Chapter 4: Linux Users & Groups Administration

Enterprise User Lifecycle

Standard workflow for production user administration:

Create User ──► Assign Password ──► Assign Groups ──► Grant sudo ──► Disable/Delete Account
              

Commands for Each Stage

1. Create: sudo useradd -m -s /bin/bash john
2. Password: sudo passwd john
3. Groups: sudo usermod -aG developers john
4. Sudo (least privilege): add a constrained rule with visudo (see section 12). For group-based elevation: Debian/Ubuntu often use sudo; RHEL/Rocky/AlmaLinux often use wheel.
5. Lock password auth: sudo passwd -l john or sudo usermod -L john (locks the password hash only).
6. Disable account access: also expire the account (sudo usermod --expiredate 1 john), revoke SSH keys/sessions, and set a non-login shell when policy requires full disablement.
7. Delete: sudo userdel -r john (removes home directory — confirm backups first).

1. Introduction

Linux is designed as a multi-user operating system. Every process, file and service runs under a user account. User and group management provides accountability, security and controlled access to system resources.

2. Types of Linux Users

Users ──► Root | Regular Users | System Users | Service Accounts
                

3. Understanding UID & GID

Linux identifies users and groups using numeric IDs rather than names.

$ id
uid=1000(ashu) gid=1000(ashu) groups=1000(ashu),27(sudo)

4. Primary vs Secondary Groups

Each user belongs to one primary group and may belong to multiple secondary groups.

• The creating user’s UID remains the file owner.
• The user’s primary GID becomes the new file’s group owner (unless a directory’s SGID bit or ACLs change that behavior).
• Secondary groups grant shared access to existing files and directories without changing the file’s owner or primary group.

5. User Information Files

root:x:0:0:root:/root:/bin/bash

Fields: Username, Password Placeholder, UID, GID, Comment, Home Directory, Login Shell.

6. Useful Information Commands

7. Hands-on Practice

1. Run whoami, id, and groups.
2. View the first few entries in /etc/passwd.
3. Identify your account UID and primary group mappings.

8. Common Beginner Mistakes

• Confusing usernames with numeric system UIDs.
• Assuming every account is an interactive login user profile.
• Editing /etc/passwd manually without extreme caution.
• Forgetting the append (-a) option with usermod -G.

9. Account Lifecycle Creation (useradd, usermod)

Create normal login accounts with useradd (without -r). Use useradd -r only when you intentionally need a system account in the reserved UID range.

sudo useradd -m -s /bin/bash david   # normal user + home + bash
sudo usermod -aG developers john     # append secondary group (keep -a)
sudo usermod -s /bin/zsh john        # change login shell
sudo useradd -r -s /usr/sbin/nologin appuser  # system account; RHEL often uses /sbin/nologin (symlink either way)

10. Password Aging Configurations (chage)

Use chage to inspect and set password aging. Maximum age does not force an immediate reset by itself — the next forced change depends on the last password-change date.

sudo chage -l appadmin
sudo chage -M 90 -W 7 appadmin   # max age 90 days; warn 7 days before expiry

11. Group Administration (groupadd, gpasswd)

Create shared groups and manage membership:

sudo groupadd developers
sudo gpasswd -a john developers   # add john to developers
sudo gpasswd -d john developers   # remove john from developers (does not delete the user)
sudo groupmod -n eng developers   # rename group
# sudo groupdel eng               # delete empty group only after confirming no owners remain

12. Switch Identities (su, sudo, visudo)

Use su - to switch to another user with a full login environment. Prefer sudo for audited, least-privilege elevation instead of logging in as root.

Always edit sudo policy with visudo (or visudo -f /etc/sudoers.d/…) so syntax is validated before the file is installed. Prefer drop-in files under /etc/sudoers.d/ instead of editing the main sudoers file.

Least-privilege example (lab-safe pattern):

# Create with: sudo visudo -f /etc/sudoers.d/nginx-ops
# File mode must be 0440
%nginx-ops ALL=(root) /usr/bin/systemctl restart nginx, /usr/bin/systemctl status nginx

# Verify what a user can run:
sudo -l -U alice

Group-based elevation differs by distribution:

• Debian/Ubuntu: members of group sudo are commonly allowed sudo (when sudoers permits it).
• RHEL/Rocky/AlmaLinux: members of group wheel are commonly allowed sudo.

# Debian/Ubuntu example
sudo usermod -aG sudo alice

# RHEL-family example
sudo usermod -aG wheel alice

After changing membership, confirm with id alice and sudo -l -U alice. Review sudo logs (often journalctl or /var/log/secure / /var/log/auth.log) during audits.

13. Production Login Outages

Commands Covered in This Chapter

• useradd / usermod / userdel — create, modify, and remove accounts
• passwd / passwd -S — set passwords and inspect lock status
• groupadd / groupmod / groupdel / gpasswd — manage groups and membership
• id / groups / getent — inspect identity and databases
• chage — password aging and account expiry
• su / sudo / visudo — identity switching and least-privilege elevation