Linux User and Group Management: Commands and Best Practices

Every person and service on a Linux system runs under a user account, and groups control shared access. Good Linux user and group management keeps systems secure and makes access easy to audit. This guide explains user types, the files involved and the commands you need, with best practices.

Types of users

Administrators should use regular accounts and gain privileges with sudo, rather than logging in as root.

Key files

Never edit /etc/shadow by hand. Use the commands below, or vipw and vigr when manual edits are unavoidable.

Managing users

Create a user

sudo useradd -m -s /bin/bash -c "Asha Patel" asha
sudo passwd asha

-m creates the home directory, -s sets the shell and -c adds a comment. On Debian and Ubuntu, the interactive adduser command is also available.

Modify a user

sudo usermod -aG developers asha    # add to a supplementary group
sudo usermod -s /usr/sbin/nologin svcapp   # block interactive login

Always use -aG together. Without -a, usermod -G replaces all of the user’s supplementary groups.

Lock and unlock accounts

sudo usermod -L asha     # lock
sudo usermod -U asha     # unlock
sudo chage -E 0 asha     # expire the account immediately

Locking blocks password logins, but SSH keys may still work. To block all access, expire the account or remove its keys as well.

Password ageing

sudo chage -l asha
sudo chage -M 365 -W 14 asha

Delete a user

sudo userdel -r asha

The -r option removes the home directory and mail spool. Before deleting, back up anything the business still needs, and check for files the user owns elsewhere with find / -user asha.

Managing groups

sudo groupadd developers
sudo gpasswd -a asha developers   # add a member
sudo gpasswd -d asha developers   # remove a member
sudo groupdel developers
id asha                            # show a user's groups

Each user has one primary group, used for new files, and can belong to many supplementary groups.

Granting admin rights with sudo

Add trusted users to the admin group: sudo on Debian and Ubuntu, or wheel on RHEL-family systems. For limited rights, create a file in /etc/sudoers.d/ with visudo -f, allowing only specific commands.

Best practices

• Give every person a named account; avoid shared logins.
• Use SSH keys and disable password logins over SSH where possible.
• Grant sudo only to those who need it, and prefer limited rules.
• Remove or lock accounts promptly when people leave.
• Review accounts and group memberships regularly.
• For many servers, use central identity, such as FreeIPA, LDAP or Active Directory.

Related guides

• Linux file permissions
• How to audit Unix and Linux systems

Sources

• The Linux man-pages project

Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.