Introduction
Local user and group administration is one of the first identity tasks a Linux administrator learns. RHCSA-style work expects you to inspect account records, create users and groups, adjust group membership, modify account metadata, and remove temporary accounts safely.
In this lab, you will create temporary local identities only: rhcsauser, rhcsaops, and rhcsaaudit. You will not modify the labex account, SSH configuration, passwords, or login access. The final step removes the temporary user and one temporary group so the system is left clean.
Inspect Existing Local Identity Records
In this step, you will inspect existing local identity records before creating new ones. getent queries the configured name service databases, so it works for local files and other identity sources. id shows the numeric identity and group membership for a user.
Move into the standard LabEx project directory.
cd /home/labex/project
Inspect the existing labex account record.
getent passwd labex
The output is colon-separated. The first field is the login name, and later fields include the numeric UID, primary GID, home directory, and login shell.
Inspect the current group membership for labex.
id labex
Inspect the current primary group record for labex.
getent group labex
These commands are read-only. They give you a baseline before you create temporary practice identities.
Create a Local Group and User
In this step, you will create a local group and a local user. Creating the group first lets you assign it as the user's primary group during account creation.
Create the primary group for the practice user.
sudo groupadd rhcsaops
Create rhcsauser with a home directory, Bash as the login shell, and rhcsaops as the primary group. In useradd, -m creates a home directory, -g sets the primary group, and -s sets the login shell.
sudo useradd -m -g rhcsaops -s /bin/bash rhcsauser
Inspect the new account record.
getent passwd rhcsauser
Inspect the new user's identity and group membership.
id rhcsauser
List the home directory that useradd -m created.
sudo ls -ld /home/rhcsauser
Add a Supplementary Group
In this step, you will add a supplementary group. A user has one primary group, but can also belong to additional groups for shared access.
Create a second group named rhcsaaudit.
sudo groupadd rhcsaaudit
Add rhcsauser to the supplementary rhcsaaudit group. The -aG options mean append to the supplementary group list. Use -a with -G so you do not replace existing supplementary groups by accident.
sudo usermod -aG rhcsaaudit rhcsauser
Inspect the user's groups.
id rhcsauser
Inspect the audit group record. The group line should list rhcsauser as a member.
getent group rhcsaaudit
Modify Account Metadata
In this step, you will modify account metadata without changing password state. Password aging and account locking are covered later, so this step focuses on the comment field and login shell.
Set a descriptive comment for the practice user. The -c option updates the GECOS/comment field.
sudo usermod -c "RHCSA Practice User" rhcsauser
Change the login shell to /bin/sh. The -s option updates the shell field in the account record.
sudo usermod -s /bin/sh rhcsauser
Inspect the updated account record.
getent passwd rhcsauser
Use chage -l only to inspect password aging details. Do not change password aging in this lab; that is the next guided lab.
sudo chage -l rhcsauser
Remove Temporary Local Identities
In this step, you will remove the temporary user and one temporary group. Cleanup is part of identity administration because unused accounts and groups should not remain on a system.
Remove the practice user and its home directory. The -r option removes the user's home directory and mail spool when supported.
sudo userdel -r rhcsauser
Remove the supplementary audit group.
sudo groupdel rhcsaaudit
Confirm that the user is gone. getent exits nonzero when the record does not exist, so && echo prints only when the lookup fails as expected.
getent passwd rhcsauser >/dev/null || echo "rhcsauser removed"
Confirm that the audit group is gone.
getent group rhcsaaudit >/dev/null || echo "rhcsaaudit removed"
Leave rhcsaops in place for inspection. It is now an empty local group.
getent group rhcsaops
Summary
You practiced local user and group administration for RHCSA preparation. You inspected existing identity records, created a primary group and local user, added a supplementary group, modified account metadata, inspected password aging information without changing it, and removed temporary identities safely.
