User Management Tools

Linux distributions commonly provide account tools from the shadow utilities suite, but defaults and higher-level wrappers vary. Before changing a local account, confirm that it is not centrally managed, review the command's local manual, and maintain a recovery path.

The commands in this lesson change authentication and ownership state. Practice only in an authorized disposable environment, not on a production host.

Reviewing Account-Creation Defaults

useradd creates a local account using command options plus site defaults. Inspect compiled and configured defaults with:

$ useradd -D

Files such as /etc/default/useradd, /etc/login.defs, and skeleton content can influence behavior, but their roles vary by distribution. A higher-level adduser command may exist, but its interface is not standardized across all Linux systems.

Creating a Local Account Explicitly

In a controlled environment, specify important properties rather than relying on unknown defaults:

$ sudo useradd -m -s /bin/bash -c "Bob Example" bob

• -m requests creation of the home directory.
• -s /bin/bash chooses the login shell after confirming that path is permitted and installed.
• -c supplies the GECOS/comment field.

The new account usually cannot authenticate with a usable local password until one is set, but exact initial password and lock state depend on local tooling and policy. Verify the records instead of assuming:

$ getent passwd bob
$ sudo passwd -S bob
$ id bob

Setting or Changing a Password

A regular user changes their own local password interactively with:

$ passwd

An authorized administrator can set another local account's password with:

$ sudo passwd bob

Enter passwords only at the protected prompt, not in command arguments, shell history, lesson notes, or chat. PAM policy can reject weak or reused passwords. Directory-managed accounts can require a different tool.

Modifying Account Properties and Groups

usermod changes local account fields. Examples include:

$ sudo usermod -s /bin/zsh bob
$ sudo usermod -d /srv/home/bob -m bob
$ sudo usermod -aG developers bob

For the home move, verify the destination, ownership, available space, running processes, mounts, and services first. For supplementary groups, -aG means append to the current list. Using -G without -a replaces the entire supplementary group list and can remove access unexpectedly.

Group changes normally affect new login sessions rather than processes already running under the old credential set.

Locking a Local Password

An administrator can lock the local password hash with passwd -l USER and inspect status with passwd -S USER. Unlocking is performed with passwd -u USER only after reviewing why the lock exists and whether a valid hash remains.

A password lock does not necessarily stop SSH keys, tokens, scheduled jobs, already running processes, or service-specific authentication. To disable an account comprehensively, define the threat and access paths, then apply a coordinated policy that can include account expiration, login shell, service access, keys, and session termination.

Removing a Local Account Deliberately

Plain userdel bob removes the local account records but normally leaves the home directory. userdel -r bob also attempts to remove the home directory and mail spool, making it a destructive operation.

Before any removal:

1. Confirm the exact account with getent passwd bob and id bob.
2. Identify running processes, scheduled tasks, services, keys, and delegated access.
3. Inventory files owned by the UID across the intended filesystems.
4. Decide whether data must be transferred, archived, retained, or securely deleted.
5. Confirm that the UID will not be reassigned while orphaned files remain.

userdel -r does not guarantee removal of files outside the configured home and mail locations. Account deletion can also leave numeric ownership on files, database permissions, application identities, and remote directory records.

To practice the account lifecycle in an isolated environment, try these hands-on labs:

1. Manage Linux User Accounts with useradd, usermod, and userdel - Practice the complete lifecycle of user administration, from creating and securing new accounts to modifying and deleting them.
2. Manage Linux Groups with groupadd, usermod, and groupdel - Gain hands-on experience with core command-line utilities for group administration, including adding, modifying, and deleting groups.
3. Configure User Accounts and Sudo Privileges in Linux - Learn essential techniques for managing user accounts and sudo privileges to enhance the security of a Linux system.

Summary

You can now manage local accounts with explicit scope and verification.

1. Review useradd defaults before creation.
2. Request home, shell, and metadata settings explicitly.
3. Change passwords only through protected prompts.
4. Append supplementary groups without replacing the existing list.
5. Inventory identity dependencies before destructive removal.