Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

Users and groups

5 min Ubuntu 24.04

Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one.

Cheat sheet

7 commands Printable version
  • id alice uid/gid/groups
  • sudo useradd -m -s /bin/bash bob create
  • sudo usermod -aG sudo bob add to a group (with -a, or it replaces all)
  • sudo passwd bob set a password
  • sudo passwd -l bob lock password login
  • sudo chage -M 90 bob maximum password age — 90 days
  • getent group sudo who's in the group

Overview

An account is a line in /etc/passwd, the password (hash) is in /etc/shadow, groups are in /etc/group. A user has one primary group and a list of supplementary ones.

The last field of an /etc/passwd line is the login shell: the program the system starts when the user logs in. For people it's usually /bin/bash; for services it's /usr/sbin/nologin, and nobody can log in as them. usermod -s changes it (see usermod).

bash 
id alice                          # uid, gid, groups
whoami                            # the current user
getent passwd alice               # the passwd entry (accounts for LDAP/SSSD)
groups alice                      # the user's groups

Recipes

2

Management

bash 
sudo useradd -m -s /bin/bash alice    # create (with a home directory -m and shell)
sudo passwd alice                      # set a password
sudo usermod -aG sudo alice            # ADD to a group (the -a matters, or it replaces!)
sudo usermod -aG docker,www-data alice
sudo usermod -s /usr/sbin/nologin svc  # forbid interactive login (a service account)
sudo gpasswd -d alice docker           # remove from a group
sudo userdel -r alice                  # delete along with the home directory
sudo groupadd devs                     # create a group
sudo groupdel devs                     # delete a group
adduser bob                            # the interactive wrapper (Debian/Ubuntu)

A common mistake. usermod -G grp without -a replaces all of a user's supplementary groups — use usermod -aG, not -G. The template for a new home directory is /etc/skel.

Passwords, locking, su

bash 
sudo passwd -l alice              # lock the password (password login forbidden)
sudo passwd -u alice              # unlock it
sudo usermod -L / -U alice        # the same (lock/unlock)
sudo chage -l alice               # the password aging policy
sudo chage -M 90 -W 7 alice       # max age 90 days, warn 7 days ahead
sudo chage -E 2026-12-31 alice    # the account's expiration date
sudo passwd -e alice              # require a password change at next login

su - bob                          # become bob (a login shell, its own environment)
su -                              # become root (if you know root's password)
sudo -u postgres -i               # better: through sudo, no root password needed (see sudo)

System users (daemons) usually have uid < 1000, nologin, no password (useradd -r).

Troubleshooting

5

Added to a group — it has no effect

Group membership applies on the next login. Log back in (or use newgrp <group> for the current shell). Check with id.

Accidentally replaced the groups (-G without -a)

Restore the needed ones: usermod -aG sudo,docker alice. You can verify against /etc/group (getent group).

Can't delete a user — "currently used by process"

End its processes (pkill -u alice, see processes) or use userdel -f.

Login denied, even though the password is correct

The account/password is locked (passwd -l/chage -E in the past) or the shell is nologin. Check chage -l, getent passwd (the last field is the shell).

Files show the "wrong" group

An SGID directory only assigns its group to NEW files; recursively chgrp -R the old ones (see permissions, chmod-chown).

Danger zone

userdel -r deletes the home directory and mail spool irreversibly — without a backup, the data cannot be recovered. Before deleting, check whether any processes or cron jobs still belong to the user (pkill -u, crontab -l -u): userdel without -f refuses to delete an account with active processes, while -f deletes it anyway, even if processes keep running under the now-nonexistent UID. After deletion, the freed UID can be reassigned to a new user — files left on disk with that UID become "theirs".

Terms

7
UID
A numeric user identifier; names are mapped to identifiers through name services. Also appears in: Docker, useradd, nologin, usermod and 15 more
GID
A numeric group identifier used in process credentials and file metadata. Also appears in: Docker, Capabilities: root split into parts, ls, NFS network filesystem and 2 more
effective UID
The process user identity used in ordinary checks of its privileges.
primary group
The group designated as primary for an account; a process has its own effective group identity. Also appears in: usermod, Special permission bits: setuid, setgid, sticky, chmod / chown, useradd
supplementary group
Additional membership considered for access; an existing process retains its own group list. Also appears in: umask, usermod
NSS
The mechanism for selecting sources that resolve users, groups, hosts, and other records. Also appears in: DNS and name resolution, Boot targets: default, multi-user, rescue and emergency, chage
login shell
The program in the last field of /etc/passwd that the system starts when a user logs in: usually /bin/bash, /usr/sbin/nologin for services. usermod -s changes it. Also appears in: Environment variables and PATH, bash, nologin, chage

See also

  • usermod — groups, shell, locking; the -G without -a trap.
  • useradd — create a user: options and Ubuntu defaults.
  • passwd — set, change or lock a password.
  • permissions — The Unix permission model — read/write/execute, owner/group/others, special bits.
  • sudo — Running commands as root or another user; sudoers and NOPASSWD.
  • whoami — The current effective account.

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Tools on this topic

Topics
Loading…