User and Group Management

Users and groups often need to be created and modified. This section revolves around those tasks. All users and groups have a numerical value. The numerical value for a user is uid. The numerical value for a group is gid. The system can auto generate these when you create users and groups, or you can specify these when creating them.

id

The id is a useful command. It gives you information about a user including the uid, gid, and any groups that user is associated with. If you run just the id command with no arguments it will give you information about your user. If you specify a user when running id it will give you information about that user.

id examples

id
id root

groups

The groups command gives you a list of groups the user is a member of. If you run the groups command without any arguments, it will give you your groups. If you give an argument of another user it will give you the groups of that user.

groups examples

groups
groups root

User Management

User management is a key point to managing a linux system. The next sections will go over how to add, delete, and modify users.

useradd

useradd is the command used to adding a user to a system. I recommend reading through the man page as there are many switches to this command. useradd is called with useradd [options] new_username.

useradd examples

useradd newuser1
useradd -e 2027-06-01 newuser2 #creates a user that expires on the date
useradd -m -c "John Doe" -s /bin/bash newuser3
useradd -s sysuser1

usermod

Often a user needs to be updated. This is done with the usermod command. Again there are many switches to this command, so please check the man page.

usermod examples

usermod -c "Jane Doe" newuser1
usermod -a -G wheel newuser  # this command adds user to the wheel group without removing from other groups
usermod -G wheel newuser  # this command puts the user in wheel group but removes all other supplemental groups

userdel

userdel examples

userdel newuser1
userdel -f newuser1
userdel -r newuser1

Group Management

Groups will also need to be managed on a system. This section is about adding, modifying, and deleting groups.

groupadd

There are a few switches to this command so checkout the man page. Most of the time this command will be used without any switches. The command is pretty simple: groupadd group_name.

groupadd examples

groupadd newgroup
groupadd -g 9999 newgroup1 # add a group with the group id of 9999
groupadd -U "newuser1,newuser2" newgroup1 # creates a gorup and adds users to it

groupmod

This command allows you to modify a group. It has quite a few switches so check the man page.

groupmod examples

groupmod -a -U "newuser1" newgroup #adds a user to the group.
groupmod -n newgroupname newgroup
groupmod -g 1234 newgroup #changes the gid of the group

groupdel

groupdel allows you to delete groups from the system. groupdel has a few switches so check the man page, but most of the time you won't use those.

groupdel examples

groupdel newgroup

passwd

This utility manages password for accounts. Please check the man page for available switches. If it is called without any arguments it will change the password for the current account. -d or --delete deletes a password for an account. -e or --expire will expire the password making user change on next login. -l or --lock with lock the password so users cannot login with it. -S or --status shows the password status for an account -u or --unlock unlocks the password for an account. There are a few other switches so read the man page.

passwd examples

passwd
passwd -d newuser
passwd -e newuser
passwd -l newuser
passwd -u newuser
passwd -s newuser

chage

chage command is useful to show information about an account and password. It can show when an account or password expires. It can show when a password was last changed. The minimum amount of days on a password, or the max amount of days on a password. Check the man page for switches.

chage examples

chage -l newuser
chage -m 3 newuser
chage -M 120 newuser
chage -E 2027-01-01 newuser
chage -W 10 newuser

sudo

sudo is how to make a normal user execute something another users privileges. This is most commonly used to run things with root privileges. There is quite a bit of configuration to sudo. That will be gone over in another chapter. This section is more about the use. Please check the man page for switches. The most common ways to use it though will be sudo command, sudo -u different_user command, sudo -i, or sudo -u different_user -i.

sudo examples

sudo ls  # runs the ls command as root
sudo -u newuser ls  # runs the ls command as newuser
sudo -i # this enters you into an interactive root prompt.  When done enter exit to get out of it.
sudo -u newuser -i # this enters you into an interactive newuser prompt.  When done enter exit to get out of it.

which sudo user

When in an interactive sudo prompt you can forget which user you are. You can run the id command without any parameters to figure this out

Storage for user and groups

The information for user accounts is stored in multiple places. User account information is stored in /etc/passwd. Password hashes for users are stored in /etc/shadow. Group information is stored /etc/group. If you have privileges you can look at any of these files. One way to do that is with the cat command or getent command. cat displays the entire file. getent displays a single entry. See examples below

view user examples

cat /etc/passwd
cat /etc/group
sudo cat /etc/shadow
getent passwd newuser
getent group wheel
sudo getent shadow newuser

Exercise

Note

On AWX https://tower.tuckhome.lan use the User Management - Setup, User Management - Grade, User Management - Cleanup.

Tasks

• create testuser1
• create testuser2 with a uid of 9999
• delete deluser
• make inactiveuser password locked
• add testgroup1
• add testgroup2 with gid 9998
• add expireuser to testgroup1 without removing any other groups
• delete group delgroup
• set expireuser to expire on 2027-12-01
• set password to testuser1 to P@ssw0rd!123

Solution

• create testuser1

  sudo useradd testuser1
  

• create testuser2 with a uid of 9999

  sudo useradd -u 9999 testuser2
  

• delete deluser

  sudo userdel deluser
  

• make inactiveuser password locked

  sudo passwd -l inactiveuser
  

• add testgroup1

  sudo groupadd testgroup1
  

• add testgroup2 with gid 9998

  sudo groupadd -g 9998 tetgroup2
  

• add expireuser to testgroup1 without removing any other groups
  • Option 1 usermod

    sudo usermod -a -G testgroup1 expireuser
    

  • Option 2 groupmod

    sudo groupmod -a -U expireuser testgroup1
    

• delete group delgroup

  sudo groupdel delgroup
  

• set expireuser to expire on 2027-12-01

  sudo usermod -e 2027-12-01
  

• set password to testuser1 to P@ssw0rd!123

  sudo passwd testuser1
  #enter new password and confirm when prompted