Hello! Welcome back to your course on preparing for the CompTIA Linux+ exam.
In the previous module, we honed your skills in text processing, culminating in a lesson on awk for parsing and formatting structured data. We were focused on manipulating the contents of files. Now, we're shifting gears to a fundamental topic in system administration: managing the people and processes that own and access those files.
This lesson marks the beginning of Module 4, "User, Group, and Permission Management." Your learning outcome for today is to be able to create, modify, and delete user accounts using command-line tools. This is a core skill for any Linux administrator and a critical topic for your exam.
Following your preference for building a strong theoretical foundation, we will start by understanding the different types of user accounts in Linux and the key files that store user information. Then, we will dive into the practical commands for managing the entire lifecycle of a user account.
1. The Anatomy of a Linux User Account
In Linux, everything is built around the concept of users. Users own files, run processes, and are granted specific privileges. Before we start creating them, it's important to understand the different categories of user accounts.
To get a clear overview, please read the following resource, which breaks down the three main user types and introduces the concept of privilege escalation.
Study notes for CompTIA Linux+ Certificate
These study notes from "CompTIA_Linux_Plus_Notes" on GitHub provide a concise introduction to the three types of Linux user accounts.
Read the section titled "Users and Groups," focusing on the descriptions of the root, standard, and service accounts. Also, note the explanation of the sudo command, which we will be using throughout this lesson.
As you've just read, standard user accounts have limited privileges. To perform administrative tasks like creating a new user, you must elevate your privileges. This is almost always done using the sudo (superuser do) command, which temporarily grants you root-level permissions for a single command.
The image below perfectly illustrates this. An attempt to create a user as a standard user fails, but it succeeds once the user switches to an account with sudo privileges.
Behind the scenes, Linux stores user information in a few key text files. Understanding these files provides a deeper insight into how user management works.
This article from Cycle.io, "Linux User Management," clearly explains the roles of the most important user management files.
Read the subsection "Key Files for User Management." Focus on understanding the purpose of /etc/passwd and /etc/shadow.
2. Creating a New User: useradd and passwd
Now for the practical part. The primary command for creating a new user account is useradd. When you run this command, it creates a new entry in the /etc/passwd and /etc/shadow files, among other things.
The basic syntax is sudo useradd <username>. However, an important point to remember is that useradd does not set a password. It creates the account in a locked state. To make the account usable, you must immediately set a password for the new user using the passwd command.
Let's see the process in action.
The "Linux User Management" article provides a straightforward guide to creating a user.
Read the section "Creating a New User." Pay close attention to the two-step process: using useradd first, followed by passwd.
The useradd command also accepts several options to define the user's properties upon creation. Here are a few common ones:
-c "Full Name": Adds a comment, typically the user's full name.-m: Creates a home directory for the user at/home/<username>. On many modern systems, this is the default behavior, but it's good practice to be explicit.-s /bin/bash: Sets the user's default login shell.
Example: To create a user named bfranklin with the full name "Benjamin Franklin" and create their home directory, you would use:sudo useradd -m -c "Benjamin Franklin" bfranklin
And to set their password:sudo passwd bfranklin
Test your understanding!
You need to create a new user account for a data scientist named "Ada Lovelace." Her username should be alovelace. What two commands would you run, in order, to create her account and allow her to log in?
Show answer
First, you would create the user account, including her full name as a comment:sudo useradd -c "Ada Lovelace" alovelace
Second, you would set the initial password for her account:sudo passwd alovelace
3. Modifying an Existing User: usermod
Once a user account exists, you can change its properties with the usermod (user modify) command. The options are often similar to those for useradd. For example, you can change a user's comment, their home directory, or their default shell.
The syntax is sudo usermod [options] <username>.
Let's look at some examples of how to modify a user.
The "Linux User Management" article also covers the usermod command with clear examples.
Read the section "Modifying User Accounts." Note how options like -l (for login name) or -s (for shell) are used.
Example: Suppose the user bfranklin has decided to switch from the bash shell to the zsh shell. You would run:sudo usermod -s /bin/zsh bfranklin
Another very common use of usermod is to add a user to a group, but we will cover that in detail in our next lesson, which focuses entirely on group management.
4. Deleting a User: userdel
When a user no longer needs access to the system, you use the userdel (user delete) command to remove their account.
This command has a very important nuance. By default, sudo userdel <username> only removes the user from the account files (/etc/passwd, etc.). It does not remove the user's home directory or their files.
To perform a complete cleanup, you must use the -r (remove) flag.
Let's see why this is so important.
Let's review the final command in the user lifecycle.
Read the section "Deleting a User Account." Focus on the difference between running userdel with and without the -r option.
The image below provides a perfect visual demonstration of what happens when you forget the -r flag. The user is deleted, but their home directory remains.
For security and system hygiene, it is almost always best practice to use sudo userdel -r <username> to ensure all of the user's data is removed along with their account.
Test your understanding!
An employee with the username jdoe has left your organization. Your task is to remove their system access and free up disk space. Which of the following commands is the most appropriate for this task, and why?
sudo usermod --lock jdoesudo userdel jdoesudo userdel -r jdoe
Show answer
The most appropriate command is 3. sudo userdel -r jdoe.
Here's why:
- Command 1 only locks the account, preventing login, but leaves all the user's files on the system.
- Command 2 deletes the account but leaves the user's home directory and files, consuming disk space and potentially posing a security risk.
- Command 3 deletes the account and removes the user's home directory and its contents, ensuring a complete and clean removal.
Conclusion
Congratulations! You have just learned the fundamental commands for managing the entire lifecycle of a user account in Linux—a cornerstone skill for any system administrator.
Key Takeaways:
- User management is a privileged task requiring the
sudocommand. - The three essential commands are
useradd,usermod, anduserdel. - Creating a user is a two-step process:
useraddto create the account, andpasswdto set the password and enable it. - When deleting a user, the
-rflag withuserdelis crucial for removing the user's home directory and ensuring a clean system. - These commands work by modifying backend configuration files like
/etc/passwdand/etc/shadow.
Now that you can manage individual user accounts, you might wonder how to manage permissions for dozens or hundreds of users efficiently. Doing it one by one would be impossible! The solution is groups. In our next lesson, we will explore how to create, modify, and delete groups, and how to assign users to them to simplify permission management.