Manage Local Users and Groups

🎯 Introduction

User and group management is fundamental to Linux security and system organization. Every process runs as a specific user, and access to files and resources is controlled through user and group permissions.

In this chapter, you'll learn to:

• Create and manage local user accounts
• Configure user properties and home directories
• Manage group memberships
• Set and enforce password policies
• Understand key configuration files (/etc/passwd, /etc/shadow, /etc/group)

👤 Understanding User Accounts

User Account Components

Each user account in Linux consists of:

• Username: Unique identifier for the user
• UID: User ID number (numeric identifier)
• Primary Group: Default group (GID)
• Home Directory: User's personal workspace
• Login Shell: Default command interpreter
• Password: Encrypted authentication credential

User Types

Key Configuration Files

/etc/passwd

Contains basic user account information:

student:x:1000:1000:Student User:/home/student:/bin/bash
│       │ │    │    │            │             │
│       │ │    │    │            │             └─ Login shell
│       │ │    │    │            └─ Home directory
│       │ │    │    └─ GECOS (comment field)
│       │ │    └─ Primary GID
│       │ └─ UID
│       └─ Password (x = stored in /etc/shadow)
└─ Username

/etc/shadow

Stores encrypted passwords and password policies:

student:$6$random$hash:18900:0:99999:7:::
│       │                │     │ │     │
│       │                │     │ │     └─ Password warning period
│       │                │     │ └─ Maximum password age
│       │                │     └─ Minimum password age
│       │                └─ Last password change
│       └─ Encrypted password
└─ Username

/etc/group

Defines groups and membership:

developers:x:2000:alice,bob,charlie
│          │ │    │
│          │ │    └─ Group members
│          │ └─ GID
│          └─ Password field (usually x or empty)
└─ Group name

👥 Manage User Accounts

Creating Users

useradd Command

# Basic user creation
sudo useradd john

# Create with specific UID
sudo useradd -u 1500 jane

# Create with specific home directory
sudo useradd -d /custom/home/path alice

# Create with specific shell
sudo useradd -s /bin/zsh bob

# Create without home directory
sudo useradd -M serviceaccount

# Create with comment
sudo useradd -c "John Doe" john

# Create with specific groups
sudo useradd -G developers,admins charlie

# Complete example
sudo useradd -u 1501 -g users -G developers,docker -c "Alice Developer" -s /bin/bash alice

Modifying Users

usermod Command

# Change username
sudo usermod -l newname oldname

# Change UID
sudo usermod -u 2000 john

# Change home directory
sudo usermod -d /new/home -m john

# Change shell
sudo usermod -s /bin/zsh john

# Add to supplementary groups
sudo usermod -aG docker,wheel john

# Set expiration date
sudo usermod -e 2025-12-31 john

# Lock account
sudo usermod -L john

# Unlock account
sudo usermod -U john

Deleting Users

userdel Command

# Delete user (keep home directory)
sudo userdel john

# Delete user and home directory
sudo userdel -r john

# Force deletion (even if user is logged in)
sudo userdel -f john

Viewing User Information

# View user details
id john

# View current user
whoami

# View logged-in users
who

# View user's groups
groups john

# Last login information
lastlog -u john

👨‍👩‍👧‍👦 Manage Group Accounts

Creating Groups

groupadd Command

# Create basic group
sudo groupadd developers

# Create with specific GID
sudo groupadd -g 5000 admins

# Create system group
sudo groupadd -r sysgroup

Modifying Groups

groupmod Command

# Rename group
sudo groupmod -n newname oldname

# Change GID
sudo groupmod -g 6000 developers

Deleting Groups

groupdel Command

# Delete group
sudo groupdel developers

Managing Group Membership

# Add user to group
sudo gpasswd -a username groupname

# Remove user from group
sudo gpasswd -d username groupname

# Set group administrators
sudo gpasswd -A admin1,admin2 groupname

# Set group members
sudo gpasswd -M user1,user2,user3 groupname

Alternative Methods

# Using usermod (append to groups)
sudo usermod -aG group1,group2 username

# View group members
getent group groupname

# View all groups
getent group

🔐 Password Management

Setting Passwords

passwd Command

# Set password for current user
passwd

# Set password for specific user (as root)
sudo passwd john

# Set password from stdin (scripting)
echo "newpassword" | sudo passwd --stdin john

# Force password change on next login
sudo passwd -e john

# Lock user account
sudo passwd -l john

# Unlock user account
sudo passwd -u john

# Delete password (dangerous!)
sudo passwd -d john

Password Aging

chage Command

# View password aging information
sudo chage -l john

# Set maximum password age (days)
sudo chage -M 90 john

# Set minimum password age
sudo chage -m 7 john

# Set password expiration warning
sudo chage -W 14 john

# Set account expiration date
sudo chage -E 2025-12-31 john

# Force password change
sudo chage -d 0 john

# Set inactive period after password expiration
sudo chage -I 30 john

Example: Complete Password Policy

# Set comprehensive password policy
sudo chage -M 90 -m 7 -W 14 -I 30 john

# Explanation:
# -M 90:  Password expires in 90 days
# -m 7:   Minimum 7 days between password changes
# -W 14:  Warn user 14 days before expiration
# -I 30:  Account locks 30 days after password expiration

Default Password Policies

/etc/login.defs

Configure default password policies for new users:

# Edit /etc/login.defs
PASS_MAX_DAYS   90
PASS_MIN_DAYS   7
PASS_MIN_LEN    8
PASS_WARN_AGE   14

Password Quality Requirements

Configure password complexity using PAM (Pluggable Authentication Modules):

# Edit /etc/security/pwquality.conf
minlen = 12
dcredit = -1    # At least 1 digit
ucredit = -1    # At least 1 uppercase
lcredit = -1    # At least 1 lowercase
ocredit = -1    # At least 1 special character
difok = 3       # At least 3 different characters from old password