Linux user and group management is the foundation of access control on every Linux system — governing who can log in, which resources they can reach, and under what conditions they can elevate privilege. Every process runs as a UID and one or more GIDs; every file has an owner and group; every sudo rule, ACL entry, and PAM policy traces directly back to these identities. The critical mental model is that identity is layered: the kernel cares only about numeric UIDs and GIDs, the database files (/etc/passwd, /etc/shadow, /etc/group, /etc/gshadow) map those numbers to names, and higher-level tools (PAM, SSSD, sudo) bolt additional policy on top — misunderstand the layer and troubleshooting becomes guesswork.
What This Cheat Sheet Covers
This topic spans 15 focused tables and 149 indexed concepts, 130 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Core User Commands (useradd / usermod / userdel)
Creating, modifying, and deleting local user accounts is done with the shadow-utils trio useradd, usermod, and userdel. These commands write directly to /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow, and their behaviour is governed by defaults in /etc/login.defs and /etc/default/useradd.
| Command | Example | Description | |
|---|---|---|---|
useradd -m -s /bin/bash alice | • Creates user alice with home directory (-m) and login shell• home is populated from /etc/skel. | ||
useradd -r -s /usr/sbin/nologin svcacct | • Creates a system account (UID in SYS_UID_MIN–SYS_UID_MAX range)• no aging info written to /etc/shadow• no home by default | ||
useradd -u 1500 -g staff -G sudo,docker alice | Sets explicit UID, primary group ( -g), and supplementary groups (-G) at creation time. | ||
useradd -e 2025-12-31 contractor | • Sets account expiration date in YYYY-MM-DD format • account becomes inaccessible after that date | ||
useradd -D | Displays (or modifies with extra flags) the defaults stored in /etc/default/useradd. | ||
usermod -aG docker alice | • Appends alice to the docker supplementary group without removing her from existing groups• omitting -a replaces all supplementary groups | ||
usermod -g staff alice | • Changes alice's primary group • files in her home dir owned by the old GID are re-owned automatically | ||
usermod -s /bin/zsh alice | • Changes the login shell • an empty string restores the system default | ||
usermod -d /data/alice -m alice | Moves home directory to a new path ( -m triggers the actual file copy). | ||
usermod -l alice_new alice | • Renames login from alice to alice_new• home directory and mail spool are not renamed automatically | ||
usermod -L alice | • Locks the password by prepending ! to the hash in /etc/shadow• SSH key auth still works unless SSH access is also restricted | ||
usermod -U alice | • Unlocks the password by removing the ! prefix• also set EXPIRE_DATE to 99999 to fully re-enable the account | ||
usermod -e 2026-06-30 alice | • Sets or updates account expiry • pass -1 or empty string to remove the expiry | ||
userdel alice | Removes the user from account databases but leaves home directory and files intact. | ||
userdel -r alice | • Removes the user and deletes home directory, mail spool • files outside home must be found and removed manually | ||
userdel -f alice | • Forces deletion even if the user is currently logged in • dangerous — may leave the system in an inconsistent state |