Command-Line User and Group Management

1. The Architecture of User Management

Before we start typing commands, it's essential to understand what those commands are actually manipulating. In Linux, user and group information is stored in a few key plain text files. While you should never edit these files directly, understanding their structure is key to troubleshooting and grasping the concepts.

To get a clear overview of these files and the different types of users, let's watch the beginning of the following video.

To summarize and visualize what you just saw:

• /etc/passwd: A public list of all user accounts. It defines the username, user ID (UID), primary group ID (GID), home directory, and default shell. It does not contain the password.

• /etc/group: A public list of all groups. It defines the group name, group ID (GID), and which users are supplementary members.
• /etc/shadow: A highly restricted file that only the root user can read. It contains the encrypted (hashed) user passwords and password aging policies (e.g., when it expires).

For a more detailed written breakdown of these files, you can refer to the following resource. It's not required reading, but it's an excellent reference if you want to understand every single field.

Now that you know the theory, let's get practical.

2. Managing User Accounts

These are the core commands for day-to-day user administration. All of these commands require elevated privileges, so you will need to prefix them with sudo.

• useradd: Creates a new user.
• passwd: Sets or changes a user's password.
• usermod: Modifies an existing user's attributes.
• userdel: Deletes a user.

Let's see these commands in action.

A crucial point mentioned in the video is creating the user's home directory. Some Linux distributions do this by default, but many do not. As a best practice, you should always be explicit.

• sudo useradd -m username: The -m flag tells useradd to make the user's home directory (/home/username).
• sudo userdel -r username: The -r flag tells userdel to remove the user's home directory when deleting the account.

In a corporate environment, be cautious with userdel -r. Company policy may require you to archive a former employee's data rather than deleting it outright.

3. Managing Groups and Memberships

Users are rarely managed in isolation. We use groups to grant permissions to a collection of users at once, which is far more efficient.

• Primary Group: Every user has exactly one primary group. When a user creates a new file, that file is typically owned by the user's primary group.
• Secondary (or Supplementary) Groups: A user can be a member of many secondary groups. This is how you grant a user access to different projects or resources. For example, a user might have their own primary group (bob) but also be in the developers, testers, and vpn-users secondary groups.

The main commands are:

• groupadd: Creates a new group.
• groupdel: Deletes a group.
• usermod: Also used to add users to groups.

Let's see a quick demonstration.

4. Your Turn: Practical Scenario

Time to apply your "katana." Let's walk through a common administrative task in your Ubuntu VM.

Scenario: A new hire, Chandra, is joining the engineering team. Another employee, David, is moving to the QA team.

Follow these steps in your terminal.

1. Create Groups: The engineering and qa groups don't exist yet. Create them.

   sudo groupadd engineering
   sudo groupadd qa
   

2. Create New User: Create the user account for chandra. Make sure to create her home directory and set her default shell to /bin/bash.

   
   
   
   # The -m flag creates the home directory
   # The -s flag sets the shell
   sudo useradd -m -s /bin/bash chandra
   

3. Set Initial Password: Set a temporary password for chandra. The system will prompt you to enter the new password twice.

   sudo passwd chandra
   

4. Add to Group: Add chandra to the engineering group as a secondary member.

   
   
   
   # Remember: -a for append, -G for secondary groups
   sudo usermod -aG engineering chandra
   

5. Verify New User: Use the id command to check that everything is configured correctly for chandra.

   id chandra
   

   The output should show her UID, her primary group (which will be chandra by default), and that she is also in the engineering group.

6. Modify Existing User: Now, let's handle David. Assume he already has a user account. You just need to add him to the qa group.

   
   
   
   # First, let's create the 'david' user so the command works.
   sudo useradd -m david
   
   
   
   # Now, add him to the qa group.
   sudo usermod -aG qa david
   

7. Check Your Work: Verify David's new group membership.

   id david
   

This exercise, which is adapted from the "Linux Exercise 1 - User and Group Management" resource, mirrors exactly the kind of tasks you would perform as a system administrator.

Conclusion

Excellent work. You have now mastered the fundamental command-line tools for managing who has access to your Linux system. This is a non-negotiable skill for any administration role.

Key Takeaways:

• User and group data is stored in /etc/passwd, /etc/group, and /etc/shadow, but you should always use commands like useradd instead of editing them directly.
• User Commands:
  • useradd -m <user>: Creates a user and their home directory.
  • passwd <user>: Sets a user's password.
  • userdel -r <user>: Deletes a user and their home directory.
• Group Commands:
  • groupadd <group>: Creates a new group.
  • usermod -aG <group> <user>: Adds a user to a secondary group. Never forget the -a (append)!
• Verification:
  • id <user> and groups <user> are your best friends for confirming that your changes were successful.

In our next lesson, we will build directly on this knowledge. Now that you can create users and groups, you need to control what they can access. We will explore how to modify file permissions and ownership using chmod and chown to secure system resources.