funwithlinux guide

An Introduction to Linux User Management

Linux, a multi-user operating system, is designed to support multiple users simultaneously, each with distinct access levels and permissions. Whether you’re a system administrator managing a server or a casual user setting up a personal machine, understanding **user management** is critical. It ensures security, resource control, and organized access to files and services. In this guide, we’ll explore the fundamentals of Linux user management, including users, groups, configuration files, essential commands, and best practices. By the end, you’ll be equipped to create, modify, and manage users and groups effectively.

Table of Contents

Understanding Users and Groups in Linux

What Are Users?

A user is an entity that interacts with the Linux system. Each user has a unique identifier (UID) and a username, which the system uses to track ownership of files, processes, and resource access. Users are the foundation of access control: permissions for files, directories, and services are assigned to specific users.

What Are Groups?

A group is a collection of users. Groups simplify permission management by allowing multiple users to share access to resources (e.g., a “developers” group for a project folder). Instead of assigning permissions to each user individually, you assign them to the group, and all members inherit those permissions.

Types of User Accounts

Linux categorizes users into three main types based on their role and privileges:

Root User

The root user (UID 0) is the superuser with unrestricted access to the system. It can modify any file, run any command, and bypass all security checks. For security, avoid using root for daily tasks—use sudo (covered later) instead.

Regular Users

Regular users (typically UID ≥ 1000 on modern Linux distributions) are standard accounts for human users. They have limited privileges and can only modify their own files and run non-administrative commands by default. Examples: john, alice.

System Users

System users (UID 1–999) are created automatically by the OS or installed software to run services (e.g., www-data for web servers, mysql for databases). They rarely have login shells and exist to isolate service processes from regular users.

Types of Group Accounts

Groups are equally important for organizing users. Linux defines two primary types of groups:

Primary Groups

Every user belongs to exactly one primary group (defined in /etc/passwd). By default, files created by a user are owned by their primary group. When a user logs in, their primary group is active unless changed.

Secondary Groups

Users can belong to multiple secondary groups (also called supplementary groups). These groups grant additional permissions beyond the primary group. For example, a user might be in the “users” primary group and “developers” secondary group to access project files.

Key Configuration Files for User/Group Management

Linux stores user and group data in plain-text configuration files. Understanding these files is essential for troubleshooting and advanced management.

/etc/passwd

The /etc/passwd file contains basic user account information. It is world-readable (mode 644) and structured as colon-separated fields:

username:password:UID:GID:GECOS:home_directory:shell
  • username: Login name (e.g., john).
  • password: Historically stored hashed passwords; now replaced with x (passwords are stored in /etc/shadow for security).
  • UID: Unique user ID (e.g., 1000 for regular users).
  • GID: Primary group ID (e.g., 1000).
  • GECOS: Optional comment (full name, phone number, etc.).
  • home_directory: Path to the user’s home folder (e.g., /home/john).
  • shell: Default login shell (e.g., /bin/bash; /sbin/nologin for non-interactive users).

Example entry:

john:x:1000:1000:John Doe:/home/john:/bin/bash

/etc/shadow

The /etc/shadow file stores secure user password information (mode 000 or 600, readable only by root). It uses colon-separated fields:

username:password_hash:last_change:min_age:max_age:warn_period:inactive_period:expire_date:reserved
  • username: Matches /etc/passwd.
  • password_hash: Hashed password (e.g., $6$... for SHA-512). A ! or * means the account is locked.
  • last_change: Days since 1970-01-01 when the password was last changed.
  • min_age: Minimum days before the password can be changed (0 = no restriction).
  • max_age: Maximum days the password is valid (e.g., 90 = change every 90 days).
  • warn_period: Days before password expiry to warn the user.
  • inactive_period: Days after expiry before the account is locked.
  • expire_date: Days since 1970-01-01 when the account expires (blank = never).

Example entry:

john:$6$abc123$xyz789...:19500:0:90:7:14::

/etc/group

The /etc/group file stores group information (mode 644). It uses colon-separated fields:

groupname:password:GID:members
  • groupname: Group name (e.g., developers).
  • password: Historically group passwords; now x (stored in /etc/gshadow).
  • GID: Unique group ID (e.g., 1001).
  • members: Comma-separated list of secondary group members (primary members are not listed here).

Example entry:

developers:x:1001:john,alice

/etc/gshadow

The /etc/gshadow file stores secure group data (mode 000 or 600, root-only). It includes group passwords (rarely used) and admin users:

groupname:password:admins:members
  • groupname: Matches /etc/group.
  • password: Hashed group password (or ! if none).
  • admins: Users allowed to manage the group (e.g., add/remove members).
  • members: Secondary group members (same as /etc/group).

User Management Commands

Linux provides command-line tools to create, modify, and delete users. Below are the most essential commands:

Creating a User: useradd

The useradd command creates new user accounts. Use options to customize the home directory, shell, groups, and more.

Syntax:

useradd [options] username

Common Options:

  • -m/--create-home: Create the user’s home directory (required on some distros).
  • -d/--home-dir PATH: Set a custom home directory (default: /home/username).
  • -s/--shell SHELL: Set the login shell (e.g., /bin/bash, /bin/zsh).
  • -g/--gid GID: Specify the primary group (by GID or name).
  • -G/--groups GROUPS: Add the user to secondary groups (comma-separated).
  • -c/--comment COMMENT: Add a GECOS comment (e.g., full name).

Example: Create a user john with a home directory, bash shell, and “John Doe” comment:

sudo useradd -m -d /home/john -s /bin/bash -c "John Doe" john

Setting/Changing Passwords: passwd

The passwd command sets or changes a user’s password. Only root can change other users’ passwords; regular users can change their own.

Syntax:

passwd [username]  # Omit username to change your own password

Example: Set a password for john:

sudo passwd john

The system will prompt you to enter and confirm the password (no output is shown for security).

Modifying a User: usermod

The usermod command modifies existing user accounts. Use it to change the home directory, shell, groups, or other attributes.

Common Options:

  • -d/--home PATH: Change the home directory.
  • -s/--shell SHELL: Change the login shell.
  • -g/--gid GID: Change the primary group.
  • -G/--groups GROUPS: Update secondary groups (use -a to append, not replace).
  • -l/--login NEW_NAME: Rename the user.

Examples:

  • Change john’s shell to zsh: 
    sudo usermod -s /bin/zsh john
  • Add john to the developers secondary group: 
    sudo usermod -aG developers john  # -a = append (critical!)

Deleting a User: userdel

The userdel command removes a user account. Use -r to delete their home directory and mail spool.

Syntax:

userdel [-r] username  # -r = remove home directory and mail

Example: Delete john and their home directory:

sudo userdel -r john

Checking User Information: id

The id command displays a user’s UID, GID, and group memberships.

Syntax:

id [username]  # Omit username to check your own info

Example: Check john’s details:

id john

Output:

uid=1000(john) gid=1000(john) groups=1000(john),1001(developers)

Group Management Commands

Managing groups is as important as managing users. Below are commands to create, modify, and delete groups.

Creating a Group: groupadd

The groupadd command creates new groups. Use -g to specify a custom GID.

Syntax:

groupadd [-g GID] groupname

Example: Create a developers group with GID 1001:

sudo groupadd -g 1001 developers

Modifying a Group: groupmod

The groupmod command modifies existing groups (e.g., rename, change GID).

Common Options:

  • -n/--new-name NEW_NAME: Rename the group.
  • -g/--gid GID: Change the group’s GID.

Example: Rename developers to devs:

sudo groupmod -n devs developers

Deleting a Group: groupdel

The groupdel command deletes a group (only if no user lists it as their primary group).

Syntax:

groupdel groupname

Example: Delete the devs group:

sudo groupdel devs

Adding/Removing Users from Groups: gpasswd/usermod

To add/remove users from secondary groups, use gpasswd (group password) or usermod -aG.

gpasswd Syntax:

sudo gpasswd -a username groupname  # Add user to group
sudo gpasswd -d username groupname  # Remove user from group

Example: Add john to devs:

sudo gpasswd -a john devs

Checking Group Memberships: groups

The groups command lists all groups a user belongs to (primary + secondary).

Syntax:

groups [username]  # Omit username to check your own groups

Example: Check john’s groups:

groups john

Output:

john : john devs  # "john" is primary, "devs" is secondary

User Authentication and Password Policies

Secure authentication is critical for system safety. Linux uses two key mechanisms: password policies and PAM.

Password Security

To enforce strong passwords, use passwd with options to set password expiration and complexity:

  • passwd --max-days 90 username: Force password change every 90 days.
  • passwd --min-days 7 username: Prevent password changes for 7 days after reset.
  • passwd --warn-days 14 username: Warn 14 days before expiry.

Example: Set a 90-day password expiry for john:

sudo passwd --max-days 90 john

Pluggable Authentication Modules (PAM)

PAM is a framework that controls how users authenticate (passwords, SSH keys, biometrics, etc.). Configuration files for PAM are stored in /etc/pam.d/ (e.g., /etc/pam.d/login for terminal logins).

For example, to enforce password complexity (e.g., minimum length, mixed case), install libpam-pwquality and edit /etc/pam.d/common-password to include:

password requisite pam_pwquality.so minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1

This requires passwords to be at least 10 characters with uppercase, lowercase, digit, and special character.

Sudo: Delegating Administrative Privileges

The sudo (superuser do) command allows regular users to run administrative commands with root privileges—without logging in as root.

What is sudo?

sudo checks the /etc/sudoers file to determine which users/groups can run which commands. It logs all actions, enhancing accountability.

Configuring sudo: visudo

To edit /etc/sudoers, always use visudo (not a direct text editor). visudo validates syntax before saving, preventing accidental lockouts.

Syntax:

sudo visudo

Common Entries:

  • Allow user john to run all commands with sudo: 
    john ALL=(ALL:ALL) ALL
  • Allow the sudo group (Debian/Ubuntu) to run all commands: 
    %sudo ALL=(ALL:ALL) ALL
  • Allow john to run apt and systemctl without a password: 
    john ALL=(ALL:ALL) NOPASSWD: /usr/bin/apt, /usr/bin/systemctl

Common sudo Examples

  • Update system packages: 
    sudo apt update && sudo apt upgrade -y  # Debian/Ubuntu
sudo dnf update -y  # RHEL/CentOS
  • Edit a protected file (e.g., /etc/fstab): 
    sudo nano /etc/fstab

Best Practices for Linux User Management

Follow these practices to keep your system secure and organized:

  1. Least Privilege: Grant users only the permissions they need (avoid adding everyone to sudo).
  2. Avoid Root Login: Use sudo instead of logging in as root directly.
  3. Strong Passwords: Enforce long, complex passwords with passwd policies and PAM.
  4. Regular Audits: Review /etc/passwd, /etc/group, and last (login history) for unused accounts.
  5. Remove Unneeded Users/Groups: Delete accounts for former employees or deprecated services.
  6. Monitor Logs: Check /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) for suspicious login attempts.

Conclusion

Linux user management is a cornerstone of system administration. By mastering users, groups, configuration files, and commands like useradd, groupmod, and sudo, you can secure your system, control access, and streamline resource sharing. Remember to follow best practices like least privilege and strong passwords to keep your Linux environment safe.

References