Managing Users and Groups

1. Creating Users

Command	Description	Example
useradd	Creates a new user account	`sudo useradd -m john`
useradd -m	Creates a home directory for the user	`sudo useradd -m -d /home/jane jane`
useradd -g	Assigns the user to a primary group	`sudo useradd -g developers alice`
useradd -s	Sets the default shell for the user	`sudo useradd -s /bin/bash bob`
useradd -c	Adds a comment (GECOS field) to the user	`sudo useradd -c "John Doe" john`

Example: Create a user with a specific home directory

sudo useradd -m -d /home/john_doe -s /bin/bash -c "John Doe" john

Example: Create a user and set a password

sudo useradd -m -s /bin/bash alice
sudo passwd alice

2. Modifying User Accounts

Command	Description	Example
usermod	Modifies user account settings	`sudo usermod -d /home/newuser -m newuser`
passwd	Changes user password	`passwd username`
chsh	Changes user's default shell	`chsh -s /bin/zsh username`

Example: Changing User Home Directory

sudo usermod -d /home/johndoe -m johndoe

Example: Adding User to Group

sudo usermod -aG developers johndoe

Note: The -a flag ensures the user is added to the group without removing them from other groups.

3. Deleting Users

Command	Description	Notes
userdel	Deletes a user account from the system	Does not remove user's home directory or mail spool by default
userdel -r	Deletes a user account and removes the user's home directory and mail spool	Use with caution as it permanently deletes data

Example: Delete a user without removing home directory

sudo userdel john

Example: Delete a user and remove home directory

sudo userdel -r john

Note: Ensure the user is not currently logged in before deletion.

Warning: Using userdel -r will permanently delete all files in the user's home directory.

4. Setting User Passwords

Command	Description	Notes
passwd	Change password for current user	Interactive prompt for old and new passwords
passwd username	Change password for specified user	Requires root or sudo privileges
passwd -l username	Lock user account	Prevents login until unlocked with -u
passwd -u username	Unlock user account	Re-enables login for locked account
passwd -d username	Remove password (disable login)	User can only log in via SSH keys or other methods
passwd -S username	Display password status	Shows lock status, last change date, etc.

Example: Setting a new password for a user

sudo passwd john
Enter new UNIX password: &lt;new_password&gt;
Retype new UNIX password: &lt;new_password&gt;
passwd: password updated successfully

Example: Locking a user account

sudo passwd -l john
passwd: password locked successfully

Note: The passwd command uses PAM (Pluggable Authentication Modules) and stores passwords in /etc/shadow using SHA-512 encryption by default.

Warning: Never share passwords or store them in plain text files. Use secure methods like ssh-keygen for key-based authentication.

Password Policy Option	Default Value	Description
PASS_MAX_DAYS	`99999`	Maximum number of days a password may be used before it must be changed
PASS_MIN_DAYS	`0`	Minimum number of days between password changes
PASS_WARN_AGE	`7`	Number of days before password expiry to warn user
ENCRYPT_METHOD	`SHA512`	Encryption method used for password hashing

Example: Configure password aging policy

sudo chage -M 90 john
sudo chage -m 1 john
sudo chage -W 7 john

Password Security Best Practices

Use strong, unique passwords for each account
Enable two-factor authentication (2FA) where possible
Regularly review and update password policies
Use SSH keys instead of passwords for remote access
Enforce password complexity rules using libpam-pwquality

5. Creating Groups

Command	Description	Example
groupadd	Creates a new group	`sudo groupadd developers`
groupadd -g <GID>	Creates a group with a specific GID	`sudo groupadd -g 1005 developers`
groupadd -r	Creates a system group (GID < 1000)	`sudo groupadd -r systemd-journal`

Note: The groupadd command requires root or sudo privileges.

Example: Creating a Group with a Specific GID

sudo groupadd -g 1005 developers

This creates a group named developers with the GID (Group ID) of 1005.

Example: Creating a System Group

sudo groupadd -r systemd-journal

This creates a system group used by the systemd journaling service.

6. Modifying Groups

Command	Description	Example
groupmod	Modify group attributes like name or GID	`sudo groupmod -n newgroupname oldgroupname sudo groupmod -g 1001 groupname`

Note: The groupmod command does not change the primary group of existing users. Use usermod to update user group memberships if needed.

Example: Change Group Name

sudo groupmod -n developers olddevgroup

Example: Change Group ID

sudo groupmod -g 2000 developers

7. Deleting Groups

Command	Description	Notes
groupdel	Deletes a group from the system	Must not have any users assigned to it

Example: Delete a group

groupdel developers

Note: The groupdel command will fail if the group is still assigned to any user or has members.

Warning: Deleting a group can cause issues if applications or services depend on it. Ensure no dependencies exist before deletion.

8. Adding Users to Groups

Command	Description	Example
usermod	Adds a user to a supplementary group	`sudo usermod -aG developers john`
gpasswd	Manages group memberships; adds user to group	`sudo gpasswd -a john developers`

Example: Adding User to Multiple Groups

sudo usermod -aG developers,admin,users john

Note: The -a flag ensures the user is added to the group without removing them from other groups.

Warning: Changes to group membership may not take effect until the user logs out and back in.

9. Removing Users from Groups

Command	Description	Example
gpasswd -d	Remove a user from a specific group	`gpasswd -d john developers`
usermod -G	Remove a user from a group by resetting group list	`usermod -G john developers`

Example: Remove user from a group

gpasswd -d john developers

Note: The gpasswd -d command is preferred for removing a user from a group as it's more explicit and safer than modifying the group file directly.

10. Viewing User Information

Command	Description	Example
whoami	Prints the effective user ID	`whoami # Output: john`
id	Prints user and group IDs	`id # Output: uid=1000(john) gid=1000(john) groups=1000(john),27(sudo)`
who	Lists currently logged-in users	`who # Output: john pts/0 2024-05-10 10:30 (localhost)`
w	Shows logged-in users and their processes	`w # Output: john pts/0 10:30 0.00s 0.00s w`
last	Shows last logged-in users	`last # Output: john pts/0 localhost 2024-05-10 10:30 still logged in`

Example: Viewing User Info with id

id john
# Output: uid=1001(john) gid=1001(john) groups=1001(john),27(sudo)

Example: Viewing User Info with finger

finger john
# Output: Login: john     Name: John Doe
#         Directory: /home/john
#         Office: Room 101

11. Switching Users

Command	Description	Usage
su	Switch user identity	`su - username`
sudo	Execute command as another user (usually root)	`sudo -u username command`
sudo su -	Switch to root user	`sudo su -`

Example: Switching to another user

su - john

Example: Running a command as root

sudo -u root ls /root

12. Managing Sudo Access

Command	Description	Notes
sudo	`sudo command`	Execute a command as root
sudo -l	`sudo -l`	List allowed commands for current user
sudo -i	`sudo -i`	Start a root shell session
sudo -u username	`sudo -u username command`	Run command as a different user

Example: Granting Sudo Access to a User

# Add user to sudo group
usermod -aG sudo username

# Or edit /etc/sudoers with visudo
echo "username ALL=(ALL:ALL) ALL" &gt;&gt; /etc/sudoers

Example: Restricting Sudo Access

# Allow only specific commands
echo "username ALL=(ALL) /usr/bin/apt, /usr/sbin/service" &gt;&gt; /etc/sudoers

Note: Use visudo to safely edit the sudoers file and prevent syntax errors that could lock you out.

Warning: Never give full root access unless strictly necessary. Prefer least privilege principles.