Managing Users on Linux: A Practical Guide

Linux user management controls who can sign in, which files they can access, and which administrative actions they can perform. A few standard commands cover most day-to-day account management tasks.

1. Create a User

The low-level useradd command creates a new account. A practical invocation is:

sudo useradd -m -s /bin/bash -c "John Doe" john

The options mean:

• -m creates the user’s home directory.
• -s /bin/bash selects Bash as the login shell.
• -c "John Doe" stores a descriptive comment, commonly the user’s full name.

On Debian and Ubuntu, the higher-level adduser command is also commonly used because it interactively creates the account, home directory, and password.

2. Set or Change the Password

sudo passwd john

The command prompts for the new password without displaying it on screen.

3. Add a User to a Group

Groups are the preferred way to grant shared permissions. For example, on Debian and Ubuntu, administrative access is usually granted through the sudo group:

sudo usermod -aG sudo john

The -a option is important: it appends the group instead of replacing the user’s existing supplementary groups.

On distributions that use the wheel group for administrative access, such as many Fedora or RHEL installations, use:

sudo usermod -aG wheel john

4. Inspect User Information

id john

This shows the user’s UID, primary GID, and group memberships. You can also inspect account records with:

getent passwd john

Using getent is preferable to reading /etc/passwd directly when the system may use LDAP, SSSD, or another directory service.

5. Lock and Unlock an Account

To disable password authentication for an account:

sudo passwd -l john

To unlock it again:

sudo passwd -u john

Note that locking a password does not necessarily terminate existing sessions or disable every possible authentication method, such as SSH public keys. For a full access revocation, review active sessions, SSH keys, and the account’s login shell as well.

6. Delete a User

Remove the account while leaving its home directory in place:

sudo userdel john

Remove the account together with its home directory and mail spool:

sudo userdel -r john

Before using -r, confirm that the home directory does not contain data that must be archived.

7. Practical Security Guidelines

• Grant privileges through groups rather than changing permissions individually for every user.
• Follow least privilege: give each account only the access it needs.
• Review inactive accounts and privileged group membership periodically.
• Prefer SSH keys or other strong authentication methods for server access where appropriate.
• Remove access promptly when an account is no longer required.

Conclusion

Commands such as useradd, passwd, usermod, id, and userdel provide the foundation for Linux account administration. Combining them with group-based permissions and regular access reviews keeps systems easier to manage and reduces unnecessary privilege.