Introduction
Linux is mostly known for its stability,
flexibility and strong security model. A key aspect of system administration is
user management which allows administrators to control access to system
resources and maintain a secure environment.
Manage Users
in Linux
User management is essential for controlling
access and maintaining the security of a Linux system. A user is an entity such
as a person, process or service that interacts with the system and performs
specific tasks. Each user is assigned a unique User ID (UID), which determines
their permissions, file ownership and access rights.
A Linux system can have different user accounts
for different purposes. Among them the root user holds superuser privileges
with full control over the system.
Before learning how to manage the users and groups in Linux, it is important to understand the fundamentals of the Linux operating system. you are new to the Linux, read our beginner guide on What is Linux? An Introduction to Linux and Its Popular Distributions.
Types
of Users
Linux supports different types of users including system users, regular users and the root user, each serving a specific role in system operation and security.
The User and group management is typically performed through the command line in the Linux. you are new to the Linux terminal, check our tutorial on 10 Linux Basic Commands Every Beginner Should Know.
Root
User (Superuser)
The root user identified by a UID of 0, has
complete administrative control over the system. This account can install or
remove software, manage users, modify system configurations and access all
files and resources.
System
Users (Service Accounts)
System users are accounts created automatically
during system installation or when software packages are installed. They are
used to run services and applications in the background with limited
privileges.
These accounts are not allowed for direct login
and typically have limited or no shell access. Examples include service
accounts such as mysql, www-data, mail and bin.
By isolating services under separate user
accounts, Linux enhances security—if a service is compromised the impact is
limited to that specific account rather than the entire system.
IDs of System users are typically assigned from
reserved range which is already defined by the system configuration (e.g.,
/etc/login.defs).
Regular
Users
Non-administrative accounts are regular accounts
that are used in everyday activities. They have limited permissions compared to
the root user and can perform activities such as creating files, running
scripts and accessing their own directories.
These users are not allowed to install software
or edit system files without elevated privileges. In most Linux systems,
regular user IDs (UIDs) are typically assigned from a higher range, often starting
above system user IDs which is above 1000.
Regular users are normally used to perform daily
operations to minimize security risks associated with administrative
privileges.
User
Configuration Files
Linux
stores user and group information in several important configuration files:
· /etc/passwd – Stores basic user account information such as
username, UID, GID, home directory and default shell
· /etc/shadow – Stores encrypted password and security information of account accessible
only by the root user
· /etc/group – Contains group information, including group
names, group IDs (GIDs), and group members
·
/etc/login.defs – Defines
default settings of user accounts such as UID ranges and password policies
Understanding these files is essential for
managing user accounts, permissions and system security in Linux.
Understanding the Linux file system structure helps the administrators control the file permissions and ownership. You can learn more in our guide on Linux Directory Structure and File System – Beginners to Pro Guide.
How
to create a New User in Linux
The useradd command is used to create a new user
account in Linux. When a user is created the system assigns default properties
such as a user ID (UID), group ID (GID), home directory and login shell.
#useradd
–u 1001 -d /home/seeklinux -s /bin/bash seeklinux
A user named seeklinux is created with a
specified UID (-u 1001), home directory (-d /home/seeklinux) and default shell
(-s /bin/bash). To verify the newly created user account, run the following
command:
#id
seeklinux
This command shows the user ID (UID), group ID (GID) and group memberships for the seeklinux account.
System administrators often manage the users while monitoring the running services and processes on the system. Learn more about the process monitoring in our guide on Linux Process Management for Beginners – Complete Guide 2025.
User
Account Properties
Every user account in Linux has specific
attributes that define its identity and access privileges. The key properties
are explained below
1. Username
Every user account in Linux is assigned a unique
username, which is used to identify the user on the system. For example account
is created with username of seeklinux.
2. UID
Every
user account is assigned a unique User ID (UID) and this UID is a numerical value as the UID
of seeklinux is 1001. UID is automatically assigned by the system to a user at
the time of creation, or you can assign by yourself when you create a user.
3. GID
GID
is group ID, the primary group ID of the user seeklinux is 1001.
4. Home Directory
Every
user has an associated home directory where personal files, documents and
settings reside. The home directory of seeklinux is /home/seeklinux.
5. Default Shell
The
default shell determines which interpreter the user will use after logging in.
This is the associated interactive environment of the user as SeekLinux’s
default shell is /bin/bash.
6. Password
Every
user should be secured by a strong password. A password is required to
authenticate and to interact with the system. The password should be according
to the password security policy.
7. Group
Group membership determines the resources a user
can access and the permissions they have within the system.
The /etc/passwd file stores user account
details. You can view this information using the following command:
#grep
seeklinux /etc/passwd
/etc/passwd contains the following
fields.
Seeklinux
– seeklinux is the user account created using the
useradd command.
X
– This field represents the encrypted password of
the user account.
UID
– The value 1001 represents the User ID (UID)
which is a unique identifier assigned to every user account. It is typically
assigned automatically by the system but it can also be specified manually during
user creation.
GID
– 1001 GID group ID for user account representing primary group membership of
user.
/home/seeklinux
– home directory of the user account.
/bin/bash
– the default shell for the user account
This is detailed information that is
stored in /etc/passwd about the users.
How
to set a user's Password
When setting a user password, always follow
strong password policies to ensure security. Avoid using easily guessable
passwords especially in production environments.
To set or change a user’s password, use the
following command:
#sudo
passwd seeklinux
How
to Delete a User Account
To delete a user account, the command is
#usdo
userdel seeklinux
This will delete the user's home directory and
all associated files.
How
to Lock and Unlock a User Account
There are several methods to lock or disable
user accounts in Linux. Normal approaches include using the passwd and usermod
commands or modifying the /etc/shadow file.
Lock
user Using Passwd
You can lock a user account using the passwd
command as shown below:
#sudo
passwd –l seeklinux
Disable
a User Account Using usermod
The usermod command is used to modify user
accounts in Linux. You can disable a user account by using the -L or --lock
option.
#sudo
usermod -L seeklinux
How
to Set a User Shell to nologin
You can prevent a user from logging in by
setting their default shell to /sbin/nologin. This restricts interactive access
but it allows the account for service or administrative purposes.
To change the user’s shell, use the following
command:
#sudo
usermod –s /sbin/nologin seeklinux
When the user attempts to log in they will
receive a message indicating that access is not permitted.
Modify
the Shadow File (/etc/shadow)
A user account can also be disabled by modifying
the /etc/shadow file. Open file with a text editor and locate the user account
you want to disable.
Add a! Or * at the beginning of the password
field to lock the account and prevent login access.
#sudo
vi /etc/shadow
When the user does log in attempt to the system
then it returns an authentication failure error and prevents access to the
account.
How
to unlock the User Account
To unlock a user account, use the -U option with
the usermod command.
#sudo
usermod –U seeklinux
By
using passwd to unlock the user
#sudo
passwd –u seeklinux
How
to Check the User Status
You can check the status of a user account
(locked or unlocked) using the following command:
#sudo
passwd –S seeklinux
If the output shows PS the user account is unlocked.
If it shows LK the account is locked.
Linux Group
Management
Group management is an essential part of Linux
system administration, allowing administrators to control access to files and
resources based on user roles and permissions. Groups enable multiple users to
share access to common resources efficiently.
Group types
Primary
Group
At the time of account creation the primary
group is assigned to a user. It defines the default group ownership of files
created by the user. Every user has at least one primary group.
In some Linux distributions the primary group
often shares the same name as the user but this behavior may vary depending on
system configuration.
Secondary
Group
Secondary groups allow users to have additional
access to shared resources beyond their primary group. A user can belong to
multiple secondary groups at the same time.
/etc/group:
This is the main file for groups to
store information about all groups and their associated members with group IDs
(GIDs).
How
to Create a New Group
To create a new group, for example
developer, the command is
#sudo
groupadd developer
This group grants access and permissions
to all development-related resources.
To view the group detail that is created
with the name developer, go /etc/group file.
#cat
/etc/group
This command returns all group details,
and the newly created group will be at the bottom. You can sort the command to
see only the information of a specific group. Command is
#cat
/etc/group | grep developer
How
to Add a User to a Group
Users can be assigned to a group after it
has been created. To assign the user to the group developer command is
#sudo
usermod -aG developer seeklinux
As Seeklinux is a member of the developer group
and he has access to the resources of this group.
How
to Delete a Group
To delete the group command is
#sudo
groupdel developer
Security Best Practices
- Use sudo instead of logging in as root directly
- Create dedicated service accounts for applications
- Lock unused accounts instead of deleting them immediately
- Enforce strong password policies using /etc/login.defs
- Monitor logins with last
Proper user account management plays a key role in securing the Linux servers. learn how to secure the remote access, follow our guide on How to Secure SSH Access on Linux.
Frequently Asked Questions (FAQs)
Q1: How do I create a user in Linux with a home directory?
Ans: Run sudo useradd -m
username && sudo passwd username.
Q2: How do I add a user to multiple groups at once?
Ans: Use sudo usermod -aG
group1,group2 username.
Q3: How do I lock a user account without deleting it?
Ans: Run sudo usermod -L
username.
Q4: What is the difference between primary and secondary
groups?
Ans: Primary group is assigned
at login; secondary groups provide additional permissions.
Conclusion
That’s all about users and group management. Managing users and groups in Linux is one of. the most important skills for every system administrator and beginner alike. By mastering the commands such as useradd, groupadd, usermode, and passwd, you gain control over how users access the system. Proper Linux user management not only helps organize your system but also plays a critical role in maintaining security and stability. Keep visiting seeklinux for more updates and information.
SeekLinux Team
Linux Engineers | DevOps | Security Enthusiasts
Linux Engineers | DevOps | Security Enthusiasts
SeekLinux Team shares practical Linux tutorials, SSL/TLS certificate guides, commands and DevOps solutions. Our goal is to simplify system administration and help you master real-world server and security tasks.
Post a Comment