Managing Users and Groups

Reading /etc/passwd and /etc/group tells you what exists. Actually creating an account, adding someone to a team’s group, or removing a user who’s left means going through dedicated commands instead — editing those files directly by hand is both unnecessary and risky, since a malformed line in /etc/passwd can break login for the entire system.

Every command in this chapter needs elevated privileges, since you’re changing system-wide account data — expect sudo in front of nearly everything.

Creating A User: useradd

sudo useradd alice

This creates a bare-minimum account: an entry in /etc/passwd, an entry in /etc/shadow with no password set yet (meaning alice can’t actually log in until one’s set), and by default, depending on your system’s configuration, possibly no home directory at all. That last part catches people off guard — plain useradd on many Debian-based systems doesn’t create a home directory automatically, unlike some other distributions.

A more complete, realistic version:

sudo useradd -m -s /bin/bash alice

• -m creates a home directory (/home/alice) if it doesn’t already exist, and populates it with default configuration files.
• -s /bin/bash sets the login shell explicitly, rather than leaving it unset or defaulting to something you didn’t intend.

You can also assign a primary group and additional supplementary groups at creation time:

sudo useradd -m -s /bin/bash -g developers -G sudo alice

• -g developers sets developers as the primary group (lowercase g, singular).
• -G sudo adds alice to the supplementary group sudo (uppercase G, and it can take a comma-separated list for multiple groups at once).

Important: check the behaviour of -g

id -Gn alice

Creating System User

Every account created so far has been a regular human user, landing at UID 1000 or above, as covered in the User/Group Model chapter. Service accounts — the www-data, syslog-style entries you saw browsing /etc/passwd — are created differently, with -r (or the equivalent long form --system):

sudo useradd -r -s /usr/sbin/nologin -M appservice

• -r creates a system account instead of a regular one — the account gets a UID from the lower, system-reserved range instead of counting up from 1000, marking it clearly as non-human at a glance in any /etc/passwd listing.
• -s /usr/sbin/nologin sets a shell that refuses interactive login entirely — appropriate here, since nobody should ever be logging in as a service account directly.
• -M explicitly skips creating a home directory. Most system accounts don’t need one, and the -r alone doesn’t guarantee a home directory is skipped on every distribution, so it’s worth setting explicitly rather than assuming.

This is exactly the pattern you’d use when setting up a dedicated, isolated identity for a service to run under — the same principle covered back in the System Accounts vs. Human Accounts section: if that service is ever compromised, whatever it can access is limited to what appservice has permission to touch, nothing more.

Clean up the same way as any other account:

sudo userdel appservice

Setting A Password

A newly created account has no usable password until you set one, using the same passwd command referenced back in the Special Bits chapter as the classic setuid example:

sudo passwd alice

This prompts you to type — and confirm — a new password for alice, updating the hash in /etc/shadow directly. Run without a username, passwd changes the password for whoever is currently logged in, no sudo required, since you’re always allowed to change your own password.

Modifying An Existing User: usermod

usermod changes an account’s settings after it already exists — everything useradd sets at creation time, usermod can adjust afterward.

Adding a user to an additional group, without disturbing their existing group memberships:

sudo usermod -aG developers alice

That -a (append) matters enormously here. -G alone replaces a user’s entire supplementary group list with whatever you specify — leaving off -a on a user who already belongs to several groups will silently remove them from all the others. -aG together means “add this group to the existing list,” which is what you want essentially every time you’re managing group membership after the fact.

Changing a user’s shell:

sudo usermod -s /usr/sbin/nologin alice

Useful for converting a former human account into something closer to a service account — nobody can log in interactively as alice anymore, without deleting the account or its files.

Locking and unlocking an account, without deleting it:

sudo usermod -L alice
sudo usermod -U alice

-L locks the account by disabling the password (the account still exists, but can’t authenticate), -U unlocks it again. This is generally the safer move for a user leaving temporarily, compared to deleting the account outright and potentially losing ownership context on their files.

sudo usermod -p "$(openssl passwd -6 'YourPasswordHere')" alice
sudo useradd -p "$(openssl passwd -6 'YourPasswordHere')" -m -s /bin/bash bob

Removing A User: userdel

sudo userdel alice

This removes the account entry from /etc/passwd and /etc/shadow, but by default leaves the home directory and its contents untouched. Files alice owned on the system don’t disappear — they just end up owned by a UID that no longer resolves to any username, showing up as a raw number in ls -l output instead of a name.

To remove the home directory and mail spool along with the account:

sudo userdel -r alice

Creating And Removing Groups: groupadd / groupdel

Groups follow the same pattern, with fewer moving parts since there’s no password or home directory involved.

sudo groupadd developers

Creates a new, empty group. Removing one:

sudo groupdel developers

This fails if the group is still set as any user’s primary group — you’d need to reassign those users to a different primary group first (with usermod -g) before the group can be removed.

A Full Example, Start To Finish

Putting the whole thing together into one realistic sequence — onboarding a new team member:

sudo groupadd developers
sudo useradd -m -s /bin/bash -g developers -G sudo alice
sudo passwd alice
sudo usermod -aG developers,sudo alice

That last line is redundant here since group membership was already set at creation — included only to show the safer, append-based pattern you’d actually reach for later, when adding an existing user to a new group without disturbing what they already have.

Clean it up once you’re done experimenting:

sudo userdel -r alice
sudo groupdel developers

Quick Reference

What’s Next

You can now create, adjust, and remove both users and groups directly. There’s still one gap: every command in this chapter required sudo, and you’ve been typing it for a while now without a real explanation of what it’s actually doing, how it differs from su, or where its rules are configured. That’s the chapters in this section.