Linux User Management — Complete Practical Guide

1. What Is Linux User Management?

Linux is a multi-user operating system. Multiple users can have different:

·       User accounts

·       Passwords

·       Groups

·       Permissions

·       Home directories

·       Login shells

·       Sudo privileges

For example:

Linux Server

├── root

├── sankh

├── alice

├── bob

├──devuser2

└── devuser1

 

A Linux administrator manages these accounts and controls what each user can access.

2. Linux Root User

root is the Linux superuser.

Check:

whoami

If you're root:

root

Check root's UID:

id root

Typically:

uid=0(root) gid=0(root) groups=0(root)

Why UID 0?

Linux identifies users internally using a UID (User ID).

root → UID 0

3. Check Your Current User

Run:

whoami

Example:

sankh

Get detailed information:

id

Example:

uid=1000(sankh) gid=1000(sankh) groups=1000(sankh),27(sudo)

This tells you:

Item	Meaning
UID	User ID
GID	Primary Group ID
groups	Groups the user belongs to
sudo	Administrative privileges

 

4. See All Users

Linux stores local user accounts in:

/etc/passwd

Run:

cat /etc/passwd

You'll see entries such as:

root:x:0:0:root:/root:/bin/bash

sankh:x:1000:1000::/home/sankh:/bin/bash

devuser1:x:1001:1001::/home/devuser1:/bin/bash

For just usernames:

cut -d: -f1 /etc/passwd

Find regular users

awk -F: '$3 >= 1000 {print $1}' /etc/passwd

5. Understand /etc/passwd

A typical entry:

devuser1:x:1001:1001:Dev User:/home/devuser1:/bin/bash

The fields are:

 

More precisely:

username : password-placeholder : UID : GID : comment : home : shell

Example

devuser1:x:1001:1001:Dev User:/home/devuser1:/bin/bash

means:

• Username → devuser1
• Password field → x
• UID → 1001
• Primary GID → 1001
• Home → /home/devuser1
• Shell → /bin/bash

 

6. Understand /etc/shadow

Password hashes and password-aging information are stored in:

/etc/shadow

View it:

sudo cat /etc/shadow

⚠️ Do not manually edit this file.

Use commands such as:

passwd

and:

chage

instead.

---

7. Create a User with adduser

For Ubuntu, adduser is beginner-friendly:

sudo adduser devuser1

You'll be asked for a password and optional information.

Verify:

id devuser1

Check the home directory:

ls /home

You should see:

devuser1

---

8. Create a User with useradd

Another command is:

sudo useradd devuser2

However, useradd does not automatically create a home directory unless you request it.

Use:

sudo useradd -m devuser2

Set a password:

sudo passwd devuser2

Verify:

id devuser2

Difference

adduser
   ↓
Interactive and beginner-friendly

useradd
   ↓
Low-level command, useful for scripting/automation

---

9. Switch to Another User

Use:

su - devuser1

Check:

whoami

Result:

devuser1

Check the home directory:

pwd

Result:

/home/devuser1

Return to your previous user:

exit

---

10. Change a User Password

Change your own password:

passwd

Change another user's password:

sudo passwd devuser1

Example:

New password:
Retype new password:
passwd: password updated successfully

Remember: Linux normally doesn't display anything while you type a password.

---

11. Create Linux Groups

Groups make permission management easier.

Create a group:

sudo groupadd developers

Verify:

getent group developers

Create another:

sudo groupadd testers

---

12. Add User to a Group

Add devuser1 to developers:

sudo usermod -aG developers devuser1

Check:

groups devuser1

or:

id devuser1

You should see:

developers

Important: -aG

Use:

usermod -aG group username

-a means append.

Without -a, you may accidentally replace the user's existing supplementary groups.

---

13. Add User to Multiple Groups

For example:

sudo usermod -aG developers,testers devuser1

Check:

id devuser1

---

14. Remove User from a Group

Remove devuser1 from testers:

sudo gpasswd -d devuser1 testers

Verify:

groups devuser1

---

15. View All Groups

Run:

cat /etc/group

Or:

cut -d: -f1 /etc/group

Find a specific group:

getent group developers

---

16. Give User Sudo Access

Ubuntu normally uses the sudo group for administrative access.

Add:

sudo usermod -aG sudo devuser1

Verify:

groups devuser1

Then switch:

su - devuser1

Test:

sudo whoami

Expected:

root

That's because devuser1 now has sudo privileges.

---

17. Remove Sudo Access

Return to your administrative user:

exit

Then:

sudo gpasswd -d devuser1 sudo

Verify:

groups devuser1

---

18. Lock a User Account

Lock:

sudo passwd -l devuser1

Check status:

sudo passwd -S devuser1

You can also use:

sudo usermod -L devuser1

Real-world use

Account locking is useful when an employee temporarily leaves the company or an account needs to be disabled without deleting it.

---

19. Unlock a User

Unlock:

sudo passwd -u devuser1

or:

sudo usermod -U devuser1

Check:

sudo passwd -S devuser1

---

20. Change Username

Suppose you have:

devuser2

and want:

developer

Run:

sudo usermod -l developer devuser2

Check:

getent passwd developer

---

21. Change the Home Directory

You can change and move the user's home directory:

sudo usermod -d /home/developer -m developer

Check:

getent passwd developer

---

22. Change Login Shell

See available shells:

cat /etc/shells

Change a user's shell to Bash:

sudo usermod -s /bin/bash developer

Verify:

getent passwd developer

---

23. Password Aging with chage

Check password aging:

sudo chage -l devuser1

You'll see information such as:

Last password change
Password expires
Password inactive
Account expires
Minimum number of days
Maximum number of days

---

24. Force Password Change

Force devuser1 to change their password at the next login:

sudo chage -d 0 devuser1

---

25. Password Expiration

Set password to expire after 90 days:

sudo chage -M 90 devuser1

Check:

sudo chage -l devuser1

---

26. Set Account Expiration

For example:

sudo usermod -e 2026-12-31 devuser1

Check:

sudo chage -l devuser1

This can be useful for temporary contractors or temporary accounts.

---

27. Delete a User

Delete the account:

sudo userdel devuser1

This may leave the user's home directory.

Delete user and home directory:

sudo userdel -r devuser1

Verify:

id devuser1

Expected:

id: ‘devuser1’: no such user

Check:

ls /home

---

28. Find Logged-In Users

who

who

w

w

users

users

Login history

last

---

29. Important User Management Files

Remember these four:

/etc/passwd
/etc/shadow
/etc/group
/etc/gshadow

And for sudo configuration:

/etc/sudoers

Do not casually edit /etc/sudoers with a normal text editor.

If you need to modify it manually, use:

sudo visudo

It performs syntax checking before saving.

---

🔥 Practical Lab 1 — Create Users

Let's start your first real exercise.

Task

Create:

alice
bob
charlie

Commands:

sudo adduser alice
sudo adduser bob
sudo adduser charlie

Verify:

id alice
id bob
id charlie

Check:

ls /home

---

🔥 Practical Lab 2 — Create Departments

Create:

developers
devops
hr

Commands:

sudo groupadd developers
sudo groupadd devops
sudo groupadd hr

Verify:

getent group developers
getent group devops
getent group hr

---

🔥 Practical Lab 3 — Assign Users

Requirement

Alice → developers
Bob → developers + devops
Charlie → hr

Commands:

sudo usermod -aG developers alice

sudo usermod -aG developers,devops bob

sudo usermod -aG hr charlie

Verify:

id alice
id bob
id charlie

---

🔥 Practical Lab 4 — Sudo Administration

Give Alice administrative access:

sudo usermod -aG sudo alice

Switch:

su - alice

Test:

sudo whoami

Expected:

root

Return:

exit

---

🔥 Practical Lab 5 — Lock and Unlock

Lock Bob:

sudo passwd -l bob

Check:

sudo passwd -S bob

Unlock:

sudo passwd -u bob

Check again:

sudo passwd -S bob

---

🔥 Practical Lab 6 — Password Policy

Set Alice's password to expire after 90 days:

sudo chage -M 90 alice

Force Alice to change the password at next login:

sudo chage -d 0 alice

Check:

sudo chage -l alice

---

🔥 Practical Lab 7 — Temporary Employee

Imagine contractor1 is a temporary employee.

Create:

sudo adduser contractor1

Set account expiration:

sudo usermod -e 2026-12-31 contractor1

Set password expiration:

sudo chage -M 30 contractor1

Check:

sudo chage -l contractor1

---

🔥 Practical Lab 8 — Employee Leaves Company

Suppose Bob leaves the company.

First lock the account:

sudo passwd -l bob

Then, when you're certain the account can be removed:

sudo userdel -r bob

Verify:

id bob

---

🚀 Final Real-World Project

Now try this without looking at the commands above.

Scenario

You are a Linux Administrator.

Your company has three departments:

Development
DevOps
HR

Create groups:

developers
devops
hr

Create employees:

rahul
amit
priya

Requirements

Rahul

developers

Amit

developers
devops
sudo

Priya

hr

Additional requirements

1. Create all users.
2. Set passwords.
3. Create all groups.
4. Assign users to appropriate groups.
5. Give Amit sudo access.
6. Set Amit's password expiration to 90 days.
7. Lock Rahul's account temporarily.
8. Unlock Rahul.
9. Check all users.
10. Check all groups.
11. Verify each user's UID/GID.
12. Finally delete the practice accounts.

Useful commands

whoami
id
cat /etc/passwd
cut -d: -f1 /etc/passwd
getent passwd username
getent group groupname
groups username
sudo adduser username
sudo useradd -m username
sudo passwd username
sudo groupadd groupname
sudo usermod -aG groupname username
sudo gpasswd -d username groupname
sudo passwd -l username
sudo passwd -u username
sudo chage -l username
sudo userdel -r username

🧠 Commands You Should Eventually Memorize

For a Linux/DevOps beginner, focus first on these:

whoami       → Current user
id           → User/Group information
adduser      → Create user
passwd       → Manage password
su           → Switch user
useradd      → Create user
usermod      → Modify user
userdel      → Delete user
groupadd     → Create group
groups       → Show user's groups
gpasswd      → Manage group membership
chage        → Password aging

Once you're comfortable with these, the next logical Linux lab is File & Directory Permissions: chmod, chown, chgrp, rwx, numeric permissions (755, 644, 700), and practical scenarios combining users + groups + permissions.