User Accounts: Authentication, Authorization, and System Management
At its core, a user account is a digital identity that allows an individual to authenticate to a computer system. This process is the first step in establishing a secure connection, enabling the system to track activity and manage how resources are distributed. While often used interchangeably, it is critical to distinguish between authentication—proving who you are—and authorization—determining what you are allowed to do.
Key Facts
- Authentication verifies identity, but it does not automatically grant authorization to access resources.
- Multi-user systems use identity correlation to replace usernames with numeric identifiers for internal processing.
- Home directories provide private storage for users, protected by file system permissions.
- Password storage methods vary significantly between Unix-based systems and Microsoft Windows.
- Special accounts, such as "guest" or "anonymous," allow system access without a personalized account.
How User Accounts Function
To access an account, a user must provide credentials, such as a password. This process serves several vital functions: security, logging, accounting, and general resource management. Once the system verifies these credentials, it performs identity correlation. Instead of using the alphanumeric username throughout every operation, the operating system assigns a unique identifier, such as an integer, to refer to the user.
In Unix-based systems, for example, this is handled by correlating the username with a specific user ID (UID).
[ไม่มีภาพประกอบ]Single-User vs. Multi-User Systems
Computer systems are generally categorized by how they handle user identities:
- Single-user systems: These systems lack the concept of multiple distinct accounts.
- Multi-user systems: These require users to identify themselves before accessing the system to ensure data isolation and security.
Resource Management and Permissions
In a multi-user environment, each account typically possesses a home directory. This is a dedicated space for storing files related exclusively to that user's activities. To maintain privacy, these directories are protected from other users, although a system administrator usually retains access.
Access control is managed through file system permissions. The operating system inspects these permissions to decide if a user has the right to read a file, execute a program, or save a new file within a specific directory. Additionally, accounts may feature a public user profile containing basic information provided by the owner.
While most accounts are tied to one person, some systems provide generic accounts for broader access, such as "guest" accounts or "anonymous" accounts used in anonymous FTP.
Password Storage and Security
Different operating systems employ different strategies for storing sensitive credential data:
| Operating System | Storage Location / Method | Format |
|---|---|---|
| Unix | /etc/passwd (accounts) and /etc/shadow (passwords) | Hashed form |
| Microsoft Windows | Credential Manager / Windows profile directory | Managed via system tools |
Username Formats
The rules for how a username is formatted depend on the application or operating system in use. Microsoft Windows environments, for instance, utilize two primary formats:
- User Principal Name (UPN): An email-like format, such as
UserName@Example.com. - Down-Level Logon Name: A format that specifies the domain, such as
DOMAIN\UserName.
Frequently Asked Questions
Does authentication mean I am authorized to access a file?
No. Authentication only proves your identity. Authorization is a separate process that determines whether your authenticated identity has the specific permissions required to access a resource.
What is identity correlation?
Identity correlation is the process where an operating system replaces a human-readable username with a system-readable identifier, such as an integer, to manage the user session more efficiently.
How are files protected in a multi-user system?
Files are protected using file system permissions, which the operating system checks to determine if a user is allowed to read, write, or execute a specific file.
Where does Unix store user passwords?
While basic account information is stored in /etc/passwd, the actual passwords are stored in a hashed format within the /etc/shadow file for increased security.
What is the difference between a UPN and a Down-Level Logon Name?
A User Principal Name (UPN) follows a format similar to an email address (user@domain.com), whereas a Down-Level Logon Name uses a backslash to separate the domain from the username (DOMAIN\user).