one NetInfo domain. For example, don't add a user account for tsmith to the root domain, then add another for tsmith in a local domain. With duplicate user accounts, the user might have a different password, different home directory, or different file ownerships, depending on which computer tsmith logged into.

User Names

A user name is the name a user logs in with, and is frequently a shortened form of the user's full name. It should contain only ASCII letters (without diacritics), digits, and the underbar (_) character, and must be no more than 8 characters long. By convention, a user name has no uppercase letters and doesn't begin with a number.

User names are used by people other than the account holder (for example, when addressing mail), so it's good to have a standard way to assign themÐespecially at sites with many users. One such strategy is to take the user's first initial followed by all or part of the last name. By this method, the user name for Martha Lang would be mlang. In smaller groups, more informal user names are fine.

User IDs

A user ID is the number used by the system to identify each user account. UserManager automatically assigns the user ID to new accounts. File permissions and ownership are based on user ID rather than user name, so it's important that no two users have the same ID. If two users do have the same user ID, they'll have file permission problems: Whatever the permissions on one user's files, the other user will be able to read, write, or erase them. On networked computers, user ID numbers should be unique throughout the entire NetInfo domain hierarchy. For example, if martha has user ID 125 in the root domain, then no other account in any domain should have user ID 125.

Home Directories

The home directory is where a user stores personal files. It's created by UserManager when you set up an account. If you're creating a network account, you need to make the user's home directory available on all the computers that user can log into. The home directory should be on a shared file system. Set up the home directory server before you attempt to add network accounts.

User Groups

A user group is a collection of users, set up so that its members can allow each other to read and write some (or all) of their files. All files and directories have a group associated with them. They also have permissions that apply to members of that groupÐpermissions different from those that apply to users not in the group. A user can be a member of several groups, and can specify any one of them for each file (and directory).

UserManager assigns a default group to each new user account. When the new user's home directory is created, it is associated with the default group. When a user creates a new file or directory, it has the same group as the parent directory. All of a user's files will have the default group.

If you'll be creating your own user groups, you might want to create them before you add new user accounts, so you can assign new users to these groups. See ªManaging User Groups,º later in this chapter.

Passwords

Each user account should have a password assigned to it. If an account doesn't have a password, anyone can log in using that account. A password should be no more than 8 characters, be easy to remember and hard to guess. A combination of uppercase and lowercase letters with numbers is recommended to make the password harder to guess. If you don't assign a password when you create a new account, make sure the new user creates one right away with the Preferences application.

Standard User Accounts

Every NeXT computer comes with several user accounts already installed in the local domain. Here's a description of some of the standard accounts:

·	root (user ID 0)ÐSuperuser. Can bypass file and directory permissions. Used for administrative tasks.

·	me (user ID 20)ÐDefault account. Used on standalone computers. See the User's Guide for more information. 

·	nobody (user ID -2)ÐUsed for anonymous NFS users. See Chapter 4, ªSetting Up the Network File System,º for more information. 

·	uucp (user ID 4)ÐUsed in the administration of UUCP mail and file transfer. See Chapter 12, ªUsing UUCP,º for more information. 

All standard accounts have a user ID of 20 or less, as do the standard accounts on UNIX computers from other vendors. To avoid any possible conflicts, make sure that all the user accounts you create have a user ID of 100 or greater.

The root Account

Every local domain has a root account (also called the superuser), which is able to bypass file permissions altogether. When you're logged in as root, you have far-reaching powers that let you perform a variety of administrative tasks. For example, root can change the ownership or permissions on any file or directory. (You can restrict root access for remote files. See Chapter 4, ªSetting Up the Network File System.º) Two ways to act as root are by logging in as root and by using the su command (see the next section). 

Domains other than local domains also have a root account, but you don't log into these accounts. Instead, the root account is used to control access to the domain. If you want to make changes to a domain, you must know the root password for that domain. The root password for a network domain is copied from the local domain when the network domain is created. Once created, the passwords for the two root accounts are changed independently. See ªExamining the NetInfo Database,º later in this chapter. 

Using the su Command

The su command is a shell program that allows someone logged in as one user to gain access as another. It's most commonly used to gain root access. Using su often eliminates the need to log out and log back in as root. To gain root access, a user must be a member of the user group wheel. To act as root, perform the following steps:

1.	Enter the following command into a shell window:

su

Without an argument, su assumes you want root access. If the root account has a password (and it should), you're prompted to enter it.

2.	Enter the root password and press Return.

Note:  An alternative version of su is /bin/su.wheel. With this version of the program, users belonging to the wheel group can gain root access by using either the root password or their own. To use this version, just copy /bin/su.wheel to /bin/su.

3.	Any commands you enter now are executed with root privileges. 

4.	When you've finished your work as root, enter the following command:

exit 

Any further commands are run normally, with the privileges of the original user. 

	Warning:	Acting as root is dangerous. When you act as root, you can delete essential files and important information without being warned. Try to avoid logging in as root, and be careful when using su. Logging in as root is considered more dangerous since every aspect of your work with the system can have far-reaching consequences.

Adding a User Account

To give a person access to a computer or network, you add a new user account. This section describes adding a user account with the long form of the New User Window in UserManager. 

1.	Log into the computer that will hold the new user's home directory. For a local account, this is just the local computer. For a network account, this is the home directory server.

Note:  UserManager must have permission to create the user's home directory as root. If you want to be able to add users from a computer other than the home directory server, you need to export the directory with root access for the hosts from which you want to add users. For example, if the home directory server is earth, and you want to add users while logged into mars, you need to log into earth and export the home directory with root access for mars. See Chapter 4 for details.

2.	Start up UserManager, located in /NextAdmin. 

3.	If you're not logged in as root, a panel tells you that you must have superuser status to run this application. Enter the password for root and click Login.

,

4.	Choose New User from the User Record menu. The User Type panel appears.

,

5.	Choose the type of user account.

a.	Click Local if you're adding a local user account. The New User window appears.

b.	Click Network if you're adding a network-wide account. The Select NetInfo Domain panel appears. 

,

c.	Click ª/º (the root domain) in the first column of the domain browser, then click OK. (If you're adding users on a network with more than two NetInfo domain levels, choose the appropriate domain.) The New User window appears. 

,

Notice that the title bar of the New User window indicates the domain the new user will be added to. 

6.	Click the Switch to Long Form button to open the long form of the New User window. 

,

This window contains all the fields in the short form as well as additional fields for the remaining information associated with a user account, including an area for specifying user groups.

7.	Enter the appropriate values into the first three fields: User's Full Name, Username, and Password.

8.	Modify the contents of the last four fields as necessary. The Default Group field cannot be edited directly; you'll deal with user groups in the next step.

User IDÐEach user account must have a unique user ID number, the number the system uses to identify the user. UserManager has determined the next available number and assigned it to the account automatically. Don't change this value unless you need to. 

	Warning:	UserManager assigns the next available user ID for the current domain. When you save the account, UserManager only checks the current domain for conflicts. Be absolutely sure that the user ID assigned is unique throughout the network.

Home DirectoryÐIn the long form, you must enter the home directory for a new account, rather than choose it from a pop-up list. Be sure to enter the complete pathname, ending in the new user name. For example, the network user pat might have the home directory /Net/earth/Users/pat (earth is the host name of the directory server, and Users is the name of the shared directory).

Login ShellÐThe program specified in this field is started when the user opens a shell window. It's also run when the user logs in remotely through a shell window. You shouldn't need to change this value. If you do specify a different shell for a user, the program must be listed in the file /etc/shells. 

LanguageÐThis field sets the default language for the user. If you need to change it, select a new value from the pop-up list.

9.	Change the default group for this account, or add the account to additional groups, if you want. If you set up additional groups, you can specify a different default group for your user accounts. (See ªManaging User Groupsº later in this chapter.)

a.	Click the group you want to use as the default group in the scrollable list in the User Group Info area, then click the button labeled Set Default Group. A check appears next to the group name in the list, and the value of the Default Group field changes to match.

b.	Add this account to any other groups by clicking the group in the list and clicking the Add button. A check appears next to the group, but the default group stays the same.

	Warning:	Avoid putting a user account in any of the groups that come with the system (except other) unless you are absolutely sure the user needs to be a member of that group. For example, the wheel group permits its members to use the UNIX command su to gain root privileges. 

c.	Remove the account from a user group, if necessary, by clicking the group in the list and clicking the Remove button. You can't remove an account from its default group, but you can change the default group to something else. 

,

10.	Choose Save from the User Record menu to save the new user account.

11.	A panel appears asking you to verify the password. 

,

12.	Enter the password and click OK. An attention panel appears displaying all the information about the new user account.

,

13.	Review the information (the password is displayed in encrypted form). If the information shown is OK, click Yes. If it's not, click No; you begin again at step 7. The information you entered into the fields is intact. 

14.	If the user's home directory doesn't exist, a panel asks if you want to create it. Click Yes. 

,

15.	If the home directory already exists, a panel asks you if you want to recreate it from scratch or leave it alone. Choose the appropriate response. 

,

Note:  Multiple users shouldn't share the same home directory. If you see this panel unexpectedly, click Leave It Alone. Once the user has been added, you can modify the Home Directory field and save the user account again. The home directory will be created for you. 

16.	If you're adding a network account, you may be presented with a panel in which you need to type the root password of the root domain. Enter the password and click Login. (Initially, the root password for the root domain will be the same as the root password on the master NetInfo server. See ªExamining the NetInfo Databaseº later in this chapter for details.) 

,

17.	When the user account has been created, the User window reappears with a title bar that reflects the name of the new account. 

,

18.	To add additional user accounts, repeat the procedure just described, beginning with step 4. 

Tip:  Another way to add additional user accounts is to modify the fields in the user window currently displayed, being sure to change the user name, user ID, and home directory (these must be unique for each account). Then, when you choose Save, you see a warning panel indicating that you've changed these fields; you have the opportunity to overwrite the existing account or create a new one. Click New User to create a new account.

,

Modifying a User Account

If you want to change something about an existing account, such as group memberships or the home directory, use the following procedures.

1.	Choose Open User from the User Record menu of UserManager. In the Open in NetInfo Domain panel that appears, click the appropriate domain, then click the account name you want to modify in the lower part of the panel. 

,

2.	Click OK. The long form appears, displaying information about the account you've selected.

,

3.	Make the desired changes to the fields. 

4.	It's not a good idea to change the user ID associated with a user account unless it's necessary to avoid conflicts with another account, since doing so can make the account unusable. If you do change an account's user ID, you'll need to use the chown command to change the ownership on that user's files.

5.	Make any changes to the user group memberships according to the instructions described earlier in ªAdding a User Account.º

6.	Save your modifications by choosing Save from the User Record menu. You're presented with an attention panel displaying the account data. Review the information and click OK if it's correct.

7.	If you changed the user's home directory, you're asked if the new home directory should be created. Click OK.

	Warning:	If you change a user's home directory, the new directory is created for you, but the old home directory won't be affected. You'll have to copy the user's files into the new home directory and then delete the old home directory using the Workspace Manager.

8.	If you're modifying a network account, you may be presented with a panel in which you need to type the root password of the root domain. Enter the password and click Login. (Initially, the root password for the root domain will be the same as the root password on the master NetInfo server. See ªExamining the NetInfo Databaseº later in this chapter for details.) 

,

Deleting a User Account

If you find it necessary to delete a user account, the following procedure can be used.

1.	Choose Open User from the User Record menu in UserManager. In the panel that appears, click the appropriate domain, then click the account name you want to delete in the lower part of the panel. 

2.	Click OK. The Long Form appears. Be sure this is the user you want to remove. 

	Warning:	Make sure you haven't selected one of the standard accounts. 

,

3.	Choose Delete from the User Record menu. The following panel appears:

,

4.	Choose whether to delete or disable the account:

a.	Click ªDelete the account from the NetInfo databaseº if you want to remove all information about the user account from the NetInfo database. Choose this option if the user is unlikely to need access to the system again in the future. 

b.	Click ªDisable the account but leave it in the NetInfo databaseº if you just want to change the account password so that it's impossible to log in with this account name. Nothing else in the NetInfo database is changed, so you can later reactivate this account. To reactivate a disabled account, give the user a new password with UserManager. Choose this option if it's likely that the user will need to use the system at a later time.

5.	If you want to remove the user's home directory, check ªDelete the user's home directory.º Be especially careful using this option. If there might be important files in the user's directory that haven't been backed up, don't use this option. Sometimes this option will be disabled; for example, if the user's home directory is ª/º. 

Note:  You can disable the account and delete the home directory, but it's rarely a good idea. If you re-enable the account, you'll have to create a new home directory for that user.

6.	Click OK. The account will be removed or disabled, according to your instructions. 

Changing Local Accounts to Network-Wide Accounts 

If you've already created local accounts, you can make some or all of them network-wide. The easiest way to accomplish this is described in the following procedure.

Creating the Network Account

The first step is to create the new network account:

1.	Log into the computer that will hold the user's new home directory.

2.	Start up the UserManager application, located in /NextAdmin. If you're not logged in as root, UserManager will display a panel telling you that you must have superuser status to run this application. Type the password for the root account and click Login.

3.	Choose Open User from the User Record menu. The Open in NetInfo Domain panel appears. 

4.	In the upper portion of the panel, choose the local domain where the user account resides (for example, /earth, where earth is the computer holding the local account). 

5.	In the lower portion of the panel, double-click the account you want to make network-wide. A user window appears. 

,

6.	Change the user ID only if necessary to avoid conflicts with an existing network account.

7.	Change the Home Directory field to the appropriate network-wide directory (for instance, /Net/earth/Users/lbrown).

8.	Choose Save to Domain from the User Record menu. The Save to NetInfo domain panel appears. Select the root domain (or the appropriate domain if you have a three-level NetInfo structure) and click OK. 

9.	An attention panel appears displaying all the information about the user account. Make sure the information is accurate, then click Yes. 

,

10.	A warning panel appears, asking if you want to create the home directory. Click Yes. 

,

11.	You may be presented with a panel in which you need to type the root password of the root domain. Enter the password and click Login. (Initially, the root password for the root domain will be the same as the root password on the master NetInfo server. See ªExamining the NetInfo Databaseº later in this chapter for details.) 

,

12.	If the user ID number is not unique in the selected domain, a panel appears warning you of this. Click Cancel Save, then change the user ID. Choose Save again. 

,

13.	Make sure that the group memberships for the new network account are correct. For example, if the local user account belongs to a user group that doesn't exist in the root domain, remove the network user from those groups. You might also want to add the network user to groups that are only available in the root domain.

Deleting the Local Account

At this point, you have two accounts for the userÐa local account and a network-wide account. In order to successfully log into the network-wide account, you must eliminate the local account:

1.	Follow the instructions earlier in this chapter under ªDeleting a User Accountº to delete the local account. Be sure to select the proper local domain. When you delete the user, choose ªDelete the account from the NetInfo databaseº but do not delete the user's home directory.

2.	Have the user log into the new network account (this must be on the computer formerly used to hold the local account). The user should then copy the files from the old home directory on the local disk to the new home directory on the network (don't forget Mailboxes). 

Note:  It's important that the user do the copying, rather than having an administrator do it as root, so that the home directory maintains the proper file ownerships. If someone other than the user does the copying, you'll need to use the chown command to change file ownerships. See the UNIX manual page for chown for details.

3.	Delete the old home directory.

Customizing the User Environment

The UserManager application creates new user accounts with specific default data and a uniform home directory. You can change some of this information so that the user accounts created at your site meet your specific needs.

UserManager copies the directory /usr/template/user when it creates the home directory for a new user account. If you want a certain file included in every new user's home directory, or some other change to the default directory, you can change the model in /usr/template/user. (It's a good idea to make a copy of system files before changing them. You might copy /usr/template/user to /usr/template/user.orig, for instance, before modifying it.) Note that these changes don't affect home directories that already exist.

UserManager uses the same configuration file (/etc/nu.cf) as the UNIX utility nu. This file determines the default values for various components of new user accounts, as well as many other features of UserManager. By making modifications to this file, you can change the beginning user ID number, what the default group will be, and so on. For more information, see the UNIX manual page for nu.

Managing User Groups

You may find it worthwhile to set up several user groups at your site. You might, for example, organize users into groups based on organizational departments, or you might create a special group for all users associated with a specific project. Once you've created a user group, the members can grant file access to other members while denying it to nonmembers.

User Group Components

User groups and user accounts are similar in many ways. Like user accounts, user groups are made up of several components, including a name and ID number.

Group Name

Each user group is assigned a group name, which you use when you assign a group to a file or a user. The group name should contain only ASCII letters (without diacritics), digits, and the underbar (_) character, and must be at most 8 characters long. By convention, it has no uppercase letters and doesn't begin with a number.

Group ID

Much as a user ID is used by the system to identify a user account, a group ID is used to identify a user group. When a user is logged in, the system keeps a list of the group IDs of all the groups that user belongs to. This includes the default group listed in the user account, plus any groups stored in NetInfo that list the user among its members. When you create a user group with UserManager, the default group ID is assigned for you. If you use your own group IDs, make sure they are unique. Group IDs below 100 are reserved for system use (see the next section).

	Warning:	It's generally not a good idea to have duplicate group names or group IDs anywhere in the NetInfo domain hierarchy. For example, having a local group and a network group with the same group ID but different names will allow members of either group to access files associated with the other. To avoid these problems, always keep groups in the same NetInfo domains as the users in those groups. If you have users and groups in more than one domain, be sure that there's no overlap of group (or user) IDs between those domains. The exception to this is the standard groups, like wheel, which are duplicated in domains.

Group Members

Each user group includes a list of the users that are members of the group.

Standard Groups

As with user accounts, several user groups are included with each local domain. Most of these groups aren't used except for special purposes, and all have a group ID of 20 or less. In general, you shouldn't add network-wide users to groups with those IDs. One exception is the other group, with group ID 20, which can be used as the group for users who don't need to be in any particular group. If you use SimpleNetworkStarter or NetInfoManager to set up a parent domain, it creates several groups in the new domain, including other.

Here's a description of some of the standard groups:

·	other (group ID 20)ÐThe only standard group for regular users; the default for new user accounts.

·	wheel (user ID 0)ÐMembers of this group are permitted to use su to gain root access. Many system files have this group assigned to them. System administrators should belong to the wheel group.

·	nogroup (group ID -2)ÐThe group assigned to anonymous NFS users. See Chapter 4 for details. 

·	operator (group ID 9)ÐMembers of this group have permission to access device files, allowing them to perform system backups.

Adding a User Group

Follow these procedures to create a new user group:

1.	Start up UserManager.

2.	Choose New User Group from the User Record menu. The Select NetInfo Domain panel appears.

,

3.	Click the appropriate domain, then click OK to open the group window.

,

4.	Fill in the three fields of this window as follows:

Group NameÐEach group needs its own unique name. The group name should be all lowercase letters with no spaces or special characters. (The rules for valid account names apply to group names as well.)

Group IDÐEach user group must have a unique group ID number, which is used internally by the system to identify the group. The next available number has been determined and assigned automatically to this group. Don't change this value unless you have a very good reason and are certain your new group ID is unique.

Group DescriptionÐThis field is not used by the system and is available for you to store useful information about the group, such as a description of the group purpose.

5.	Save the new user group by choosing Save from the User Record menu. If you're creating a network user group, you may be asked for the root password for the domain. 

,

6.	Enter the appropriate password and click Login. This group is now available when you add new user accounts. Close the window.

7.	To add existing users to the new group, follow the instructions in the earlier section, ªModifying a User Accountº; or, if you'd like to add many users to the group at once, see the section ªAdding Multiple Users to a User Groupº later in this chapter.

Deleting a User Group

You might want to remove a user group that is no longer in use. For instance, if a user group was created for people working together on a project, the group generally becomes obsolete on completion of the project. This section shows how to delete a user group.

1.	Start up UserManager.

2.	Choose Open User Group from the User Record menu. The Open in NetInfo Domain panel appears. 

,

3.	Click the name of the domain holding the group you want to remove. 

4.	Click the group you want to delete in the bottom of this panel and click OK. A group window appears containing the data for the group you selected. Be sure that this is the group you want to delete. 

,

5.	Choose Delete from the User Record menu. A warning panel appears asking you to verify your action. 

,

6.	Click Delete. If you're removing this group from a network domain, you may be prompted for that domain's root password. 

,

7.	Enter the root password and click Login.

The user group is now removed from the NetInfo database.

Note:  If you try to delete a user group that is the default group of any user account, you see an error message. Click OK, then change the default group of the appropriate users. See the next section for details.

,

Identifying Accounts with a Particular Default Group 

As described in Chapter 3, ªNetInfo Networking,º you can change how the NetInfo directories are displayed in the browser. This can be useful when you want to determine which directories have a particular value for a property other than name. 

1.	Start up NetInfoManager. If the user accounts aren't stored in the local domain, use the Open command from the Domain menu to open the appropriate domain.

2.	Click /users in the directory browser, then click the name of one of the user accounts. 

,

3.	From the Domain menu choose View, and from the View menu choose View Directories By. This opens a window containing a scrollable list of properties.

,

This list shows the properties contained in each directory in the domain window. Notice that name is selected, indicating that each directory is represented in the domain window by the value of its name property.

4.	To display directories by their gid (group ID) property, click gid in the scrollable list and then click the Set View button. The display in the domain window changes to show the value of the gid property for each directory (user account). 

,

5.	Examine the display to determine which user accounts have the user group that you're going to delete as the default (remember, the default group is stored by number in the user account, not by name). You need to change the default group for these accounts so that you can delete the user group.

6.	Find the user name for each account that has the group as their default. Double-click each directory in turn, and make a note of the value of the name property.

7.	Change the display back to the way it was by choosing Domain and then View Directories By from the View menu. Click name in the list that appears and then the Set View button.

8.	Use the instructions in ªModifying a User Accountº earlier in this chapter to change the default user group for each account to something other than the user group you're going to delete.

Tip:  A faster and easier though potentially more dangerous way to modify the default group ID for these accounts is to use NetInfoManager directly:

1.	Double-click the gid value in the browser to open the Directory window.

2.	Click gid in the property column. 

3.	Click the value of the gid property in the Values column.

,

4.	Enter the group ID number of the group you want this account to use as the default and press Return.

5.	Choose Save from the Directory menu to save the modified account.

	Warning:	Be very careful whenever you make any modifications with NetInfoManager. Since it doesn't do any error checking, it's very easy to make mistakes. Make sure that you're modifying the value of the gid property (in the Values column) and not the key (in the Properties column). Also be sure that the number you use is a valid and appropriate group ID.

Adding Multiple Users to a User Group

When you create a new user group, you can add user accounts one by one using UserManager. A faster way is to use NetInfoManager.

	Warning:	Be very careful whenever you make any modifications with NetInfoManager. Since it doesn't do any error checking, it's very easy to make mistakes. Make sure that you're modifying the correct item, and always double-check your work.

1.	From NetInfoManager, click /groups in the domain window. Open a Directory window by double-clicking the name of the user group that you want to add users to.

,

2.	If there's not already a users property, create it:

a.	Click gid in the Properties column, then choose Append Property from the Directory menu. 

,

b.	Enter users into the text field and press Return.

3.	Click users in the Properties column.

4.	If the users property doesn't already have a value displayed in the Values column, choose New Value from the Directory menu. Otherwise, click the value in the Values column and choose Append Value from the Directory menu.

,

5.	Change the new value by entering the name of the account that you want to add to this group. Press Return.

,

6.	To add another account, choose Append Value from the Directory menu, enter the account name you want to add, and press Return. Repeat the same procedure for the remaining accounts you wish to add.

7.	When you've finished adding accounts, choose Save from the Directory menu. A warning panel appears, asking you if you're sure you want to make the change. 

,

8.	Click Change. You may see a panel asking for the root password for the domain. Enter the password and click Login.

Changing Local User Groups to Network-Wide Groups

If, for some reason, you have a local user group that you want to change to a network group, follow the steps in this section. 

Creating the Network User Group

The first step is to create the network user group:

1.	Start up the UserManager application, located in /NextAdmin. If you're not logged in as root, UserManager will display a panel telling you that you must have superuser status to run this application. Enter the password for the root account and click Login.

2.	Choose Open User Group from the User Record menu.

3.	In the upper portion of the Open in NetInfo Domain panel, choose the local domain where the user group resides (for example /earth, where earth is the host name of the computer holding the user group).

,

4.	In the lower portion of the panel, double-click the group you want to make network-wide. A group window appears. 

,

5.	Choose Save to Domain from the User Record menu. The Save to NetInfo panel appears. 

,

6.	Select the root domain (or other appropriate domain, if you have more than two levels in your NetInfo hierarchy) and click OK. 

7.	You may be prompted for the root password of the domain. If so, enter the appropriate password and click Login. 

Deleting the Local Group

At this point, you have two user groupsÐone local and one network-wide. In order to maintain consistency, you should eliminate the local group.

·	Follow the instructions earlier in this chapter under ªDeleting a User Groupº to delete each local group you've moved. Be sure to select the proper local domain for each host when deleting the old groups. 

Examining the NetInfo Database

As you've already discovered, UserManager modifies the appropriate NetInfo domain when you create a new user account. Take the following steps to examine the NetInfo database directly and see what changes UserManager has made.

1.	Start up the NetInfoManager application, located in /NextAdmin.

2.	Open the root domain by selecting Open from the Domain menu and double-clicking ª/º in the panel that appears. If you have a NetInfo hierarchy with more than two levels, open the domain you used to store the user accounts.

3.	Click /users to display all the user accounts in the domain.

,

4.	Choose a newly added user account and double-click its name to open the Directory window.

,

5.	Examine the various property values by clicking each property key in turn. These values should look familiar, since they're what you specified in UserManager.

6.	Click the property _writers_passwd and note the value. 

,

This property lists the names of the users who can modify the passwd property. This property has the same value as the name property (that is, the user name), so that the user can change the password without assistance from an administrator. 

Note:  Normally, properties and values can only be changed by a user knowing the root password for the domain, or a user logged in as root on the computer serving the domain. However, if a directory contains a property named _writers, the users listed as values of that property are permitted to change any properties or values in the directory. A property of the form _writers_property lists the users that can change the value of the indicated property. 

7.	Quit NetInfoManager by choosing Quit from the main menu.

Changing the root Password of a Domain

As mentioned earlier, each domain has its own root account. The password for this account is required when you make a change to the domain. When a new domain is created, as with SimpleNetworkStarter, the root account is copied from the local domain. Initially, the password will be the same in both domains. When you change the root password with the Preferences application or through a UNIX command, you only change the account in the local domain. 

If you want to change the root password for another domain, follow these procedures:

1.	Start up NetInfoManager.

2.	Choose Open from the Domain menu.

3.	Click the name of the appropriate domain in the panel that appears, then click OK.

4.	Choose Security from the Domain menu, then choose Change Root Password. A panel appears asking you to enter the old password. 

,

5.	Enter the current root password, then click OK. A panel appears asking for the new password. 

,

6.	Enter the new password, then click OK.

7.	You're asked to verify the new password. Enter it again, then click OK. 

The password for the root account is now changed.

Troubleshooting

Problems with a new user account usually show up when the user tries to log in. The most common problem with a new user account is an error in assigning the home directory. Three symptoms that indicate a problem with the user's home directory are:

·	The application dock associated with the root user appears instead of the default application dock.

·	The icon for the home directory appears as a neighbor icon (two houses) instead of the home icon (one house).

·	A panel appears during the login process, saying ªNo home directory.º

To correct this situation, first use UserManager to examine the user record for that user account. Make sure that the value of the User's Home Directory field is what it should be and that the named directory really exists. Take appropriate action depending on what you find:

·	If the value of the User's Home Directory field is incorrect, correct it and save the modified user record. 

·	If the value is correct, but the directory doesn't exist, use Create User's Directory from the User Record menu to create it. 

If the value of the home directory field is correct and the named directory exists, the problem is probably with the directory ownership or permissions. Use the Workspace Manager Inspector (from the Tools menu) to examine the permissions and ownership of the directory. Depending on what you find, take appropriate action:

·	If the directory permissions are set so that the user cannot access the directory, use the Inspector to correct them. 

·	If the owner of the directory listed in the Inspector is not the correct user, use the UNIX command chown from a shell window as follows, replacing user_name with the account name of the user and homedirectory with the complete path of the user's home directory:

chown -R user_name /homedirectory

If a user can successfully log into a newly created account, but later encounters attention panels when attempting to access files or directories, the problem may be with file ownerships or permissions. Again, use the Workspace Manager Inspector to determine whether such a problem exists, and use the Inspector and/or the chown command to correct any errors.