Master Linux User & Group Management: Commands, Files, and Best Practices

User Types

Superuser (root)

The highest‑privilege account (uid 0) that has unrestricted access to the system.

Regular user

Limited‑privilege accounts typically with uid ranging from 1000 to 60000.

Program (system) user

Accounts used by services and programs, usually with uid 1‑999.

Each user must have one primary group; supplementary groups are optional and can be multiple.

User Account Files

/etc/passwd

Stores basic account information such as username, encrypted password placeholder, uid, gid, comment, home directory, and default login shell.

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
... (other entries) ...
asdjkl:x:1000:1000::/home/asdjkl:/bin/bash

Field order: username, password placeholder, uid, gid, comment, home directory, login shell.

/etc/shadow

Contains encrypted passwords and password‑aging information.

root:$6$1ErSmgzZVaTclNcr$TMSjtWrgcZXeE1lo2.SQyrRK4M.GKe/...:...:0:99999:7:::
bin:*:17110:0:99999:7:::
... (other entries) ...

Fields: username, encrypted password, last change (days since epoch), minimum days, maximum days, warning period, inactive period, expiration date, reserved.

Adding Users

useradd command

Creates a new user and sets its attributes.

useradd -u 1234 -s /sbin/nologin -M aa   # uid 1234, no login shell, no home directory

Common options:

-u UID: specify user ID (must be unused).

-d DIR: set home directory (ignored with -M).

-e DATE: set account expiration date (YYYY‑MM‑DD).

-g GROUP: set primary group (name or GID).

-G GROUPS: set supplementary groups (comma‑separated).

-M: do not create a home directory.

-s SHELL: set login shell.

# useradd -u 1234 a
# cat /etc/passwd | grep a
a:x:1234:1234:/home/a:/bin/bash

# useradd -d /etc/data aa
# cat /etc/passwd | grep aa
aa:x:1001:1001:/etc/data:/bin/bash

# useradd -g asdjkl kk
# cat /etc/passwd | grep kk
kk:x:1236:1000:/home/kk:/bin/bash

Password Management

passwd command

Set or modify a user’s password.

# passwd asdjkl
Changing password for asdjkl.
New password: ********
Retype new password: ********
passwd: all authentication tokens updated successfully.

Options:

-d: delete the password (login without a password).

-l: lock the account.

-u: unlock the account.

-S: display account status.

# passwd -d qq
Password for qq removed.
passwd: success

# passwd -l qq
Locking password for qq.
passwd: success

# passwd -S qq
qq LK 2024-04-08 0 99999 7 -1 (Password locked.)

# passwd -u qq
Unlocking password for qq.
passwd: success

# passwd -S qq
qq PS 2024-04-08 0 99999 7 -1 (Password set, SHA512 algorithm.)

Modifying and Deleting Users

usermod command

Modify existing user attributes.

-l NEWNAME: change login name.

-L: lock account.

-U: unlock account.

-u UID: change UID.

-d DIR: change home directory.

-e DATE: set expiration date.

-g GROUP: change primary group.

-G GROUPS: change supplementary groups.

-s SHELL: change login shell.

userdel command

Delete a user account; use -r to also remove the home directory and mail spool.

# userdel qq
# id qq
id: qq: no such user
# userdel -r qq
# id qq
id: qq: no such user

Source: https://www.cnblogs.com/zhj0708/p/18121337 (© original author).