Linux Users and Groups: useradd, usermod, userdel, passwd, groups and id Explained

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: a housing society

Why do we need this?

In Kothrud, the Shanti housing society gives each resident a member card with a number. The secretary keeps the member register. Passwords for the society office locker are kept in a separate sealed book that only the secretary can open. Residents are grouped: committee, gym members, parking holders. A new tenant gets a card, is added to the gym group, and when they leave the card is cancelled.

What is it?

Member card number = UID. Member register = /etc/passwd. Sealed password book = /etc/shadow. Committee, gym, parking = groups in /etc/group. Giving a card = useradd. Adding to gym = usermod -aG gym. Cancelling the card = userdel. Secretary = root.

How to do it (step by step)

2. whoami: which user am I?

Why do we need this?

Before you run a risky command you must know if you are root or a normal user. Scripts also check this.

What is it?

whoami prints the name of the user you are running as now. It changes after sudo or su.

How to do it (step by step)

1. Check your user.

whoami

Output:

ravi

What it means: You are logged in as ravi.

2. See the change with sudo.

sudo whoami

Output:

root

What it means: sudo runs the command as root.

3. Use it in a script check.

[ "$(whoami)" = root ] || echo 'Run as root'

Output:

Run as root

What it means: The script stops normal users.

3. id: UID, GID and all groups

Why do we need this?

Permission problems are almost always about which UID and groups you have. id shows them in one line.

What is it?

id shows uid (user number), gid (primary group) and groups (all groups). id NAME shows another user. -u prints only the UID, -g only the GID, -G all group numbers, -n gives names.

How to do it (step by step)

1. Show your identity.

id

Output:

uid=1001(ravi) gid=1001(ravi) groups=1001(ravi),10(wheel),992(docker)

What it means: ravi is in wheel (sudo) and docker.

2. Check another user.

id nginx

Output:

uid=992(nginx) gid=990(nginx) groups=990(nginx)

What it means: A system user for the web server.

3. Only the UID.

id -u

Output:

1001

What it means: Normal users start at 1000 on most systems.

4. All group names.

id -Gn ravi

Output:

ravi wheel docker

What it means: Same as the groups command.

4. groups: list a user's groups

Why do we need this?

You added a user to a group but access still fails. First check the group list.

What is it?

groups prints the groups of the current shell. groups NAME reads the files and shows the saved list. New groups appear in your shell only after you log out and in again, or run newgrp.

How to do it (step by step)

1. Your groups.

groups

Output:

ravi wheel

What it means: docker is missing in this old shell.

2. Saved groups for ravi.

groups ravi

Output:

ravi : ravi wheel docker

What it means: The file already has docker.

3. Load a new group now.

newgrp docker && id -Gn

Output:

docker ravi wheel

What it means: No need to log out.

5. /etc/passwd: the user list

Why do we need this?

When a login fails or a service user looks wrong, you read this file to see the home folder, shell and UID.

What is it?

Each line has 7 fields split by ':' — name:x:UID:GID:comment:home:shell. The x means the password is in /etc/shadow. Shell /sbin/nologin blocks interactive login. Everyone can read this file. Use getent passwd NAME to also see users from LDAP or AD.

How to do it (step by step)

1. See one user's line.

grep '^ravi:' /etc/passwd

Output:

ravi:x:1001:1001:Ravi B:/home/ravi:/bin/bash

What it means: Name, UID 1001, home and bash shell.

2. Same with getent (works with LDAP too).

getent passwd nginx

Output:

nginx:x:992:990:Nginx web server:/var/lib/nginx:/sbin/nologin

What it means: nologin: no one can log in as nginx.

3. List only real users (UID 1000+).

awk -F: '$3>=1000 && $3<65534 {print $1}' /etc/passwd

Output:

ravi
priya
anil

What it means: Field 3 is the UID.

4. Who has UID 0?

awk -F: '$3==0 {print $1}' /etc/passwd

Output:

root

What it means: Any other name here is a security alarm.

6. /etc/shadow: hidden passwords and ageing

Why do we need this?

You need to check if an account is locked or when its password expires.

What is it?

Only root can read /etc/shadow. Fields: name:hash:lastchange:min:max:warn:inactive:expire. A hash starting with $6$ is SHA-512, $y$ is yescrypt. ! or !! at the start means locked or no password set. passwd -S shows a short status.

How to do it (step by step)

1. Normal users cannot read it.

cat /etc/shadow

Output:

cat: /etc/shadow: Permission denied

What it means: Good. Hashes stay secret.

2. Read one line as root.

sudo grep '^priya:' /etc/shadow

Output:

priya:$y$j9T$Kd...:20386:0:90:7:::

What it means: Password changed on day 20386, max age 90 days, warn 7 days before.

3. A locked account.

sudo grep '^anil:' /etc/shadow | cut -c1-12

Output:

anil:!$y$j9T

What it means: The ! means the password is locked.

7. /etc/group and /etc/gshadow: group lists

Why do we need this?

To know who is in the docker, wheel or finance group, you read the group file.

What is it?

Each line is group:x:GID:member1,member2. Members listed here have it as a secondary group. A user's primary group is in field 4 of /etc/passwd and is often not listed again. getent group NAME is the safe way to read it.

How to do it (step by step)

1. Members of wheel.

getent group wheel

Output:

wheel:x:10:ravi,priya

What it means: ravi and priya can use sudo (Red Hat family).

2. Ubuntu uses sudo group.

getent group sudo

Output:

sudo:x:27:ubuntu,ravi

What it means: Same idea, different name.

3. Count groups on the system.

wc -l < /etc/group

Output:

58

What it means: Most are system groups.

8. useradd: create a user

Why do we need this?

A new developer, an app account or a CI runner needs its own login so actions are tracked and rights are separate.

What is it?

useradd NAME creates the user. Key options: -m make home folder, -d set home path, -s login shell, -c comment, -u fixed UID, -g primary group, -G extra groups, -r system user (low UID, no home by default), -e expiry date. Defaults come from /etc/default/useradd and /etc/login.defs. On Ubuntu, adduser is a friendly wrapper that asks questions.

How to do it (step by step)

1. Create a normal user with home and bash.

sudo useradd -m -s /bin/bash -c 'Priya Kulkarni' priya && getent passwd priya

Output:

priya:x:1002:1002:Priya Kulkarni:/home/priya:/bin/bash

What it means: -m made /home/priya with files from /etc/skel.

2. Create a user with extra groups.

sudo useradd -m -G wheel,docker anil && id anil

Output:

uid=1003(anil) gid=1003(anil) groups=1003(anil),10(wheel),992(docker)

What it means: anil gets sudo and docker on day one.

3. A system user for an app (no login).

sudo useradd -r -s /sbin/nologin -d /opt/billing billing && getent passwd billing

Output:

billing:x:989:987::/opt/billing:/sbin/nologin

What it means: Low UID, cannot log in. Safe for services.

4. A contractor account that expires.

sudo useradd -m -e 2026-12-31 vendor1 && sudo chage -l vendor1 | grep 'Account expires'

Output:

Account expires : Dec 31, 2026

What it means: The account stops working after that date.

5. See the defaults.

useradd -D

Output:

GROUP=100
HOME=/home
SHELL=/bin/bash
SKEL=/etc/skel

What it means: Used when you skip options.

9. passwd: set, lock and check passwords

Why do we need this?

A new user cannot log in until a password (or SSH key) is set. You also lock accounts when someone leaves.

What is it?

passwd changes your own password. sudo passwd NAME sets another user's. -l lock, -u unlock, -S status, -e expire now (force change at next login), -d delete password (dangerous). To set from a script use echo 'name:pass' | sudo chpasswd.

How to do it (step by step)

1. Set a password for priya.

sudo passwd priya

Output:

New password:
Retype new password:
passwd: password updated successfully

What it means: Typing is hidden on screen.

2. Force change at first login.

sudo passwd -e priya

Output:

Expiring password for user priya.
passwd: Success

What it means: She must pick her own password.

3. Lock and check.

sudo passwd -l anil && sudo passwd -S anil

Output:

Locking password for user anil.
passwd: Success
anil LK 2026-10-25 0 99999 7 -1

What it means: LK means locked. SSH keys may still work, so also expire the account.

4. Set many passwords from a file.

sudo chpasswd < new-users.txt

Output:

(no output)

What it means: Each line is name:password.

10. usermod: change an existing user

Why do we need this?

People change teams, need docker access, change their shell or must be locked out. usermod does all of this without recreating the user.

What is it?

-aG GROUP append a group (ALWAYS use -a with -G, or other groups are removed). -g new primary group, -s shell, -d -m move home, -l new login name, -L lock, -U unlock, -e expiry date, -c comment.

How to do it (step by step)

1. Add ravi to docker safely.

sudo usermod -aG docker ravi && groups ravi

Output:

ravi : ravi wheel docker

What it means: wheel stayed because of -a.

2. The common mistake.

sudo usermod -G docker ravi && groups ravi

Output:

ravi : ravi docker

What it means: Without -a, wheel was removed and ravi lost sudo.

3. Change the shell.

sudo usermod -s /bin/zsh priya && getent passwd priya | cut -d: -f7

Output:

/bin/zsh

What it means: Field 7 changed.

4. Lock an employee who left.

sudo usermod -L -e 1 anil && sudo chage -l anil | grep 'Account expires'

Output:

Account expires : Jan 02, 1970

What it means: -L locks the password, -e 1 expires the account so SSH keys stop too.

5. Rename a login and move home.

sudo usermod -l priyak -d /home/priyak -m priya && ls /home

Output:

anil  priyak  ravi

What it means: UID stays the same, files stay owned.

11. userdel: remove a user

Why do we need this?

Old accounts are a security risk. When someone leaves for good, remove the account.

What is it?

userdel NAME removes the account but keeps the home folder. -r also deletes home and mail spool. Files elsewhere stay with the old UID (find them with find / -nouser). Kill the user's processes first, or userdel fails with 'user is currently used by process'.

How to do it (step by step)

1. Back up, then delete with home.

sudo tar czf /root/anil-home.tgz /home/anil && sudo userdel -r anil

Output:

userdel: anil mail spool (/var/mail/anil) not found

What it means: Just a note; the user and home are gone.

2. When the user is still logged in.

sudo userdel vendor1

Output:

userdel: user vendor1 is currently used by process 4312

What it means: Stop their processes first.

3. Stop processes, then delete.

sudo pkill -u vendor1; sudo userdel -r vendor1 && id vendor1

Output:

id: 'vendor1': no such user

What it means: The account is gone.

4. Find leftover files.

sudo find / -xdev -nouser 2>/dev/null

Output:

/srv/share/report-anil.xlsx

What it means: Give them a new owner with chown.

12. groupadd, groupmod, groupdel: manage groups

Why do we need this?

Teams share folders. A group like finance or devs lets you give rights once to the whole team.

What is it?

groupadd NAME creates a group (-g sets GID, -r system group). groupmod -n NEW OLD renames, -g changes GID. groupdel NAME removes it (it cannot be any user's primary group).

How to do it (step by step)

1. Create a team group.

sudo groupadd -g 3000 finance && getent group finance

Output:

finance:x:3000:

What it means: Empty group with GID 3000.

2. Rename it.

sudo groupmod -n accounts finance && getent group accounts

Output:

accounts:x:3000:

What it means: GID and file ownership stay.

3. Delete a group.

sudo groupdel accounts

Output:

(no output)

What it means: Files with GID 3000 now show just the number.

13. gpasswd: add or remove group members

Why do we need this?

usermod -aG adds one user to many groups. gpasswd is easier to add or remove one member from one group.

What is it?

gpasswd -a USER GROUP adds, -d USER GROUP removes, -M u1,u2 GROUP sets the full member list, -A sets group admins.

How to do it (step by step)

1. Add a member.

sudo gpasswd -a priya devs

Output:

Adding user priya to group devs

What it means: Same as usermod -aG devs priya.

2. Remove a member.

sudo gpasswd -d ravi docker

Output:

Removing user ravi from group docker

What it means: Only docker is removed.

3. Set the whole list.

sudo gpasswd -M ravi,priya devs && getent group devs

Output:

devs:x:3001:ravi,priya

What it means: Anyone else is dropped.

14. chage: password and account ageing

Why do we need this?

Company policy says passwords expire every 90 days, and contractor accounts expire on a date.

What is it?

chage -l USER lists ageing. -M max days, -m min days, -W warn days, -I inactive days after expiry, -E expiry date (YYYY-MM-DD, -1 for never), -d 0 forces change at next login. System defaults are PASS_MAX_DAYS etc. in /etc/login.defs.

How to do it (step by step)

1. See the ageing.

sudo chage -l priya

Output:

Last password change : Oct 25, 2026
Password expires : never
Account expires : never

What it means: No policy yet.

2. Apply a 90 day policy.

sudo chage -M 90 -m 1 -W 7 priya && sudo chage -l priya | grep 'Password expires'

Output:

Password expires : Jan 23, 2027

What it means: 90 days from the last change.

3. Force a change now.

sudo chage -d 0 priya

Output:

(no output)

What it means: At next login she must set a new password.

4. Remove expiry.

sudo chage -E -1 vendor1

Output:

(no output)

What it means: -1 means never expires.

15. su: switch to another user

Why do we need this?

You need to test what a service user can see, or work as another user for a while.

What is it?

su - USER starts a full login shell as USER (asks USER's password). The - loads their environment and home. su without a name means root. sudo su - or sudo -iu USER uses your own password instead. -c runs one command. -s gives a shell to a nologin user.

How to do it (step by step)

1. Become priya.

su - priya

Output:

Password:
[priya@web1 ~]$

What it means: Prompt shows the new user. Type exit to go back.

2. Run one command as a service user.

sudo su -s /bin/bash -c 'ls /var/lib/nginx' nginx

Output:

body  proxy  tmp

What it means: Tests what nginx can read.

3. Why the dash matters.

su priya -c pwd; su - priya -c pwd

Output:

/home/ravi
/home/priya

What it means: Without - you keep the old folder and environment.

16. who, w and last: who is logged in

Why do we need this?

Before a reboot, or during a security check, you need to know who is on the server and who logged in recently.

What is it?

who lists current logins. w also shows what each person is running and load. last shows login history from /var/log/wtmp; lastb shows failed logins (root only). lastlog shows the last login for every user.

How to do it (step by step)

1. Who is on now?

who

Output:

ravi   pts/0  2026-10-25 09:12 (49.36.10.4)
priya  pts/1  2026-10-25 10:02 (103.21.5.9)

What it means: Two people are connected over SSH.

2. What are they doing?

w -h

Output:

ravi  pts/0 49.36.10.4 09:12 0.00s bash
priya pts/1 103.21.5.9 10:02 2:10 vim app.conf

What it means: Warn priya before restarting.

3. Recent logins.

last -n 3

Output:

priya pts/1 103.21.5.9 Sun Oct 25 10:02 still logged in
ravi pts/0 49.36.10.4 Sun Oct 25 09:12 still logged in
reboot system boot 5.14.0 Sat Oct 24 22:01

What it means: Includes reboots.

4. Failed logins.

sudo lastb -n 2

Output:

admin ssh:notty 185.220.1.9 Sun Oct 25 03:11 - 03:11
root ssh:notty 185.220.1.9 Sun Oct 25 03:11 - 03:11

What it means: Bots guessing passwords. Use keys and fail2ban.

17. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

18. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

19. Troubleshooting step by step

Why do we need this?

When a user cannot log in or cannot access something, check identity, account state and groups in this order.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Does the user exist?

getent passwd priya

2. Is the shell a real shell?

getent passwd priya | cut -d: -f7

3. Is the password locked or expired?

sudo passwd -S priya; sudo chage -l priya

4. Which groups does the user have?

id priya

5. Did the group change need a new login?

sudo -iu priya id -Gn

6. Check the auth log.

sudo journalctl -u sshd --since '10 min ago' | tail

20. Lab 1: Onboard and offboard an employee

Why do we need this?

Create a user with groups and a forced password change, then lock and remove them safely.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create a team group.

sudo groupadd devs && getent group devs

Output:

devs:x:3001:

2. Create the user.

sudo useradd -m -s /bin/bash -c 'Lab User' -G devs labuser && id labuser

Output:

uid=1004(labuser) gid=1004(labuser) groups=1004(labuser),3001(devs)

3. Set a password and force change.

echo 'labuser:Temp@12345' | sudo chpasswd && sudo chage -d 0 labuser && sudo chage -l labuser | head -2

Output:

Last password change : password must be changed
Password expires : password must be changed

4. Lock the user on the last day.

sudo usermod -L -e 1 labuser && sudo passwd -S labuser

Output:

labuser LK 1970-01-01 0 99999 7 -1

5. Back up home and delete.

sudo tar czf /root/labuser.tgz /home/labuser && sudo userdel -r labuser && id labuser

Output:

id: 'labuser': no such user

21. Lab 2: Read the user databases

Why do we need this?

Use awk and getent to answer real admin questions from /etc/passwd and /etc/group.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. List human users.

awk -F: '$3>=1000 && $3<65534 {print $1, $6}' /etc/passwd

Output:

ravi /home/ravi
priya /home/priya

2. Users who can log in.

grep -v -E 'nologin|false' /etc/passwd | cut -d: -f1

Output:

root
ravi
priya

3. Check for extra UID 0.

awk -F: '$3==0' /etc/passwd

Output:

root:x:0:0:root:/root:/bin/bash

4. Who can use sudo?

getent group wheel sudo

Output:

wheel:x:10:ravi,priya

5. Accounts with no password set.

sudo awk -F: '$2=="" {print $1}' /etc/shadow

Output:

(no output)

22. Frequently asked questions

23. Interview questions and answers

Beginner level

Mid level level

Senior level

24. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.