User and Group Management in Linux

October 22, 2025
•
linux
basiclinux

Master the fundamentals of Linux user and group administration with practical examples and hands-on tutorials.

linuxterminalshellserver

Linux User and Group Management

Master the fundamentals of Linux user and group administration with practical examples and hands-on tutorials.

Understanding Root vs Regular Users

Root user has complete system access and can perform any operation, while regular users have limited permissions for security.

bash
# Check current user
whoami

# Switch to root (if you have sudo access)
sudo su -

# Check if you're root
id

System Files Overview

/etc/passwd - User Database

Contains user account information in a specific format:

bash
# View passwd file
cat /etc/passwd

# Format: username:password:x:uid:gid:gecos:home:shell
# Example: malik:x:1001:1001:malik abdullah,,,:/home/malik:/bin/bash

Field breakdown:

/etc/group - Group Database

Stores group information:

bash
# View group file
cat /etc/group

# Format: groupname:password:x:gid:members
# Example: developers:x:1002:malik,john,sarah

Field breakdown:

/etc/shadow - Password Database

Contains encrypted passwords and account information:

bash
# View shadow file (requires root)
sudo cat /etc/shadow

# Format: username:encrypted_password:last_change:min:max:warn:inactive:expire:reserved

User Management

Adding Users

bash
# Basic user creation
sudo useradd john

# Create user with specific options
sudo useradd -m -s /bin/bash -c "John Doe" -g users john

# Set password
sudo passwd john

Common useradd options:

Home Directory & /etc/skel

bash
# /etc/skel contains template files for new users
ls -la /etc/skel/

# Copy custom template
sudo cp /etc/skel/.bashrc /etc/skel/.bashrc.backup
sudo echo "alias ll='ls -la'" >> /etc/skel/.bashrc

Removing Users

bash
# Remove user but keep home directory
sudo userdel john

# Remove user and home directory
sudo userdel -r john

# Force removal (even if user is logged in)
sudo userdel -f john

Modifying Users

bash
# Change user's full name
sudo usermod -c "John Smith" john

# Change user's shell
sudo usermod -s /bin/zsh john

# Add user to additional groups
sudo usermod -aG sudo,developers john

# Lock/unlock account
sudo usermod -L john  # lock
sudo usermod -U john  # unlock

Password Management

bash
# Change password
sudo passwd john

# Lock account (prevent login)
sudo passwd -l john

# Unlock account
sudo passwd -u john

# Force password change on next login
sudo passwd -e john

Group Management

Adding Groups

bash
# Create basic group
sudo groupadd developers

# Create group with specific GID
sudo groupadd -g 1500 managers

Modifying Groups

bash
# Change group name
sudo groupmod -n newname oldname

# Change group ID
sudo groupmod -g 2000 developers

Removing Groups

bash
# Remove group (must be empty)
sudo groupdel developers

# Check if group has members first
getent group developers

Administrative Tasks

Root User Operations

bash
# Switch to root
sudo su -

# Execute single command as root
sudo command

# Edit files as root
sudo nano /etc/hosts

Sudoers Configuration

bash
# Edit sudoers file safely
sudo visudo

# Grant user full sudo access
john ALL=(ALL:ALL) ALL

# Grant specific command access
john ALL=(ALL) /usr/bin/apt, /usr/bin/systemctl

# Grant passwordless sudo
john ALL=(ALL) NOPASSWD:ALL

Account Security

bash
# Lock account
sudo usermod -L username

# Check account status
sudo passwd -S username

# Set account expiration
sudo usermod -e 2024-12-31 username

# Check last login
last username

Practical Tutorials

Tutorial 1: Create a Developer User

bash
# 1. Create group for developers
sudo groupadd developers

# 2. Create user with home directory
sudo useradd -m -s /bin/bash -c "Developer User" -g developers devuser

# 3. Set password
sudo passwd devuser

# 4. Add to sudo group
sudo usermod -aG sudo devuser

# 5. Verify creation
id devuser
groups devuser

Tutorial 2: Manage Group Memberships

bash
# 1. Create multiple groups
sudo groupadd frontend
sudo groupadd backend

# 2. Add user to multiple groups
sudo usermod -aG frontend,backend devuser

# 3. Check group memberships
groups devuser

# 4. List all users in a group
getent group frontend

Tutorial 3: Account Security Setup

bash
# 1. Create user with expiration
sudo useradd -m -e 2024-12-31 tempuser

# 2. Set password policy
sudo passwd -x 90 tempuser  # password expires in 90 days

# 3. Lock account for maintenance
sudo usermod -L tempuser

# 4. Check account status
sudo passwd -S tempuser

Tutorial 4: System Administration

bash
# 1. Check all users
cut -d: -f1 /etc/passwd

# 2. Find users with shell access
grep -v '/nologin\|/false' /etc/passwd | cut -d: -f1

# 3. Check user login history
last -n 10

# 4. Monitor failed login attempts
sudo grep "Failed password" /var/log/auth.log

Quick Reference Commands

TaskCommand
List userscut -d: -f1 /etc/passwd
List groupscut -d: -f1 /etc/group
User infoid username
Group membersgetent group groupname
Login historylast username
Current userwhoami
Switch usersu - username
Sudo accesssudo -l

Security Best Practices

  1. Use strong passwords - enforce password complexity
  2. Limit sudo access - only grant necessary permissions
  3. Regular audits - review user accounts and permissions
  4. Account expiration - set expiration dates for temporary accounts
  5. Monitor access - check login logs regularly
  6. Lock unused accounts - disable accounts not in use

Remember: Always use visudo to edit sudoers file safely, and test user accounts after creation to ensure proper access.