Red Hat System Administration I · RH124

Chapter 10

Managing Local Users and Groups

/etc/passwd & /etc/shadow · useradd/usermod/userdel · Groups

CIS126RH — Mesa Community College

Chapter Objective

Create, modify, and remove local user accounts and groups, understand the files that store account information, and manage passwords securely.

Key Commands

useradd
usermod
userdel
passwd
groupadd
groupmod
groupdel
id

User Accounts on Linux

Every process on a RHEL system runs as some user, and every file is owned by a user and a group. User accounts fall into a few broad categories.

Type	UID Range (typical)	Purpose
Superuser (root)	0	Unrestricted administrative access
System accounts	1–999	Owned by services and daemons, not meant for interactive login
Regular (human) accounts	1000+	Created for people who log in and do work

Why It Matters — Running everyday tasks as a regular user rather than root limits the damage a mistake or compromised process can do. Understanding UID ranges helps you tell a legitimate service account from a suspicious one at a glance.

/etc/passwd Fields

Local account information lives in two plain-text files. /etc/passwd is world-readable and holds account metadata; /etc/shadow is readable only by root and holds the actual password hashes.

student:x:1000:1000:Student User:/home/student:/bin/bash

Field	Meaning
`student`	Username
`x`	Placeholder — the real password hash lives in `/etc/shadow`
`1000`	UID (user ID)
`1000`	GID (primary group ID)
`Student User`	GECOS field — comment, usually the full name
`/home/student`	Home directory
`/bin/bash`	Login shell

/etc/shadow Fields

student:$6$hash...:19850:0:99999:7:::

Field (in order)	Meaning
Username	Matches the `/etc/passwd` entry
Encrypted password	The password hash (or `!` / `*` if locked)
Last changed	Days since Jan 1, 1970 the password was last changed
Minimum age	Days before the password can be changed again
Maximum age	Days before the password must be changed
Warning period	Days before expiration the user is warned

Warning — Never Edit These Files Directly — Both files use precise field structure that the system relies on. Use useradd, usermod, passwd, and related commands instead of hand-editing — or, if you must inspect the raw structure, use vipw and vipw -s, which lock the file safely while you edit.

Creating and Managing Users

# Create a new user with default settings
useradd sarah

# Create a user with a specific UID, comment, and shell
useradd -u 1050 -c "Sarah Connor" -s /bin/bash sarah

# Create a user with no login shell (for service accounts)
useradd -s /sbin/nologin appuser

# Modify an existing user's comment field
usermod -c "Sarah J. Connor" sarah

# Lock an account (disable password login)
usermod -L sarah

# Unlock it again
usermod -U sarah

# Delete a user, keeping their home directory
userdel sarah

# Delete a user AND their home directory
userdel -r sarah

Tip — /etc/skel — When useradd creates a home directory, it populates it by copying everything from /etc/skel. Adding a file there (like a default .bashrc customization) means every newly created user gets it automatically.

Managing Passwords

# Set or change your own password
passwd

# As root, set another user's password
passwd sarah

# Force a user to change their password at next login
passwd -e sarah

# Lock a password without deleting the account
passwd -l sarah

# Unlock it again
passwd -u sarah

# View password aging information
chage -l sarah

# Set a maximum password age of 90 days
chage -M 90 sarah

Exam Note — passwd -l and usermod -L both lock an account by prepending ! to the password hash in /etc/shadow — they accomplish the same underlying result through different commands.

Groups

Groups let you grant the same permissions to multiple users at once. Every user has exactly one primary group and can belong to any number of supplementary groups.

# Create a new group
groupadd developers

# Create a group with a specific GID
groupadd -g 2000 developers

# Add an existing user to a supplementary group
usermod -aG developers sarah

# Set a user's PRIMARY group (careful — replaces the primary group)
usermod -g developers sarah

# Rename a group
groupmod -n devs developers

# Delete a group
groupdel devs

Warning — Always Use -a with -G — usermod -G developers sarah (without -a) replaces all of a user's supplementary groups with just the one listed, silently removing them from every other group. Always pair -G with -a (append) unless you specifically intend to reset the whole list.

Checking Identity

# Show your own UID, GID, and group memberships
id

# Show another user's identity information
id sarah

# Show which username you're currently logged in as
whoami

# Show who is currently logged in
who

# Show who is logged in and what they're running
w

Tip — id Is Your Fastest Sanity Check — Before troubleshooting a "permission denied" error, run id to confirm exactly which user and groups you're actually operating as — it's often not what you assumed.

Key Terms for Chapter 10

UID: User ID; the numeric identifier the system actually uses to represent a user
GID: Group ID; the numeric identifier for a group
/etc/passwd: World-readable file storing account metadata for each user
/etc/shadow: Root-only file storing password hashes and password aging data
primary group: The single group a user's files are created with by default
supplementary group: An additional group a user belongs to, beyond their primary group
/etc/skel: Directory whose contents are copied into a new user's home directory at creation
GECOS field: The comment field in /etc/passwd, typically holding a user's full name

Review Questions

What is the difference between what /etc/passwd and /etc/shadow store, and why are they split apart?
What UID range is typically reserved for system/service accounts on RHEL, as opposed to human users?
Write a command that creates a new user named miguel with /bin/bash as the login shell.
What's the difference between usermod -G developers sarah and usermod -aG developers sarah?
What command would you run to see a user's password aging settings?
What is the purpose of /etc/skel?
You get "permission denied" doing something you expect to be allowed. What's the fastest command to confirm which user and groups you're actually running as?

1 / 11