Users & groups

Users & groups manages the accounts that access the shares and the administrators of the web interface.

Roles

Role	Web interface	Shares
Administrator	may log in and change everything	access like a user
User	cannot log in, not even to the API	only the shares released to them or their groups

Administrators are the members of the Linux group bunkerbox-admin. The role is set on the user; the members of bunkerbox-admin cannot be edited directly.

What a NAS user is

A user is a regular Linux account plus a Samba account:

• no login shell (/usr/sbin/nologin) and no home directory (/nonexistent): no login via SSH or on the console;
• primary group users, further groups as selected;
• a Samba account with the same password, so SMB access works.

Accounts that existed on the system before (for example your own user with a shell) are listed as well and can be edited. Their shell and home directory stay unchanged.

Creating and editing users

New user asks for the user name, full name, password, role and groups.

• User name: lowercase letters, digits, - and _, starting with a letter or _, at most 32 characters. It cannot be changed later. Names already used by a user or group of the system and reserved names (root, nobody, users, guest, everyone, bunkerbox, bunkerbox-admin) are rejected.
• Full name: at most 64 characters, without :, ,, =, quotes and backslashes.
• Password: 8 to 256 characters, without line breaks.

When editing, the full name, role, groups and the Account active switch can be changed. Memberships in system groups the interface does not show (for example sudo or docker) are kept.

Setting a password

Password sets the Linux and the Samba password at the same time. If the Samba account is still missing (column Samba shows "No account"), it is created. A disabled account stays disabled.

Disabling

A disabled account keeps all data and memberships but can log in neither via SMB nor to the interface: the Linux password is locked (usermod -L) and the Samba account is disabled (smbpasswd -d).

Deleting

Delete removes the Linux and the Samba account. The user name has to be typed to confirm. Files of the user on the shares are kept.

Deleting is refused as long as

• the user still has an access rule on a share (remove it in the share first),
• the user is still connected (for example to an SMB share).

Protection rules

• System accounts (uid or gid below 1000 and nobody/nogroup) are never shown or changed. The exception is the group bunkerbox-admin, which is maintained through the roles only.
• The last active administrator can be neither deleted, disabled nor turned into a user.
• You cannot delete, disable or demote your own account.
• When an administrator's password is changed, the role is removed, or the account is disabled or deleted, all of their sessions end. Changing your own password means logging in again.

Groups

Groups combine users, so shares do not have to be assigned to every user individually. A group has a name (same rules as user names), a description and members.

• Bunkerbox stores the description itself (data/groups.json), because Linux groups have no description field.
• Private groups that Linux creates for single users (same name as the user) are not shown.
• A group cannot be deleted while a share has an access rule for it or while it is the primary group of a user. The group name has to be typed to confirm.

Behind the scenes

All changes use the Debian tools useradd, usermod, userdel, groupadd, gpasswd, groupdel, chpasswd, smbpasswd and pdbedit. Names are validated strictly first; passwords are only passed on standard input and never show up in process lists.

Mock mode

In mock mode the page shows a simulated family NAS (administrators admin and daniel, users such as anna, max and the disabled lena, groups family, media, backup, photos). Changes only live in memory and are gone after a restart. The login is always admin / admin.