User and Group Management: Configuring Access

Adding a new person to your team doesn't just mean giving them an email address; it means giving them a secure environment to work in. In the Linux terminal, this involves creating a user account, setting a home directory, assigning a default shell, and adding them to the correct permission groups.

As an administrator, you need to know how to do this manually using the "Low-level" commands (useradd) and the "High-level" interactive scripts (adduser).

In this lesson, we will learn how to create, modify, and delete the inhabitants of our system.

---

1. Creating a User: useradd vs. adduser

useradd (The Low-Level Command)

This is a standard utility that works on every Linux system. It is very precise but requires many flags to set up correctly.

# Create a user with a home directory and Bash shell
sudo useradd -m -s /bin/bash sudeep

adduser (The Friendly Script)

On Debian and Ubuntu, adduser is an interactive script that asks for the password, full name, and even phone number. It is much easier for manual additions.

sudo adduser sudeep

---

2. Modifying a User: usermod

Once a user exists, you often need to change their settings. The usermod (User Modify) command is the tool for this.

Changing the Shell:

sudo usermod -s /usr/bin/zsh sudeep

Locking and Unlocking Accounts:

If a contractor leaves the company, don't delete their files immediately. Lock their account instead!

sudo usermod -L sudeep # Lock
sudo usermod -U sudeep # Unlock

The Most Common Task: Adding to a Group

Use the -aG (Append Group) flags. Warning: If you forget the -a, you will remove the user from all their other groups!

# Add 'sudeep' to the 'docker' group
sudo usermod -aG docker sudeep

---

3. Deleting a User: userdel

Deleting a user requires a choice: do you keep their files or destroy them?

# Delete the user, but keep their /home/folder for legal/backup reasons
sudo userdel sudeep

# Extreme Clean: Delete the user AND their home folder AND their email spool
sudo userdel -r sudeep

---

4. Group Management: groupadd and groupdel

Managing groups is the easiest way to give permissions at scale.

# Create a new group for a specific project
sudo groupadd ai-engineers

# Delete a group (users are NOT deleted, just removed from the group)
sudo groupdel ai-engineers

---

5. Practical: The "New Employee" Workflow

Here is the professional sequence for setting up a new developer:

1. Create the user: sudo useradd -m -s /bin/bash dev_user
2. Set the password: sudo passwd dev_user
3. Assign to team group: sudo usermod -aG developers dev_user
4. Force password change on first login: sudo chage -d 0 dev_user

---

6. Example: Automated Onboarding Script (Python)

If you are a DevOps engineer, you'll want to automate this process. Here is a Python script that takes a CSV of employees and creates their Linux accounts automatically.

import subprocess
import os

def onboard_user(username, team_group):
    """
    Creates a Linux user and adds them to a team group.
    """
    print(f"Onboarding {username}...")
    
    # 1. Ensure the group exists
    subprocess.run(["sudo", "groupadd", "-f", team_group])
    
    # 2. Create the user
    # -m: Create home dir
    # -s: Use bash
    create_cmd = ["sudo", "useradd", "-m", "-s", "/bin/bash", username]
    
    result = subprocess.run(create_cmd, capture_output=True, text=True)
    if result.returncode == 0:
        print(f"  [OK] User created.")
        
        # 3. Add to group
        subprocess.run(["sudo", "usermod", "-aG", team_group, username])
        print(f"  [OK] Assigned to {team_group}.")
        
        # 4. Set temporary password (should be unique in production!)
        passwd_input = f"{username}:ChangeMe2026"
        subprocess.run(["sudo", "chpasswd"], input=passwd_input, text=True)
        print("  [OK] Temporary password set.")
    else:
        print(f"  [!] Error: {result.stderr.strip()}")

if __name__ == "__main__":
    new_hires = [
        ("sudeep", "ai-team"),
        ("alice", "devops"),
        ("bob", "devops")
    ]
    
    for user, group in new_hires:
        onboard_user(user, group)

---

7. Professional Tip: Use 'nologin' for System Accounts

If you are creating a user for a database or a file-transfer service, that user should never be allowed to log into a shell. Set their shell to /usr/sbin/nologin.

sudo useradd -s /usr/sbin/nologin sftp_user

---

8. Summary

User management is about control and automation.

• useradd is for automation; adduser is for manual use.
• usermod -aG is your most important command for group assignment.
• userdel -r performs a deep clean.
• Use nologin for any service account that doesn't need a terminal.

In the next lesson, we will look "under the hood" at the specific files where these users live: /etc/passwd and /etc/shadow.

Quiz Questions

1. Why is the -a flag so important when using usermod -G?
2. What happens if you delete a user but keep their home directory? Who owns those files now?
3. How do you force a user to change their password the very next time they log in?

---

Continue to Lesson 3: Understanding /etc/passwd and /etc/shadow—The Identity Database.