Linux: User and Group Management — The Multi-User System
Linux is designed as a multi-user operating system from the ground up. Whether a development team shares a server or different applications need isolated runtime permissions, user and group management is a core skill.
📋 Prerequisites: You should first complete
- Lesson 8: File Permissions
1. What You Will Learn
- Difference between useradd and adduser
- passwd for password management
- groupadd and usermod for group management
- sudo privilege configuration
- Viewing logged-in user information
2. A Story About Team Members Sharing a Server
(1) The Pain: A New Colleague Needs an Account
Alex's team got a new colleague Bob who needed an account on the development server. On Windows, you'd have to open "Computer Management" → "Users and Groups" → right-click to create (plus deal with activation and password policies).
(2) Linux's One-Line Solution
BASH
sudo useradd -m -s /bin/bash bob
sudo passwd bob
# Enter bob's password
sudo usermod -aG developers,sudo bob
Three commands, 30 seconds, done.
(3) The Benefit: Foundation for Multi-Person Collaboration
After creating the user, Bob can log in with ssh bob@server, has his own home directory, can access the shared developers group directory, and can use sudo to install software.
3. Knowledge Points
(1) User-Related Files
BASH
/etc/passwd # User account information
/etc/shadow # Encrypted passwords (root-readable only)
/etc/group # Group information
Each line in /etc/passwd has 7 colon-separated fields:
TEXT
alice:x:1001:1001:Alice Wang:/home/alice:/bin/bash
└───┘ └ └───┘ └───┘ └───────┘ └─────────┘ └─────────
│ │ │ │ │ │ └── Login Shell
│ │ │ │ │ └────────────── Home directory
│ │ │ │ └────────────────────────── Full name/description
│ │ │ └────────────────────────────────── Group ID (GID)
│ │ └──────────────────────────────────────── User ID (UID)
│ └──────────────────────────────────────────── Password placeholder (actual encrypted password in shadow)
└──────────────────────────────────────────────── Username
(2) Creating and Managing Users
BASH
# Create a user (with home directory and specified Shell)
sudo useradd -m -s /bin/bash alice
# Set password
sudo passwd alice
> ⚠️ Note: Newly created users with default or weak passwords are highly vulnerable to brute-force attacks. In production, always force users to change their password on first login (`chage -d 0 alice`) and configure password complexity policies.
# Delete a user
sudo userdel bob # Keep home directory
sudo userdel -r bob # Delete user and home directory
# Modify user information
sudo usermod -l newname alice # Change username
> ℹ️ Note: Ubuntu also has the `adduser` command, which is an interactive wrapper around `useradd` — it automatically creates a home directory, prompts for password, and copies `/etc/skel` templates. `useradd` is more flexible but requires manual parameters; `adduser` is friendlier but less customizable. Use `useradd` in production scripts; `adduser` is fine for manual operations.
sudo usermod -d /home/newhome alice # Change home directory
sudo usermod -L alice # Lock user (disable login)
sudo usermod -U alice # Unlock user
(3) Creating and Managing Groups
BASH
# Create a group
sudo groupadd developers
sudo groupadd devops
# Delete a group
sudo groupdel oldteam
# Add a user to a group
sudo usermod -aG developers alice # -aG = append to Group
sudo gpasswd -a bob developers # Alternative method
# Remove a user from a group
sudo gpasswd -d bob developers
# View a user's groups
groups alice
# Output: alice : alice sudo developers
(4) sudo Privilege Escalation
sudo allows regular users to execute commands as root (or a specified user).
BASH
# Edit sudoers configuration (never edit /etc/sudoers directly)
sudo visudo
> ⚠️ Note: Never edit `/etc/sudoers` directly with `vim` or `nano`! If there's a syntax error, `sudo` will break completely and you won't be able to elevate privileges to fix it. `visudo` automatically performs syntax checking before saving — it's the only safe way to edit.
Common configurations:
BASH
# Allow all members of the sudo group to use sudo
%sudo ALL=(ALL:ALL) ALL
# Allow a specific user to run sudo without a password
alice ALL=(ALL) NOPASSWD: ALL
# Restrict to specific commands only
bob ALL=(ALL) /usr/bin/apt, /usr/bin/systemctl
(5) ▶ Example: Create a User and Configure Their Environment
BASH
# Create user alice
sudo useradd -m -s /bin/bash alice
# Set password
sudo passwd alice
# Add alice to the sudo group (so she can elevate privileges)
sudo usermod -aG sudo alice
# Verify
id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),27(sudo)
# Switch to alice and test
sudo -u alice whoami
# alice
Output:
TEXTuid=1001(alice) gid=1001(alice) groups=1001(alice),27(sudo) alice
(6) ▶ Example: Create a Team Shared Group
BASH
# Create a development group
sudo groupadd developers
# Add team members to the developers group
sudo usermod -aG developers alice
sudo usermod -aG developers bob
sudo usermod -aG developers charlie
# View group members
grep developers /etc/group
# developers:x:1005:alice,bob,charlie
Output:
TEXTdevelopers:x:1005:alice,bob,charlie
(7) ▶ Example: Configure sudo Without Password
BASH
# Edit with visudo (safe method)
sudo visudo
# Add at the end of the file (after the %sudo line):
alice ALL=(ALL) NOPASSWD: ALL
# Or create a standalone file
echo "alice ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/alice
sudo chmod 440 /etc/sudoers.d/alice
# Verify
sudo -l -U alice
Output:
TEXTUser alice may run the following commands on server: (ALL) NOPASSWD: ALL
(8) ▶ Example: View Online Users
TEXT
# Currently logged-in users
who
# alice pts/0 2026-07-07 09:15 (192.168.1.100)
# bob pts/1 2026-07-07 10:23 (192.168.1.101)
# More detailed information
w
# 10:30:45 up 2 days, 1 user, load average: 0.08, 0.03, 0.01
# USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
# alice pts/0 192.168.1.100 09:15 0.00s 0.23s 0.02s w
# View recent login records
last | head -10
# Count currently logged-in users
who | wc -l
Output:
TEXTalice pts/0 2026-07-07 09:15 (192.168.1.100) bob pts/1 2026-07-07 10:23 (192.168.1.101) 10:30:45 up 2 days, 1 user, load average: 0.08, 0.03, 0.01 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT alice pts/0 192.168.1.100 09:15 0.00s 0.23s 0.02s w alice pts/0 192.168.1.100 Mon Jul 7 09:15 still logged in bob pts/1 192.168.1.101 Mon Jul 7 10:23 still logged in 2
(9) ▶ Example: Lock and Unlock Users
BASH
# Lock a user (locked accounts cannot log in)
sudo usermod -L bob
# Verify lock status
sudo grep bob /etc/shadow
# bob:!$6$... ← The ! before the password field indicates locked
# Try to log in (should be denied)
ssh bob@localhost
# Permission denied
# Unlock the user
sudo usermod -U bob
Output:
TEXTbob:!$6$xyz...:19600:0:99999:7::: Permission denied, please try again. bob:$6$abc...:19600:0:99999:7:::
(10) ▶ Comprehensive Example: Complete Server Account Setup for a New Developer
BASH
#!/bin/bash
# add-dev-user.sh - Create an account for a new developer
# Check arguments
if [ $# -ne 1 ]; then
echo "Usage: sudo ./add-dev-user.sh <username>"
exit 1
fi
USERNAME=$1
echo "Creating user $USERNAME..."
# 1. Create user
sudo useradd -m -s /bin/bash "$USERNAME"
# 2. Set password (interactive)
sudo passwd "$USERNAME"
# 3. Add to developers and sudo groups
sudo usermod -aG developers,sudo "$USERNAME"
# 4. Create SSH directory
sudo mkdir -p /home/$USERNAME/.ssh
sudo chmod 700 /home/$USERNAME/.ssh
# 5. Copy template configuration
sudo cp /etc/skel/.bashrc /home/$USERNAME/
sudo cp /etc/skel/.profile /home/$USERNAME/
# 6. Set correct permissions
sudo chown -R $USERNAME:$USERNAME /home/$USERNAME/
echo "User $USERNAME created!"
echo "Please run manually: sudo passwd $USERNAME to set password"
❓ FAQ
Q: What's the difference between root and a regular user? A: \1
Q: Why use sudo instead of logging in as root directly? A: Security + auditing: commands executed with
sudoare logged (/var/log/auth.log), so you can trace who executed what and when. Direct root login doesn't distinguish between operators.
Q: What does
userdel -rdelete? A: The user's home directory and mail spool. Without-r, the home directory is preserved — useful when you need to keep data (e.g., during handoffs).
Q: Why can't regular users read
/etc/shadow? A: Because it stores encrypted password hashes. Although hashes can't be directly reversed, attackers can use rainbow tables for brute-force attacks. That's why the shadow file has permissions of600, readable only by root.
Q: Will multiple users SSHing at the same time cause conflicts? A: No. Each SSH connection is an independent session with its own Shell process. However, writing to the same file simultaneously may cause conflicts (use file locks to resolve this).
📖 Summary
useradd -m -s /bin/bashcreates a new user;passwdsets the passwordgroupaddcreates groups;usermod -aGadds users to groupssudo visudosafely edits sudo configuration;%groupsets group-level permissions/etc/passwdfor user info,/etc/shadowfor passwords,/etc/groupfor group infowho/w/lastto view logged-in users
📝 Exercises
- Basic (Difficulty ⭐): Create a new user
student1, set a password, create a home directory, then usewhoandwto view current logged-in user information - Intermediate (Difficulty ⭐⭐): Add
student1to thesudogroup and verify sudo works, then create a shared groupteamand add two users to it - Advanced (Difficulty ⭐⭐⭐): Use
sudo -l -U student1to check that user's sudo privileges, then create a configuration file under/etc/sudoers.d/to restrictstudent1to only runsudo aptandsudo systemctl
