DevOps Peach

Linux · Linux System Administration and Networking · Lesson 1 of 6

Manage users and groups

Create identities and memberships without overwriting existing access.

Practice interactively →

Where accounts live

Each /etc/passwd line describes an account, UID, primary GID, home, and login shell; password hashes live in /etc/shadow, not here. Groups and their members are listed in /etc/group. id alice shows UID, primary group, and supplementary groups, while groups alice focuses on memberships.

UID 0 is root. Most distributions give regular users UIDs from 1000 up; lower numbers belong to system accounts such as www-data or nginx, which run services and usually have the login shell /usr/sbin/nologin.

flowchart LR
  A["Admin<br/>sudo"] -- "useradd -m" --> U["User alice<br/>/etc/passwd"]
  U --> PW["Password hash<br/>/etc/shadow"]
  A -- "usermod -aG docker" --> GR["Group docker<br/>/etc/group"]
  U --> GR
  GR --> F["Files owned<br/>by the group"]
  %% step A: Account changes need root, so they run with sudo.
  %% step U: useradd -m creates the account and its home directory; it is listed in /etc/passwd.
  %% step PW: The password hash is stored separately in /etc/shadow, readable only by root.
  %% step GR: usermod -aG adds a supplementary group. Without -a the existing groups are replaced.
  %% step F: Group membership grants the group permission bits on files.

Change an account

Goal Common command
Create a user sudo useradd -m alice or distro-specific adduser
Set or change a password sudo passwd alice
Create a group sudo groupadd devops
Add a supplementary group sudo usermod -aG devops alice
Lock or unlock login sudo usermod -L alice / -U
Set account expiry sudo chage -E 2026-12-31 alice
Remove user and home sudo userdel -r alice

With usermod, -G replaces the complete supplementary-group list; -a preserves existing memberships and appends a group. Plain userdel alice keeps the home by default, which may aid recovery but leaves data to manage. New group memberships apply at the next login, so the user must log out and back in.

Becoming another user

sudo cmd runs one command as root and logs it. Who may use sudo is set in /etc/sudoers; edit it only with sudo visudo, which checks syntax before saving, or drop a file in /etc/sudoers.d/. Ubuntu grants sudo to the sudo group, the Red Hat family to wheel. su - alice switches to another account with its full login environment and asks for that account's password; sudo -i opens a root shell with your own password.

Who is logged in

who and w list current sessions, and last shows recent logins. For SSH access, a user's public keys go in ~/.ssh/authorized_keys, which should be readable only by its owner.

Administrative commands need root. When a prompt says you already are root, forms with and without leading sudo are equivalent.

Practice interactively →