% last review: 2025-05-07
% review schedule: 1 year
% ISMSControl: A.9.2.2 % ISMSControl: 5.18

User accounts¶
Principles¶
- Users are distinguished as human or service users.
- All users of a resource group are configured (e.g. visible via
getent) on all nodes of a resource group. - The following attributes are globally unique: UID for users; group name and GID for groups.
- The presence of an account alone does not imply any permission assignments.
Human users¶
- The username is globally unique and must not start with
s-. - The primary group is
users. - The home directory is located in
/home/$USER.
Service users¶
- The primary group is
service. - Usernames usually start with
s-and are unique within a resource group. Different resource groups can reuse the same service user names. - The home directory is located in
/srv/$USER. - No SSH login is allowed by default to support the general data protection guidelines. In exceptional cases SSH access may be granted.
- Human users that have the sudo-srv permission in a project are
allowed to change to the service user ({command}
sudo -u <service_user_name> -i) and execute commands as a service user ({command}sudo -u <service_user_name> <command>).
Permissions¶
Users own a separate set of permissions for every project they are a member of. Common permissions include:
- login
-
Perform interactive shell login on a machine (via SSH).
- manager
-
Add or remove other users from the project. Define permissions for users in the project.
- sudo-srv
-
Sudo into service users on a machine (password not necessary)