Users and Groups app seems... half finished. Why?

[RedBearAK]

Upon installation of Mint, my user was automatically added to the following groups:

Code: Select all

adm, audio, cdrom, dialout, dip, input, lpadmin, plugdev, sambashare, sudo, tty, video

I assume that there is good reason for a desktop environment user to be in all these groups. So I am very confused by the fact that when adding a new user via the Cinnamon "Users and Groups" app, the new user is left with only these groups:

Code: Select all

nopasswdlogin, sudo, and [group with same name as username]

Also, by default, even if you choose "Administrator" (which I assume just adds the "sudo" group), the app does not ask for a password for the new user. So unless you go back in and deliberately set a password, you've just added a privileged account to your system, with no password.

For a community that is obsessed with doing everything the "secure" way (like not caching passwords temporarily for software installation), this seems like a fairly nonsensical state of affairs. These no-password users are able to log in to their own desktops, but can't authenticate to install software. So maybe they aren't considered a security risk? But it still seems very weird to not even ask for a password before allowing the account to be created.

If I wanted to set up a dozen different user accounts on this machine, I'd have to go in and manually set a password on each new account after creation, and also manually go in and select all the relevant groups to match what was set up automatically for the initial user.

I don't understand this, and I would love to see an explanation why this particular application in Mint seems like it was written to only be used by Linux gurus who would know exactly which groups to select by hand, from memory. This "Users and Groups" app is so basic that it's more like something I would expect to find in a web-based server UI like FreeNAS/TrueNAS, not on a user-oriented desktop distro. It makes adding new user accounts so complicated and error-prone for inexperienced users.

Why is it like this? Everything else in Mint and Cinnamon seems relatively well polished and user-friendly by comparison.

Also, it has a tendency to crash when I delete a user account. And there are actually two different "Users and Groups" applications presented in the Cinnamon menu that are only slightly different, and only one of them has an option to choose to encrypt the user's home folder before the account is created.

[jjp2145-oldtimer]

Creating a user in the sudo group without a password is a major security problem because anyone with access to the machine can run commands with sudo. I am alarmed to find out that this is possible, and yes I did confirm that I could create a user in the sudo group that does not need a password.

That being said, why would you do such a thing? Just click where it says password and add a password when you create an account. How many of your dozen accounts actually need to be in the sudo group? What do your dozen accounts need to be able to do? I don't think the average desktop distro is designed with a system administrator in mind.

I don't know why you have two Users and Groups and I don't know why Users and Groups is set up like it is.

[AZgl1800]

I would only allow one (1) sudo user, and that is me.
fortunately in this house, I only have one family member to deal with, and she is a Windows user.

[RedBearAK]

That being said, why would you do such a thing? Just click where it says password and add a password when you create an account.

I believe that is absolutely the wrong question. What matters is that this is supposed to be one of the main user-friendly distros (and for the most part, it is) and yet a common admin utility like the tool to add a new user is set up so that the user of the tool can simply forget that they didn't enter a password for a new account, because they were not prompted to do so. How could there even be a legitimate reason for the tool to not have the password field right there when creating a new user account? It makes no sense. A tool like this needs to be built to guide any level of user into correctly creating a safe user account with a legitimate password.

Oh, and when you add the user? You don't even end up with the new user highlighted. So there is literally nothing to remind you to actually go in and set a password, until you click on the new user's name in the list and see that it says "No password set". And all those fields on the right side of the pane? They're buttons, but they don't look like buttons, so there's no way to know that until you hover the mouse cursor over them and notice that they get highlighted a bit. The mouse cursor doesn't even change to indicate that they are clickable, there's just the highlighting. There's no immediate visual indication that anything on the right side of the pane is even editable at all.
.

users_no_password_field.png (12.2 KiB) Viewed 1399 times

No password prompt before creating.
.

After creating, new user not highlighted/selected.
.

Now you finally see "No password set". But how many inexperienced users would actually notice?

The preference pane that does this same function in macOS makes you actively confirm that you DON'T want to use a password for a new user account if you leave the password field empty, precisely because that is a security risk. I'm not sure if the latest versions of macOS will even still allow you to have a user account with no password, I'm still on Mojave. And every other user-add type of GUI tool in any operating system that I've ever seen in my entire life (there have been many) has always asked for a password for the new user. Always. So for this utility in Mint to fail to ask for the password before the new account is created is absolutely bizarre. I don't understand how either the Mint team or the community finds this tool acceptable. Does everyone using Mint just only have one user account on their machine?

How many of your dozen accounts actually need to be in the sudo group? What do your dozen accounts need to be able to do? I don't think the average desktop distro is designed with a system administrator in mind.

That "dozen accounts" was just an example to emphasize how cumbersome the process is in this version of the utility. In macOS, again, if you want to add a new user, you choose Standard or Administrator, just as you do in this utility, then enter the full name, username and _password_, verify the password, and you're done.

There is no messing about after that with adding the new user to the "correct" groups so that they won't have problems with audio, video or other things. What kind of new Linux user would even understand why such things would be necessary? Very few.

In short, I fully expected the Users and Groups application to create a new user with the exact same method that the main system installer used to create my initial user. Any other type of behavior makes very little sense. I did not expect to have to manually copy the collection of group selections from my main user to the new user, and I certainly did not expect to have to go through extra steps to make sure the new account actually had a password attached.

I don't know why you have two Users and Groups and I don't know why Users and Groups is set up like it is.

That's probably down to the fact that I have Cinnamon, MATE, and Xfce all installed on the same system, installed through the official "mint-meta" packages. It doesn't actually cause any real problems, but it does cause a number of "duplicate" applications to show up that don't properly isolate themselves to only be seen in the other desktop environment. Like two nearly identical "Archive Manager" apps that are very hard to tell apart. And two file managers that want to pretend their name is "Files".

The problem is not so much that there are two of them, the real problem is that the "Cinnamon" version is the one that doesn't seem as smart or as fully featured as the other one. I presume the other might be the default GNOME application that the Cinnamon version was forked from at some point. But neither has an "About" dialog, so it's hard to know for sure.

The Cinnamon version unfortunately is the one that is missing the option to choose to encrypt the new user's home folder. And the other version actually does a bit better job trying to prompt you after the initial step to enter a password. But you can still cancel out of that, leaving the password blank, and it doesn't complain. But it will show the account as "disabled", and make you enter a password to enable it.

So the non-Cinnamon version of the app seems a little better designed, but that isn't the version most Cinnamon users will see in their menu. I find the state of the Cinnamon version of this tool to be... very unfortunate, and sure as heck not user-friendly for any kind of new Linux user.

[Moonstone Man]

Oh, and when you add the user? You don't even end up with the new user highlighted. So there is literally nothing to remind you to actually go in and set a password, until you click on the new user's name in the list and see that it says "No password set". And all those fields on the right side of the pane? They're buttons, but they don't look like buttons, so there's no way to know that until you hover the mouse cursor over them and notice that they get highlighted a bit. The mouse cursor doesn't even change to indicate that they are clickable, there's just the highlighting. There's no immediate visual indication that anything on the right side of the pane is even editable at all.

There's absolutely nothing anyone here can do about a single one of those issues. There are no developers here, only Linux Mint users helping other Linux Mint users. If you have things that you think are bugs, take them to github otherwise you're just complaining at nobody who can fix them.

I find the state of the Cinnamon version of this tool to be... very unfortunate, and sure as heck not user-friendly for any kind of new Linux user.

See above.

[RedBearAK]

There's absolutely nothing anyone here can do about your issues. There are no developers here, only Linux Mint users helping other Linux Mint users. If you have things that you think are bugs, take them github otherwise you're just complaining at nobody who can fix them.

It's my understanding that this is a place to ask questions, and that there are no dumb ones. I'm not asking you or anyone else to "fix my problem", I'm asking if anyone even besides me even thinks that this is a problem at all. And if not, why not? What am I missing?

[Moonstone Man]

It's my understanding that this is a place to ask questions, and that there are no dumb ones.

Your understanding is correct, but the questions should be technical, not rhetorical and interspersed in great walls of bellyache.

I'm not asking you or anyone else to "fix my problem"...

Who said you were[1]?

I'm asking if anyone even besides me even thinks that this is a problem at all. And if not, why not?

It's not a problem for anyone with experience because most of us do administrative things and we know what we're doing.

What am I missing?

Questions that are technical, not rhetorical.

[1] This is a support sub-forum, which is clearly below the "Main Edition Support" forum, so the clear implication is that you are indeed asking for someone to fix it.

[RedBearAK]

[1] This is a support sub-forum, which is clearly below the "Main Edition Support" forum, so the clear implication is that you are indeed asking for someone to fix it.

So here is the technical question: Are all of those extra groups added to the initial user by the installer actually needed for any new user that is created? The groups I referenced in the first post. Those were added by the installer. Does each user have to be part of all those groups to fully use the system?

[Moonstone Man]

So here is the technical question: Are all of those extra groups added to the initial user by the installer actually needed for any new user that is created? The groups I referenced in the first post. Those were added by the installer. Does each user have to be part of all those groups to fully use the system?

I'll answer the last question first. The answer is no. Oddly, the answer to the first question is also no, so I could have answered the first question first.

Don't forget that LM is, in part, aimed at new users coming from Windows so the UI needs to be basic. The users and groups UI is not intended for experienced systems administrators who would normally use the command line and would also know what groups need to be added and for what purpose. Rather the Users and Groups UI is intended for much less experienced people, and it does actually do that job quite well; it hides the complexity of systems administration when one just wants to create a user. The groups tab though is just someone's brain dump of all the possible groups they could think of.

All of that said, and technical hat off, opinion hat on, I think that you have a very strong case. The Groups tab is completely disconnected from the Users tab, and it serves absolutely no purpose, except perhaps to show off some dude's ability to search google and make a list of groups, even if the groups can be edited, extended or deleted. It just sows confusion where it isn't necessary.

In general, I agree with you, but if you want things to change, the place to make your case is github.

[RedBearAK]

So here is the technical question: Are all of those extra groups added to the initial user by the installer actually needed for any new user that is created? The groups I referenced in the first post. Those were added by the installer. Does each user have to be part of all those groups to fully use the system?

Don't forget that LM is, in part, aimed at new users coming from Windows so the UI needs to be basic. The users and groups UI is not intended for experienced systems administrators who would normally use the command line and would also know what groups need to be added and for what purpose. Rather the Users and Groups UI is intended for much less experienced people, and it does actually do that job quite well; it hides the complexity of systems administration when one just wants to create a user. The groups tab though is just someone's brain dump of all the possible groups they could think of.

All of that said, and technical hat off, opinion hat on, I think that you have a very strong case. The Groups tab is completely disconnected from the Users tab, and it serves absolutely no purpose, except perhaps to show off some dude's ability to search google and make a list of groups, even if the groups can be edited, extended or deleted. It just sows confusion where it isn't necessary.

In general, I agree with you, but if you want things to change, the place to make your case is github.

So I guess the corollary question that goes with that is, why does the installer take the trouble to put the initial user in all those different groups if it isn't necessary? An inherited quirk from years ago when the installer was created? But at this point it's rhetorical. Unless you know something about that.

Seems like you're at least partially agreeing that the Users and Groups application needs to some work to be better for new users. Except I was never actually talking about the Groups tab specifically. I never actually looked in there. I was just talking about what happens on the Users tab. When you make a new user, it only gets a couple of groups added automatically, and since the initial user is in so many other groups, it makes it feel like the utility is not "completing the job" of making a new user properly. I guess this was an illusion?

Anyway, I am working on putting together a way to ask for a specific set of changes one by one, to hopefully make this better. But I needed to know first if I was seriously misunderstanding something about the way this tool was supposed to work. Although we seem to be agreeing in principle, I would still disagree with this one thing:

"Rather the Users and Groups UI is intended for much less experienced people, and it does actually do that job quite well; it hides the complexity of systems administration when one just wants to create a user."

I agree who it's intended for. I don't agree that the Users tab is doing a good job at all of hiding the complexity for less experienced people. To do that, it would need to be hiding all the group stuff entirely, especially if it's unnecessary for the user to mess with any of that when creating a new user. Just like macOS does. You can go into another specialized app to see and edit user groups on macOS if you really want to, but in the main Users & Groups preference pane all of that is just not there. So no confusion. The typical macOS user never knows that their user is part of any unix-ish groups behind the scenes. This app produces confusion. It goes out of its way to show you what groups each user is in, and make you think you might need to do something with that.

Thanks for your input. I will try to take all this and formulate a way to ask for changes that the devs might see as useful for the intended audience. I've already put a few things in on the GitHub, but I always try to understand what I'm asking for first, so it will at least make some sense.

[Moonstone Man]

So I guess the corollary question that goes with that is, why does the installer take the trouble to put the initial user in all those different groups if it isn't necessary?

It doesn't. It only adds the necessary groups:

me adm cdrom sudo dip plugdev lpadmin

Seems like you're at least partially agreeing that the Users and Groups application needs to some work to be better for new users.

The groups tab is erroneous, it seems to me. Probably a leftover that was never removed, or a vapourware feature that never got off the ground and eventually got forgotten.

it makes it feel like the utility is not "completing the job" of making a new user properly. I guess this was an illusion?

Not an illusion, no. Maybe a minor misunderstanding. As a general rule, users of Linux Mint don't need to worry about groups, ever, and rarely do they need to create new users. In a home environment they may add one or two users. In a corporate or small business environment, it would be done using the command line, or even translated from Active Directory, or in a script, for example, one that takes an existing user name and a new user name as input and clones the existing user groups to the new one. All that new users in the home need to know is how to create or delete users, which is what the Users tab does, and that's all it's supposed to do. Beyond that, one needs to know how to add users to groups, for example, with VirtualBox or Samba, and when that happens, you are no longer a basic user.

Anyway, I am working on putting together a way to ask for a specific set of changes one by one, to hopefully make this better. But I needed to know first if I was seriously misunderstanding something about the way this tool was supposed to work.

If you plan to submit them to github, the best way is to take a look at github before you start. Submissions are supposed to be in a particular format.

I agree who it's intended for. I don't agree that the Users tab is doing a good job at all of hiding the complexity for less experienced people. To do that, it would need to be hiding all the group stuff entirely, especially if it's unnecessary for the user to mess with any of that when creating a new user.

The groups stuff, as I said, appears to be erroneous. I don't think it should be there. Anyway, unless you're installing software that requires configuring in the command line, where, as I said, you've gone past simply adding accounts for family members, it does what it's supposed to do. It's ok to disagree but I think you're missing the point in doing so.

Just like macOS does. You can go into another specialized app to see and edit user groups on macOS if you really want to, but in the main Users & Groups preference pane all of that is just not there. So no confusion. The typical macOS user never knows that their user is part of any unix-ish groups behind the scenes. This app produces confusion. It goes out of its way to show you what groups each user is in, and make you think you might need to do something with that.

And there goes another missed point. Apple averaged $1,000,000,000 a day in income over the holiday period at the end of 2019. Linux Mint pulls in $10,000 a month on a very good month, and far more often, very much less. So, given that resources are so thin on the ground, the Linux Mint team really must work out its priorities, so things like an expanded, more capable Users & Groups implementation may very well be right down the bottom of the list. In addition, and again because resources are scare, the highest common denominator applies so that a feature has benefit to a wide range of users, not just to a few.

Thanks for your input.

With my compliments.

[jjp2145-oldtimer]

The Cinnamon version unfortunately is the one that is missing the option to choose to encrypt the new user's home folder.

You buried this at the bottom of a long post. Did you read the release note that an encrypted home directory is no longer unmounted when you log out? You have to shut down or reboot for that. The Cinnamon version might be saving you a headache. Other then that, I don't see anything unanswered that belongs in a user forum.