4. Account — FreeNAS®11.2-BETA1 User Guide Table of Contents

# 4. Account

The Account Configuration section of the administrative GUI describes how to manually create and manage users and groups. This section contains these entries:

- Groups: used to manage UNIX-style groups on the FreeNAS® system.
- Users: used to manage UNIX-style accounts on the FreeNAS® system.

Each entry is described in more detail in this section.

## 4.1. Groups

The Groups interface provides management of UNIX-style groups on the FreeNAS® system.

Note

It is unnecessary to recreate the network users or groups when a directory service is running on the same network. Instead, import the existing account information into FreeNAS®. Refer to Directory Services for details.

This section describes how to create a group and assign user accounts to it. The next section, Users, describes creating user accounts.

Click Account ‣ Groups to see a screen like Figure 4.1.1.

Fig. 4.1.1 Group Management

The Groups page lists all groups, including those built in and used by the operating system. The table displays group names, group IDs (GID), built-in groups, and if sudo is permitted. Clicking the ⫶ (Options) icon on a user created group entry displays Members, Edit, and Delete options. Click Members to view and modify the group membership. Note built-in groups are required by the FreeNAS® system so they do not have Edit, and Delete buttons.

The ＋ (Add/Create) button opens the screen shown in Figure 4.1.2. Table 4.1.1 summarizes the available options when creating a group.

Fig. 4.1.2 Creating a New Group

Table 4.1.1 Group Creation Options
Setting | Value | Description
--- | --- | ---
GID | string | The next available group ID is suggested. By convention, UNIX groups containing user accounts have an ID greater than 1000 and groups required by a service have an ID equal to the default port number used by the service. Example: the `sshd` group has an ID of 22.
Name | string | Enter a name for the new group.
Permit Sudo | checkbox | Set to allow group members to use sudo. When using sudo, a user is prompted for their own password.
Allow repeated GIDs | checkbox | Set to allow multiple groups to share the same group id (GID). This is useful when a GID is already associated with the UNIX permissions for existing data.

After a group and users are created, users can be added to a group. Click ⫶ (Options) on the desired group then Members. Select the users in the Members list. This list shows all user accounts on the system. Next, click > to move the users to the right frame. Press Save to add the users on the right frame to the group.

Figure 4.1.3, shows user1 added as a member of group data1.

Fig. 4.1.3 Assigning a User to a Group

The Delete button deletes a group. The pop-up message asks if all users with this primary group should also be deleted, and to confirm the action. Note built-in groups do not have a Delete button.

## 4.2. Users

FreeNAS® supports users, groups, and permissions, allowing flexibility in configuring which users have access to the data stored on FreeNAS®. To assign permissions to shares, select one of these options:

1. Create a guest account for all users, or create a user account for every user in the network where the name of each account is the same as a login name used on a computer. For example, if a Windows system has a login name of bobsmith, create a user account with the name bobsmith on FreeNAS®. A common strategy is to create groups with different sets of permissions on shares, then assign users to those groups.
2. If the network uses a directory service, import the existing account information using the instructions in Directory Services.

Account ‣ Users lists all system accounts installed with the FreeNAS® operating system, as shown in Figure 4.2.1.

Fig. 4.2.1 Managing User Accounts

Each user entry displays the username, user ID, primary group ID, home directory, default shell, built-in user, and other configured options. Clicking a column name sorts the list by that value. An arrow indicates which column controls the view sort order. Click the arrow to reverse the sort order.

Click ⫶ (Options) on the user created account to display the Edit and Delete buttons. Note built-in users do not have a Delete button.

Note

Setting the email address for the built-in root user account is recommended as important system messages are sent to the root user. For security reasons, password logins are disabled for the root account and changing this setting is highly discouraged.

Except for the root user, the accounts that come with FreeNAS® are system accounts. Each system account is used by a service and should not be used as a login account. For this reason, the default shell on system accounts is nologin(8). For security reasons and to prevent breakage of system services, modifying the system accounts is discouraged.

The ＋ (Add/Create) button opens the screen shown in Figure 4.2.2. Table 4.2.1 summarizes the options that are available when user accounts are created or modified.

Warning

When using Active Directory, Windows user passwords must be set from within Windows.

Fig. 4.2.2 Adding or Editing a User Account

Table 4.2.1 User Account Configuration
Setting | Value | Description
--- | --- | ---
User ID | integer | Grayed out if the user already exists. When creating an account, the next numeric ID is suggested. By convention, user accounts have an ID greater than 1000 and system accounts have an ID equal to the default port number used by the service.
Username | string | Grayed out if the user already exists. Maximum 16 characters, though a maximum of 8 is recommended for interoperability. Cannot begin with a hyphen `-`, if a `$` is used it can only be the last character, and it cannot contain a space, tab, or the characters `, : + & # % ^ & ( ) ! @ ~ * ? < > =`
Create a new primary group | checkbox | Set by default to create a new a primary group with the same name as the user. Unset to select a different primary group name.
Primary Group | drop-down menu | Unset Create a new primary group to access this menu. For security reasons, FreeBSD will not give a user su permissions if wheel is their primary group. To give a user su access, add them to the wheel group in Auxiliary groups.
Home Directory | browse button | Browse to the name of an existing pool or dataset where the user will be assigned permission to access.
Home Directory Mode | checkboxes | Sets default Unix permissions of user’s home directory. This is read-only for built-in users.
Shell | drop-down menu | Select the shell to use for local and SSH logins. See Table 4.2.2 for an overview of available shells.
Full Name | string | This field is mandatory and may contain spaces.
Email | string | The email address associated with the account.
Password | string | Mandatory unless Disable password login is set. Cannot contain a `?`.
Confirm Password | string | Required to match the value of Password.
Disable password login | checkbox | Set to disable password logins and authentication to SMB shares. To undo this setting, set a password for the user with the Edit button for the user in Users. Setting this option grays out Lock user and Permit Sudo, which are mutually exclusive.
Lock user | checkbox | Set to prevent the user from logging in until the account is unlocked. Setting this option grays out Disable password login, which is mutually exclusive.
Permit Sudo | checkbox | Set to allow members of the group to use sudo. When using sudo, a user is prompted for their own password.
Microsoft Account | checkbox | Set if the user is connecting from a Windows 8 or higher system.
SSH Public Key | string | Paste the user’s public SSH key to be used for key-based authentication. Do not paste the private key!
Auxiliary groups | drop-down menu | Select which groups the user will be added to.

Note

Some fields cannot be changed for built-in users and are grayed out.

Table 4.2.2 Available Shells
Shell | Description
--- | ---
netcli.sh | User is shown the Console Setup menu (Figure 3.1) on connection, even if it is disabled in System ‣ Advanced ‣ Enable Console Menu. The user must be root or have root permissions (effective user ID 0, like toor)
csh | C shell
sh | Bourne shell
tcsh | Enhanced C shell
nologin | Use when creating a system account or to create a user account that can authenticate with shares but which cannot login to the FreeNAS system using ssh.
bash | Bourne Again shell
ksh93 | Korn shell
mksh | mirBSD Korn shell
rbash | Restricted bash
rzsh | Restricted zsh
scponly | Select scponly to restrict the user’s SSH usage to only the scp and sftp commands.
zsh | Z shell
git-shell | restricted git shell

Built-in user accounts needed by the system cannot be removed. A Delete button appears for custom users that were added by the system administrator. Clicking Delete opens a popup window to confirm the action and present the option to not delete the user primary group when the user is deleted.