User Management · Lesson 6

User Management Tools

Learn how to create, modify, secure, verify, and remove local accounts with explicit options.

Linux distributions commonly provide account tools from the shadow utilities suite, but defaults and higher-level wrappers vary. Before changing a local account, confirm that it is not centrally managed, review the command's local manual, and maintain a recovery path.

The commands in this lesson change authentication and ownership state. Practice only in an authorized disposable environment, not on a production host.

Reviewing Account-Creation Defaults

useradd creates a local account using command options plus site defaults. Inspect compiled and configured defaults with:

$ useradd -D

Files such as /etc/default/useradd, /etc/login.defs, and skeleton content can influence behavior, but their roles vary by distribution. A higher-level adduser command may exist, but its interface is not standardized across all Linux systems.

Creating a Local Account Explicitly

In a controlled environment, specify important properties rather than relying on unknown defaults:

$ sudo useradd -m -s /bin/bash -c "Bob Example" bob

-m requests creation of the home directory.
-s /bin/bash chooses the login shell after confirming that path is permitted and installed.
-c supplies the GECOS/comment field.

The new account usually cannot authenticate with a usable local password until one is set, but exact initial password and lock state depend on local tooling and policy. Verify the records instead of assuming:

$ getent passwd bob
$ sudo passwd -S bob
$ id bob

Which useradd option explicitly requests creation of the new account's home directory?

Setting or Changing a Password

A regular user changes their own local password interactively with:

$ passwd

An authorized administrator can set another local account's password with:

$ sudo passwd bob

Enter passwords only at the protected prompt, not in command arguments, shell history, lesson notes, or chat. PAM policy can reject weak or reused passwords. Directory-managed accounts can require a different tool.

Which command normally lets the current user change their own password through an interactive prompt?

Modifying Account Properties and Groups

usermod changes local account fields. Examples include:

$ sudo usermod -s /bin/zsh bob
$ sudo usermod -d /srv/home/bob -m bob
$ sudo usermod -aG developers bob

For the home move, verify the destination, ownership, available space, running processes, mounts, and services first. For supplementary groups, -aG means append to the current list. Using -G without -a replaces the entire supplementary group list and can remove access unexpectedly.

Group changes normally affect new login sessions rather than processes already running under the old credential set.

Which command adds bob to supplementary group developers without replacing his other supplementary memberships?

Locking a Local Password

An administrator can lock the local password hash with passwd -l USER and inspect status with passwd -S USER. Unlocking is performed with passwd -u USER only after reviewing why the lock exists and whether a valid hash remains.

A password lock does not necessarily stop SSH keys, tokens, scheduled jobs, already running processes, or service-specific authentication. To disable an account comprehensively, define the threat and access paths, then apply a coordinated policy that can include account expiration, login shell, service access, keys, and session termination.

What does passwd -l bob primarily lock?

Removing a Local Account Deliberately

Plain userdel bob removes the local account records but normally leaves the home directory. userdel -r bob also attempts to remove the home directory and mail spool, making it a destructive operation.

Before any removal:

Confirm the exact account with getent passwd bob and id bob.
Identify running processes, scheduled tasks, services, keys, and delegated access.
Inventory files owned by the UID across the intended filesystems.
Decide whether data must be transferred, archived, retained, or securely deleted.
Confirm that the UID will not be reassigned while orphaned files remain.

userdel -r does not guarantee removal of files outside the configured home and mail locations. Account deletion can also leave numeric ownership on files, database permissions, application identities, and remote directory records.

What extra removal does common userdel -r bob request compared with plain userdel bob?

To practice the account lifecycle in an isolated environment, try these hands-on labs:

Manage Linux User Accounts with useradd, usermod, and userdel - Practice the complete lifecycle of user administration, from creating and securing new accounts to modifying and deleting them.
Manage Linux Groups with groupadd, usermod, and groupdel - Gain hands-on experience with core command-line utilities for group administration, including adding, modifying, and deleting groups.
Configure User Accounts and Sudo Privileges in Linux - Learn essential techniques for managing user accounts and sudo privileges to enhance the security of a Linux system.

Lesson complete

You finished User Management Tools

You can now manage local accounts with explicit scope and verification.

Review useradd defaults before creation.
Request home, shell, and metadata settings explicitly.
Change passwords only through protected prompts.
Append supplementary groups without replacing the existing list.
Inventory identity dependencies before destructive removal.

Keep your learning progress

Create a free account to save this lesson and continue learning on any device.

Create a free account

Back to User Management