Skip to main content

a. Understanding User and Group Management

1. Understanding Linux User and Group Concepts​

Overview of Users, Groups, and User IDs (UIDs)​

  • Users in Linux are individuals who interact with the system. Each user has a unique User ID (UID), a name, and a home directory.
  • Groups are collections of users. Groups allow for the easy management of users who need similar permissions.
  • Every user and group is assigned a Group ID (GID), used by the system to manage permissions.
  • In Linux, the concept of users and groups is crucial for access control. Each user has a unique ID (UID), and each group has a unique Group ID (GID).

The root user (UID 0) is the administrative user with unrestricted access.
Regular users have unique UIDs, and their access is restricted based on file permissions.

Default System Groups and Users​

  • System Users: These are accounts created by the system for running services or performing specific tasks (e.g., www-data, daemon, sys).
  • System Groups: Groups like root, users, and wheel are created for user and access management purposes.

Example:​

$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
  • Each line represents a user, showing their username, password (encrypted, denoted by x), UID, GID, comment, home directory, and shell.

2. Managing Users​

Creating, Modifying, and Deleting Users:​

1. Creating a User (useradd):​

The useradd command is used to create a new user account.

sudo useradd john

This will create a user named john with a default shell (/bin/bash) and home directory (/home/john).

2. Setting the User Password (passwd):​

Once a user is created, they need a password to log in.

sudo passwd john

After this command, you will be prompted to set a password for the user john.

3. Modifying a User (usermod):​

You can modify user details, such as changing their home directory or shell.

sudo usermod -d /home/johndoe john

This changes the home directory for john to /home/johndoe.

4. Deleting a User (userdel):​

To remove a user from the system:

sudo userdel john

Optionally, you can remove their home directory with the -r flag:

sudo userdel -r john

Locking and Unlocking User Accounts:​

1. Locking a User Account (usermod -L):​

This command disables a user's ability to log in.

sudo usermod -L john

This will lock the account john.

Unlocking a User Account (usermod -U):​

To enable a locked user account:

sudo usermod -U john

3. Managing Groups​

Creating, Modifying, and Deleting Groups:​

Creating a Group (groupadd):​

The groupadd command is used to create a new group.

sudo groupadd developers

This will create a group named developers.

Modifying a Group (groupmod):​

You can modify a group’s name or GID.

sudo groupmod -n newgroup developers

This changes the group name from developers to newgroup.

Deleting a Group (groupdel):​

To remove a group from the system:

sudo groupdel developers

Adding Users to Groups:​

Adding a User to a Group (usermod -aG):​

The usermod -aG command adds a user to an existing group.

sudo usermod -aG developers john

This adds the user john to the developers group.

4. User Permissions and Access Control​

Managing Home Directories, Shells, and Other User Properties:​

  • The home directory is where the user's files and settings are stored, typically /home/username.
  • The shell is the command-line interface, like /bin/bash, used by the user to interact with the system.
  • Other properties, such as login status and environment variables, can be configured in /etc/passwd.

Understanding /etc/passwd and /etc/group Files:​

/etc/passwd contains user account information, such as:​
  • Username
  • Password (encrypted or x for shadowed passwords)
  • UID
  • GID
  • Home directory
  • Login shell
Example:​
$ cat /etc/passwd
john:x:1001:1001::/home/john:/bin/bash
/etc/group contains group information, including:​
  • Group name
  • Group password (if any)
  • GID
  • Group members
Example:​
$ cat /etc/group
developers:x:1001:john,alice

5. Best Practices for User Management​

  • Limit User Permissions: Always assign users to the least privileged group.
  • Use Groups for Better Control: Assign users to groups to manage permissions more efficiently.
  • Periodically Review User Accounts: Regularly audit user accounts and permissions to ensure no unused accounts or excessive privileges exist.
  • Set Strong Passwords: Use password policies to enforce complexity, and avoid reusing passwords.
  • Use sudo for Administrative Tasks: Never log in as root unless necessary, and instead use sudo to perform administrative tasks securely.

Key Takeaways:​

  • Proper user and group management is essential for Linux security.
  • Using useradd, usermod, and userdel, you can manage users' life cycles effectively.
  • Groups play a vital role in simplifying the management of permissions for users.
  • File permissions and ownership are configured by default in the /etc/passwd and /etc/group files, which should be reviewed periodically.
  • Best practices include limiting privileges, using groups, and securing user accounts with strong passwords and the sudo command.
© 2025 Neplearn