LFCS 31 🐧 Users — Creating and Modifying - KandZ

User management is the foundation of Linux system administration. Every process runs as a user, every file is owned by a user, and every permission decision is ultimately a decision about which user can do what. The LFCS exam treats user administration as essential, and the commands involved — useradd, usermod, passwd, chage — appear repeatedly in real work and in exam scenarios. This chapter covers the two core operations: creating a user account with the correct properties, and modifying an existing account when requirements change.

Key point: useradd creates the account entry in /etc/passwd, but it does not set a password. The account is locked until passwd is run. On most distributions, the default behavior is to create a home directory and assign a user private group, but these defaults are controlled by /etc/login.defs and the useradd configuration file, and they vary between distributions.

Why user management matters

The identity problem. Every file on the system has an owner, and every process runs with a user’s identity. Without proper user accounts, there is no way to enforce access control, no way to audit who did what, and no way to grant one person the ability to run a command without granting it to everyone.

The least-privilege problem. The root account can do anything. Running daily work as root is dangerous because a single mistake can destroy the system. Regular user accounts exist so that people can work with limited privileges, and sudo exists so that specific administrative commands can be granted on a per-user, per-command basis.

The lifecycle problem. A user account is not created once and forgotten. Passwords expire, accounts become inactive, people change roles, and usernames change. The usermod and chage commands handle the modifications that the account’s lifecycle requires.

The file layout problem. User information is stored across several files: /etc/passwd for account details, /etc/shadow for password hashes and aging, /etc/group for group membership, and /etc/gshadow for group passwords . Understanding what each file contains is what makes the commands predictable.

The default problem. When useradd runs without options, it uses the defaults from /etc/login.defs and /etc/default/useradd. These defaults determine the UID range, the home directory location, the shell, and the skeleton files. On many systems, the account is created locked, and passwd must be run separately to set a password .

The exam problem. The LFCS exam is performance-based. A typical task asks you to create a user with a specific home directory, shell, and supplementary groups, or to modify an existing user’s account expiration date. Knowing the exact flags is what makes the difference between passing and failing.

a. Creating users with useradd

The useradd command creates a new user account. It updates /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow, and it can create the home directory and copy skeleton files into it .

The basic creation

The simplest form creates an account with the system defaults.

sudo useradd alice

On many distributions, this creates a locked account. No password is set, and the user cannot log in until passwd is run. The account appears in /etc/passwd with the next available UID and a user private group (UPG) with the same name as the user .

The home directory and shell

The most common flags specify the home directory and the login shell.

sudo useradd -m -s /bin/bash alice

The -m flag creates the home directory. Without it, the directory may not be created, depending on the distribution’s defaults. The -s flag sets the login shell. /bin/bash is the common choice for interactive users; /usr/sbin/nologin is used for service accounts that should not log in .

The supplementary groups

The -G flag adds the user to supplementary groups. The groups must already exist.

sudo useradd -m -s /bin/bash -G sudo,docker alice

The user’s primary group is still the UPG created by useradd. The -G groups are additional. Group names are comma-separated with no spaces .

The UID and comment

The -u flag sets a specific UID. The -c flag sets the comment field, often the user’s full name.

sudo useradd -m -s /bin/bash -u 1500 -c "Alice Smith" alice

The UID must be unique unless -o is used to allow duplicates. UIDs below 1000 are traditionally reserved for system accounts .

The system account

The -r flag creates a system account. System accounts have UIDs below the regular user range, and the home directory is often omitted.

sudo useradd -r -s /usr/sbin/nologin myservice

System accounts are used for services and daemons that need a user identity but should not log in .

The password

useradd does not set a password. The passwd command does.

sudo passwd alice

A regular user can change their own password. The superuser can change any user’s password, including resetting a forgotten one .

The default settings

The -D flag displays or modifies the defaults in /etc/default/useradd.

sudo useradd -D
sudo useradd -D -f 30

The -D -f 30 form sets the default inactivity period for new accounts to 30 days. A value of -1 disables the inactivity lock .

The skeleton directory

When -m creates the home directory, the files in /etc/skel/ are copied into it. These files provide the initial shell configuration, such as .bashrc and .profile. The contents of /etc/skel/ can be customized to provide organization-specific defaults .

b. Modifying users with usermod

The usermod command modifies an existing account. It changes the entries in /etc/passwd, /etc/shadow, and /etc/group without creating a new account .

The home directory

The -d flag changes the home directory. The -m flag moves the contents of the old directory to the new one.

sudo usermod -d /home/alice-new -m alice

Without -m, the home directory entry changes but the files are not moved. The user’s new home directory is empty or nonexistent. With -m, the old contents are copied and ownership is adjusted .

The login name

The -l flag changes the username. The home directory name is not changed automatically; it must be renamed manually if desired.

sudo usermod -l alice-new alice

The UID, groups, and home directory remain the same. Only the login name changes. The home directory and mail spool should be renamed manually to match .

The primary group

The -g flag changes the user’s primary group. The group must exist.

sudo usermod -g developers alice

The group ownership of files in the user’s home directory is updated automatically if the home directory is owned by the user. Files outside the home directory must be fixed manually .

The supplementary groups

The -G flag sets the supplementary groups. The -a flag appends to the existing list instead of replacing it.

sudo usermod -aG docker alice

The -a flag is essential. Without it, -G replaces the user’s entire supplementary group list, potentially removing them from groups they need .

The shell

The -s flag changes the login shell.

sudo usermod -s /bin/zsh alice

The account expiration

The -e flag sets the account expiration date. The -f flag sets the inactivity period after password expiration.

sudo usermod -e 2026-12-31 alice
sudo usermod -f 30 alice

The expiration date is stored in /etc/shadow. The inactivity period is the number of days after the password expires before the account is locked. A value of 0 locks immediately on password expiration; -1 disables the inactivity lock .

Locking and unlocking

The -L flag locks the password. The -U flag unlocks it.

sudo usermod -L alice
sudo usermod -U alice

Locking adds a ! to the beginning of the encrypted password in /etc/shadow. The account can still be accessed through other authentication methods, such as SSH keys. To fully disable the account, set the expiration date to 1 (January 2, 1970) .

The UID change

The -u flag changes the UID. The -o flag allows a non-unique UID.

sudo usermod -u 1600 alice

The UID change updates the ownership of files in the user’s home directory. Files outside the home directory must be updated manually with find and chown .

c. Password and aging with passwd and chage

The passwd command manages passwords. The chage command manages password aging.

Setting a password

The passwd command prompts for the new password twice and checks it for complexity.

sudo passwd alice

The superuser can set the password for any user. A regular user can only change their own, and must provide the current password first .

Locking and unlocking with passwd

The -l and -u flags lock and unlock the password.

sudo passwd -l alice
sudo passwd -u alice

Locking with passwd -l adds the ! prefix. The note about SSH keys applies here as well: locking the password does not disable the account .

Expiring the password

The -e flag immediately expires the password, forcing a change on the next login.

sudo passwd -e alice

This is useful for onboarding: the user must set a new password at first login .

The chage command

The chage command controls password aging. The -M flag sets the maximum days between password changes. The -m flag sets the minimum. The -W sets the warning days. The -I sets the inactivity period. The -E sets the account expiration date.

sudo chage -M 90 alice
sudo chage -m 7 alice
sudo chage -W 14 alice
sudo chage -E 2026-12-31 alice

The -l flag lists the current aging information for a user.

sudo chage -l alice

The defaults for new users are set in /etc/login.defs through PASS_MAX_DAYS, PASS_MIN_DAYS, and PASS_WARN_AGE .

Complete Example Session

# ============================================
# PART 1: CREATE A BASIC USER
# ============================================

sudo useradd -m -s /bin/bash alice

# The account is created in /etc/passwd.
# The home directory /home/alice is created.
# No password is set. The account is locked.

# ============================================
# PART 2: SET THE PASSWORD
# ============================================

sudo passwd alice

# The account is now usable.

# ============================================
# PART 3: CREATE WITH SUPPLEMENTARY GROUPS
# ============================================

sudo useradd -m -s /bin/bash -G sudo,docker bob

# Bob is in the sudo and docker groups.
# His primary group is the UPG "bob".

# ============================================
# PART 4: MODIFY THE SHELL
# ============================================

sudo usermod -s /bin/zsh alice

# ============================================
# PART 5: ADD TO A SUPPLEMENTARY GROUP
# ============================================

sudo usermod -aG docker alice

# The -a is essential. Without it, -G would replace
# Alice's existing supplementary groups.

# ============================================
# PART 6: CHANGE THE HOME DIRECTORY
# ============================================

sudo usermod -d /home/alice-new -m alice

# The old home directory contents are moved.

# ============================================
# PART 7: SET ACCOUNT EXPIRATION
# ============================================

sudo usermod -e 2026-12-31 alice

# Alice cannot log in after December 31, 2026.

# ============================================
# PART 8: SET PASSWORD AGING
# ============================================

sudo chage -M 90 -m 7 -W 14 alice

# Password expires every 90 days.
# Minimum 7 days between changes.
# Warning 14 days before expiration.

# ============================================
# PART 9: LOCK AND UNLOCK
# ============================================

sudo passwd -l alice
sudo passwd -u alice

# Or with usermod:
sudo usermod -L alice
sudo usermod -U alice

# ============================================
# PART 10: VERIFY
# ============================================

id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),999(docker)

chage -l alice
# Last password change                                    : ...
# Password expires                                        : ...
# Password inactive                                       : ...
# Account expires                                         : Dec 31, 2026
# Minimum number of days between password change          : 7
# Maximum number of days between password change          : 90
# Number of days of warning before password expires       : 14

sudo grep alice /etc/passwd
# alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash

sudo grep alice /etc/shadow
# alice:$6$...:...:...:90:7:14:...:...

The ten parts showed basic creation, password setting, supplementary groups, shell change, group appending, home directory change, account expiration, password aging, lock/unlock, and verification.

Quick Reference

useradd Options

Option	Purpose
`-m`	Create home directory
`-s`	Set login shell
`-G`	Set supplementary groups
`-g`	Set primary group
`-u`	Set UID
`-c`	Set comment (full name)
`-r`	Create system account
`-D`	Show or modify defaults

usermod Options

Option	Purpose
`-d`	Change home directory
`-m`	Move home directory contents
`-l`	Change login name
`-g`	Change primary group
`-G`	Set supplementary groups
`-a`	Append to supplementary groups
`-s`	Change shell
`-e`	Set account expiration
`-f`	Set inactivity period
`-L` / `-U`	Lock / unlock password
`-u`	Change UID

passwd and chage

Command	Purpose
`passwd user`	Set password
`passwd -l user`	Lock password
`passwd -u user`	Unlock password
`passwd -e user`	Expire password
`chage -M days user`	Max password age
`chage -m days user`	Min password age
`chage -W days user`	Warning days
`chage -E date user`	Account expiration
`chage -l user`	List aging info

Important Files

File	Contents
`/etc/passwd`	User accounts
`/etc/shadow`	Password hashes and aging
`/etc/group`	Group definitions
`/etc/gshadow`	Group passwords
`/etc/skel/`	Skeleton files for new users
`/etc/login.defs`	Default login settings

Best Practices

✅ Do This:

# Use -m to create the home directory.
sudo useradd -m -s /bin/bash alice  # ✅

# Set the password after creation.
sudo passwd alice  # ✅

# Use -aG to append to supplementary groups.
sudo usermod -aG docker alice  # ✅

# Use /usr/sbin/nologin for service accounts.
sudo useradd -r -s /usr/sbin/nologin myservice  # ✅

# Set password aging for security.
sudo chage -M 90 alice  # ✅

# Verify with id and chage -l.
id alice && sudo chage -l alice  # ✅

❌ Don’t Do This:

# Don't forget -m if a home directory is needed.
sudo useradd alice  # ❌ May not create /home/alice

# Don't use -G without -a to add a group.
sudo usermod -G docker alice  # ❌ Replaces all supplementary groups

# Don't expect useradd to set a password.
sudo useradd alice  # ❌ Account is locked until passwd

# Don't run daily work as root.
# Create a regular user and use sudo.  # ❌

# Don't use -r for regular users.
sudo useradd -r alice  # ❌ System UID range

# Don't leave accounts without expiration for temporary users.
sudo useradd temp  # ❌ No expiration set

Common Pitfalls

Pitfall	Why It Happens	Fix
User cannot log in	No password set	Run `passwd`
Home directory missing	`-m` not used	Use `-m` or create manually
Removed from groups	`-G` without `-a`	Use `-aG`
Home directory not moved	`-d` without `-m`	Use `-dm`
Account still accessible	Password locked, SSH key active	Set expiration to `1`
Defaults wrong	Distro-specific `/etc/default/useradd`	Check with `useradd -D`
Group not found	Group does not exist	Create with `groupadd` first

Real-World Examples

1. Create a Standard User

sudo useradd -m -s /bin/bash alice && sudo passwd alice

2. Create with Groups

sudo useradd -m -s /bin/bash -G sudo,docker bob

3. Add to a Group

sudo usermod -aG docker alice

4. Change Shell

sudo usermod -s /bin/zsh alice

5. Move Home Directory

sudo usermod -d /home/alice-new -m alice

6. Set Account Expiration

sudo usermod -e 2026-12-31 alice

7. Set Password Aging

sudo chage -M 90 -m 7 -W 14 alice

8. Lock and Unlock

sudo passwd -l alice && sudo passwd -u alice

9. Create a Service Account

sudo useradd -r -s /usr/sbin/nologin myservice

10. Verify

id alice && sudo chage -l alice && grep alice /etc/passwd

Visual

The User Creation Flow

┌────────────────────────────────────────────────────────────┐
│  useradd alice                                             │
│                                                            │
│  ┌──────────────────────────────────────────────────┐     │
│  │  /etc/passwd                                      │     │
│  │    alice:x:1001:1001::/home/alice:/bin/bash       │     │
│  └──────────────────────────────────────────────────┘     │
│                        │                                   │
│                        v                                   │
│  ┌──────────────────────────────────────────────────┐     │
│  │  /etc/shadow                                      │     │
│  │    alice:!:...:...:...:...:...:...:...            │     │
│  │    ^                                              │     │
│  │    The ! means the account is locked.             │     │
│  └──────────────────────────────────────────────────┘     │
│                        │                                   │
│                        v                                   │
│  ┌──────────────────────────────────────────────────┐     │
│  │  passwd alice                                     │     │
│  │    Sets the password hash.                        │     │
│  │    Removes the ! and the account is usable.       │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  Without passwd, the account exists but cannot log in.     │
└────────────────────────────────────────────────────────────┘

The Group Flags

┌────────────────────────────────────────────────────────────┐
│  -G vs -aG                                                 │
│                                                            │
│  sudo usermod -G docker alice                              │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Alice's supplementary groups are REPLACED.       │     │
│  │  Before: [sudo, developers]                       │     │
│  │  After:  [docker]                                 │     │
│  │  She is removed from sudo and developers.         │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  sudo usermod -aG docker alice                             │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Docker is APPENDED to the existing groups.       │     │
│  │  Before: [sudo, developers]                       │     │
│  │  After:  [sudo, developers, docker]               │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The -a flag is essential. Without it, -G is destructive.  │
└────────────────────────────────────────────────────────────┘

Account Expiration vs Password Expiration

┌────────────────────────────────────────────────────────────┐
│  EXPIRATION TYPES                                          │
│                                                            │
│  PASSWORD EXPIRATION (chage -M 90)                         │
│  ┌──────────────────────────────────────────────────┐     │
│  │  After 90 days, the password must be changed.     │     │
│  │  The user can still log in and change it.         │     │
│  │  The account is not locked.                       │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  INACTIVITY PERIOD (chage -I 30 or usermod -f 30)          │
│  ┌──────────────────────────────────────────────────┐     │
│  │  After the password expires, the user has 30      │     │
│  │  days to change it. After that, the account is    │     │
│  │  locked.                                          │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  ACCOUNT EXPIRATION (chage -E 2026-12-31)                  │
│  ┌──────────────────────────────────────────────────┐     │
│  │  After this date, the account is disabled.        │     │
│  │  No login is possible, regardless of password.    │     │
│  │  Used for temporary accounts and contractors.     │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The three are independent. A user can have all three set. │
└────────────────────────────────────────────────────────────┘

The Locking Distinction

┌────────────────────────────────────────────────────────────┐
│  LOCKING: PASSWORD vs ACCOUNT                              │
│                                                            │
│  passwd -l alice / usermod -L alice                        │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Adds ! to the password hash in /etc/shadow.      │     │
│  │  Password login is disabled.                      │     │
│  │  SSH key login still works.                       │     │
│  │  The account is NOT disabled.                     │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  usermod -e 1 alice                                        │
│  ┌──────────────────────────────────────────────────┐     │
│  │  Sets the account expiration to Jan 2, 1970.      │     │
│  │  The account is DISABLED entirely.                │     │
│  │  No login method works.                           │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  Use the right tool for the requirement.                   │
└────────────────────────────────────────────────────────────┘

Summary

Item	Value
`useradd`	Create a new user account
`-m`	Create home directory
`-s`	Set login shell
`-G`	Set supplementary groups
`usermod`	Modify an existing account
`-aG`	Append to supplementary groups
`-L` / `-U`	Lock / unlock password
`-e`	Set account expiration
`passwd`	Set or change a password
`chage`	Manage password aging
`/etc/passwd`	User account details
`/etc/shadow`	Password hashes and aging
`/etc/skel/`	Skeleton files for new users

Key takeaways:

useradd creates the account; passwd makes it usable. The account is created locked, and the password must be set separately. Without passwd, the user cannot log in.
The -m flag creates the home directory. Without it, the directory may not exist, and the user has no place to store files. On most distributions, the default is to create it, but the behavior varies.
-G replaces supplementary groups; -aG appends. The -a flag is essential when adding a group to an existing user. Without it, the user is removed from every group not listed.
usermod -d -m moves the home directory. The -d flag changes the entry; -m moves the contents. Without -m, the files stay in the old location.
Password expiration and account expiration are different. Password expiration forces a password change. Account expiration disables the account entirely. The chage -E and usermod -e flags set the latter.
Locking the password does not lock the account. passwd -l and usermod -L disable password login but leave SSH key login functional. To disable the account, set the expiration date to 1.
The defaults live in /etc/login.defs and /etc/default/useradd. These files control the UID range, home directory location, shell, and skeleton files. The useradd -D command shows and modifies the defaults.
Verify with id and chage -l. The id command shows the UID, GID, and groups. The chage -l command shows the aging information. Both are quick ways to confirm that a change took effect.

Remember: User management is the practice of creating, modifying, and removing accounts that represent the people and services that use the system. The useradd command creates the account, and passwd sets the password. The usermod command modifies the account, and chage manages the aging policies. The flags matter: -m creates the home directory, -s sets the shell, -G sets the groups, and -aG appends without removing. The account information is stored across /etc/passwd, /etc/shadow, and /etc/group, and the defaults come from /etc/login.defs. The result is a system where every process and every file has an owner, and where the principle of least privilege can be enforced through carefully scoped accounts.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!