Chapter 6: Users and groups

Manage accounts and groups

Four commands cover the life of a user account (create, change, lock, delete) and three do the same for groups. They edit the account files for you, safely and consistently, so you never need to edit /etc/passwd by hand.

• Create accounts with useradd and its common options, and explain what it does behind the scenes.
• Change accounts with usermod, including adding supplementary groups without removing existing ones, and delete them with userdel.
• Create, rename, delete and manage the members of groups with groupadd, groupmod, groupdel and gpasswd.

All of these commands need root, so run them with sudo or from a root shell.

Create an account

[root@servera ~]# useradd ops1
[root@servera ~]# id ops1
uid=1001(ops1) gid=1001(ops1) groups=1001(ops1)

One short command does a lot. Step through it:

What useradd does: Step through what one useradd command changes.

The defaults come from /etc/login.defs (UID ranges, home directory mode, password ageing defaults) and /etc/default/useradd:

[root@servera ~]# grep -E '^(UID_MIN|UID_MAX|HOME_MODE|CREATE_HOME|PASS_MAX_DAYS)' /etc/login.defs
HOME_MODE	0700
PASS_MAX_DAYS	99999
UID_MIN                  1000
UID_MAX                 60000
CREATE_HOME	yes

The new account can't log in yet: its password field is !!, no password set. passwd ops1 sets one (the passwords lesson covers it).

Options you will use

[root@servera ~]# useradd -u 3050 -g devteam -G wheel -c "Deploy robot" -s /sbin/nologin deploy
[root@servera ~]# grep deploy /etc/passwd
deploy:x:3050:30000:Deploy robot:/home/deploy:/sbin/nologin
[root@servera ~]# id deploy
uid=3050(deploy) gid=30000(devteam) groups=30000(devteam),10(wheel)

Change an account

usermod takes the same options as useradd, plus a few of its own:

[root@servera ~]# usermod -aG devteam,wheel ops1
[root@servera ~]# id ops1
uid=1001(ops1) gid=1001(ops1) groups=1001(ops1),10(wheel),30000(devteam)

A user who is logged in while you change their groups keeps the old set until they log out and back in, because group membership is read at login.

Groups

[root@servera ~]# groupadd -g 30000 devteam
[root@servera ~]# grep devteam /etc/group
devteam:x:30000:
[root@servera ~]# groupmod -n developers devteam
[root@servera ~]# gpasswd -d ops1 developers
Removing user ops1 from group developers
[root@servera ~]# groupdel developers
groupdel: cannot remove the primary group of user 'deploy'

groupdel refuses to delete a group that is still some account's primary group: change that account's primary group first, or delete the account.

Delete an account

userdel NAME removes the account from the account files, but leaves its home directory and mail spool. userdel -r NAME removes those too:

[root@servera ~]# userdel deploy
[root@servera ~]# groupdel developers
[root@servera ~]# userdel -r ops1
[root@servera ~]# ls /home
deploy  student

With deploy gone, groupdel now succeeds. /home/deploy was left behind, still owned by UID 3050. If a new account later receives that UID, it silently inherits those files, so either use -r, or move the files somewhere safe and give them a new owner. Chapter 17 shows how to find files that no account owns, with find / -nouser.

Check your understanding

• alice is in wheel and docker. After usermod -G devteam alice, which supplementary groups does she have?
• Which command creates a service account svc-backup that can't log in interactively?
• A new account shows !! in /etc/shadow. Why can't it log in?
• Where do you put a file so every new user gets a copy in their home directory?
• What does userdel bob leave behind that userdel -r bob removes?
• Which adds the existing user carol to the existing group auditors?