3.2.1. Users, Groups, and Account Lifecycle

💡 First Principle: User accounts fall into three categories with different UID ranges: root (UID 0), system accounts (UIDs 1–999, for daemons and services), and regular user accounts (UIDs 1000+). This range separation lets administrators quickly identify account types and apply appropriate policies.

Creating Accounts:

# useradd (low-level, minimal defaults)
useradd alice                              # Create user, no home dir by default on some systems
useradd -m alice                           # Create user WITH home directory
useradd -m -s /bin/bash -G wheel alice     # Home dir, bash shell, add to wheel group
useradd -r -s /sbin/nologin -d /var/myapp myapp  # System account (no login; -d only sets the path — add -m to create it)

# adduser (high-level, interactive — Debian/Ubuntu)
adduser alice                              # Interactive: prompts for name, password

# groupadd
groupadd developers                        # Create group
groupadd -g 2000 ops                       # Create group with specific GID

Modifying Accounts:

usermod -aG wheel alice                    # Add alice to wheel group (-a = append, -G = groups)
usermod -aG docker,developers alice        # Add to multiple groups
usermod -s /bin/zsh alice                  # Change login shell
usermod -l newname alice                   # Rename user (login name only)
usermod -d /newhome -m alice               # Move home directory
usermod -L alice                           # Lock PASSWORD (prepends ! to the hash) — SSH key logins can still work; to block every login also expire it (usermod -e 1)
usermod -U alice                           # Unlock account
usermod -e 2025-12-31 alice                # Account expiry date (same /etc/shadow field as chage -E)

chsh -s /bin/bash alice                    # Change shell (user can run this themselves)
passwd alice                               # Set/change password (root) or own (user)
passwd -l alice                            # Lock account via passwd
passwd -u alice                            # Unlock account via passwd

Account Expiration and Aging:

chage -l alice                             # List password aging info
chage -M 90 alice                          # Max password age: 90 days
chage -m 7 alice                           # Min days between password changes
chage -W 14 alice                          # Warn 14 days before expiry
chage -E 2025-12-31 alice                  # Account expires on date
chage -I 14 alice                          # Inactive days allowed after the password expires before the account is disabled
chage -d 0 alice                           # Force password change on next login

Deleting Accounts:

userdel alice                              # Remove account only (files remain)
userdel -r alice                           # Remove account AND home directory + mail
deluser alice                              # Debian/Ubuntu equivalent
groupdel developers                        # Delete group (must not be primary group of any user)

Querying Accounts:

id alice                                   # UID, primary GID, all supplementary groups — resolved via NSS, so LDAP/SSSD groups appear too (full getent group listings are often disabled for LDAP/SSSD)
id                                         # Your own IDs
who                                        # Currently logged-in users (terminal info)
w                                          # Who is logged in + what they're doing
last                                       # Login history from /var/log/wtmp
lastlog                                    # Last login for all users
whoami                                     # Current effective username
groups alice                               # Group memberships for alice
getent passwd alice                        # Look up account in NSS (passwd database)
getent group developers                    # Look up group

⚠️ Exam Trap: usermod -G wheel alice replaces alice's supplementary groups with just wheel — removing her from all other groups. Always use usermod -aG wheel alice (the -a flag means append). Forgetting -a is a classic way to accidentally break a user's access to everything else.

Reflection Question: You need to give alice access to the docker group without disrupting her existing group memberships. She currently belongs to wheel and developers. Write the single correct command.