user management in Linux

Linux is multi-user by design. Every account the system knows about is a record with its own user ID, home directory, login shell and set of group memberships, and almost everything a process is allowed to do is decided by which account it runs as. Managing users therefore means five things: creating accounts, giving them credentials, adjusting their properties, controlling which groups they belong to, and eventually locking or removing them.

All of it happens through a small set of commands. They change system-wide state, so they need root privileges, which is why sudo shows up in front of nearly every example below.

adding a new user

adduser creates the account along with its primary group and its entry in the user database.

sudo adduser diogo

verifying the user was created

Search the user database for an exact word match on the name:

sudo grep -w 'diogo' /etc/passwd

The /etc/passwd file is like a phonebook for user accounts. Each line represents one user account, with different pieces of information separated by colons (:). The information are as follows:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin

Reading the first line, root:x:0:0:root:/root:/bin/bash, from left to right, the seven fields are:

  • root user name. The login name, unique on the system. It is what you type at a login prompt and what commands such as chown or su expect.
  • x password. On older UNIX systems the hashed password was stored right here. Because /etc/passwd has to stay readable by everyone, anyone could copy those hashes and attack them offline, so the hash was moved to /etc/shadow, which only root can read. The x that is left behind simply means look it up over there.
  • 0 user ID (UID). The number the kernel actually uses for permission checks; the name is only for humans. UID 0 is always root, which is what really makes an account the superuser. System accounts sit below 1000 and regular users normally start at 1000.
  • 0 group ID (GID). The user's primary group, matching an entry in /etc/group. Files the user creates are owned by this group by default. Any additional groups live in /etc/group, not here.
  • root comment (GECOS). A free-form description of the account: full name, office, phone number. These are the optional details adduser prompts for, and they are often left empty or simply repeat the user name.
  • /root home directory. Where the shell starts after login, and what $HOME and ~ expand to. Note that root's home is /root, not /home/root.
  • /bin/bash login shell. The program started once the user logs in. Accounts that exist only to own files and run services are given /usr/sbin/nologin or /bin/false instead, so a login attempt is refused immediately. That is exactly what the daemon, bin and sys lines above do.

adding a user with a home directory

Create the account together with its own home directory:

sudo adduser -m diogo

Then confirm the directory exists, along with its owner and permissions:

sudo ls -ld /home/diogo

setting a user password

A fresh account is not usable until it has a password:

sudo passwd diogo

After this command you will be asked to enter a new password twice. Nothing is echoed to the terminal while you type.

modifying user properties

usermod edits an existing account in place. Point it at a different home directory:

sudo usermod -d /home/felipe diogo

Or change the login shell:

sudo usermod -s /bin/bash diogo

Both fields live in /etc/passwd, so the same lookup as before shows the result:

sudo grep -w 'diogo' /etc/passwd

adding a user to a group

Groups are how privileges get handed out. This adds the user to the sudo group:

sudo usermod -aG sudo diogo

The -a flag means append. Without it, -G replaces every supplementary group the user currently belongs to.

List the groups the user now belongs to:

groups diogo

switching to a different user

Start a session as another account. The dash makes it a login shell, so the target user's environment and home directory are loaded:

su - otherUser

locking and unlocking user accounts

Locking temporarily disables a user account without deleting it:

sudo passwd -l diogo

And unlocking restores access:

sudo passwd -u diogo

deleting a user

When the account is no longer needed:

sudo userdel -r diogo

The -r option removes the user's home directory and mail spool. Without it, those files are left behind owned by a user ID that no longer maps to a name.