How to Manage Users and Groups in Linux

Managing users and groups is a fundamental skill for any Linux system administrator. Whether you’re running a personal server, managing enterprise infrastructure, or developing on a local machine, understanding how to properly control user access and permissions is crucial for maintaining system security and organization.

In this comprehensive guide, you’ll learn the essential commands and best practices for managing users and groups in Linux, from basic account creation to advanced permission management.

Table of Contents

• Understanding Users and Groups in Linux
• Creating and Managing User Accounts
• Managing Groups
• Modifying User Accounts
• Understanding File Permissions and Ownership
• Security Best Practices
• Common Issues and Troubleshooting

Understanding Users and Groups in Linux

Linux is a multi-user operating system where each user has a unique identity and specific permissions. Users are organized into groups, which simplify permission management by allowing administrators to assign rights to multiple users simultaneously.

Key Concepts

Every user account in Linux has several important attributes:

• Username: The unique identifier for the user
• User ID (UID): A numeric identifier assigned to each user
• Group ID (GID): The primary group associated with the user
• Home Directory: The user’s personal workspace, typically /home/username
• Shell: The command-line interface assigned to the user

User information is stored in the /etc/passwd file, while password hashes are kept in /etc/shadow. Group information resides in /etc/group.

Creating and Managing User Accounts

Adding New Users

The useradd command is the primary tool for creating new user accounts. Here’s the basic syntax:

sudo useradd -m -s /bin/bash john

This command creates a new user named “john” with a home directory (-m) and sets bash as the default shell (-s). However, this user cannot log in yet because no password has been set.

To set a password for the new user:

sudo passwd john

For a more comprehensive user creation with additional options:

sudo useradd -m -d /home/john -s /bin/bash -c "John Smith" -G sudo,developers john

This command creates a user with a custom home directory (-d), a comment field (-c) for the full name, and adds the user to supplementary groups (-G).

The adduser Command

On Debian-based distributions like Ubuntu, the adduser command provides a more user-friendly, interactive approach:

sudo adduser john

This interactive script prompts you for all necessary information, including password and user details. If you’re learning Linux system administration, platforms like DataCamp offer hands-on courses that help you master these essential commands through practical exercises.

Deleting Users

To remove a user account:

sudo userdel john

To delete the user and their home directory:

sudo userdel -r john

Managing Groups

Creating Groups

Groups allow you to manage permissions for multiple users efficiently. To create a new group:

sudo groupadd developers

To create a group with a specific GID:

sudo groupadd -g 1500 developers

Adding Users to Groups

To add an existing user to a group:

sudo usermod -aG developers john

The -a flag appends the group to the user’s existing groups, while -G specifies the group name. Without -a, you would replace all supplementary groups.

To add multiple users to a group:

sudo gpasswd -M john,jane,bob developers

Viewing Group Membership

To see which groups a user belongs to:

groups john

Or use the id command for more detailed information:

id john

Deleting Groups

To remove a group:

sudo groupdel developers

Modifying User Accounts

The usermod command is your primary tool for modifying existing user accounts.

Common Modifications

Change a user’s home directory:

sudo usermod -d /new/home/path -m john

Change the default shell:

sudo usermod -s /bin/zsh john

Lock a user account (disable login):

sudo usermod -L john

Unlock a user account:

sudo usermod -U john

Change username:

sudo usermod -l newname oldname

Understanding File Permissions and Ownership

User and group management is closely tied to file permissions. Every file and directory in Linux has an owner (user) and a group.

Viewing Permissions

Use the ls -l command to view file permissions and ownership:

ls -l /home/john/document.txt

Changing Ownership

To change the owner of a file:

sudo chown john document.txt

To change both owner and group:

sudo chown john:developers document.txt

To recursively change ownership of a directory:

sudo chown -R john:developers /var/www/project

Changing Group Ownership

To change only the group:

sudo chgrp developers document.txt

Security Best Practices

Proper user and group management is essential for system security. Here are critical best practices to follow:

Principle of Least Privilege

Grant users only the minimum permissions necessary to perform their tasks. Avoid adding users to the sudo group unless they genuinely need administrative access.

Use Strong Password Policies

Implement password aging and complexity requirements by editing /etc/login.defs and using tools like chage:

sudo chage -M 90 -m 7 -W 14 john

This sets a maximum password age of 90 days, minimum of 7 days between changes, and a 14-day warning before expiration.

Regular Audits

Periodically review user accounts and group memberships. Remove or disable accounts for users who no longer need access.

List all users:

cat /etc/passwd | cut -d: -f1

Find users with sudo privileges:

getent group sudo

Secure Testing Environments

When practicing user management or deploying applications, consider using cloud instances from providers like Kamatera, which offer flexible Linux environments where you can safely experiment without risking production systems.

Common Issues and Troubleshooting

User Cannot Login

If a user cannot log in, check these common issues:

• Verify the account isn’t locked: sudo passwd -S username
• Check if the password is set properly
• Verify the shell is valid: cat /etc/passwd | grep username
• Ensure the home directory exists and has correct permissions

Permission Denied Errors

When users encounter permission errors:

• Verify file ownership with ls -l
• Check group membership with groups username
• Ensure the user has been added to necessary groups
• Remember that group changes require logout/login to take effect

Viewing Recent User Activity

To monitor user logins:

last -a

To see currently logged-in users:

who

Conclusion

Mastering user and group management in Linux is essential for maintaining secure, well-organized systems. From creating user accounts with useradd and adduser to managing groups and permissions, these fundamental skills form the foundation of Linux system administration.

Remember to follow security best practices, regularly audit your user accounts, and always apply the principle of least privilege. As you gain experience, these commands will become second nature, allowing you to efficiently manage users across any Linux distribution.

Whether you’re managing a single server or an entire infrastructure, the knowledge you’ve gained here will serve you well in your Linux administration journey.