Linux User Management: Users, Groups, Passwords and sudo

# create a user with a home directory and bash, then set a password
sudo useradd -m -s /bin/bash alice
sudo passwd alice
# give sudo rights (Debian/Ubuntu: sudo; Fedora/Arch/openSUSE: wheel)
sudo usermod -aG sudo alice
# add to another group (keep the -a!)
sudo usermod -aG docker alice
# delete the user and their home directory
sudo userdel -r alice

How Linux stores users and groups

Every account is a line in a few plain-text files. Tools like useradd edit them safely; you read them to check the result.

Regular users get UIDs from 1000 upwards on all major distros; lower UIDs are system accounts for services. Inspect any account:

id alice
getent passwd alice
groups alice
# who is logged in now
who

Example output:

uid=1001(alice) gid=1001(alice) groups=1001(alice),27(sudo),984(docker)

Create users

useradd (every distro)

sudo useradd -m -s /bin/bash -c "Alice Smith" alice
sudo passwd alice
# with extra groups at creation time
sudo useradd -m -s /bin/bash -G sudo,video alice
# with a specific UID, e.g. to match another machine for NFS
sudo useradd -m -u 1050 alice

-m creates the home directory and copies /etc/skel; -s sets the shell. Without -m on Debian/Ubuntu you get a user with no home directory, and without -s the shell may be /bin/sh.

adduser (Debian, Ubuntu, Mint)

sudo adduser alice
# add an existing user to a group
sudo adduser alice sudo

It prompts for the password and details and applies Debian's defaults. On Fedora and Arch use useradd; adduser there is either a symlink to it or missing.

System accounts for services

# no home, no login shell, UID from the system range
sudo useradd -r -s /usr/sbin/nologin -M myservice

Use these for daemons so a compromised service has no interactive login. For systemd services, DynamicUser=yes in the unit is often a better option; see systemd basics.

Groups: add, remove and create

# add a user to supplementary groups (append)
sudo usermod -aG docker,libvirt alice
# alternative tool, one group at a time
sudo gpasswd -a alice docker
# remove a user from a group
sudo gpasswd -d alice docker
# create and delete groups
sudo groupadd developers
sudo groupdel developers
# list members of a group
getent group docker

Group changes apply at the next login. To use the new group immediately in the current terminal, run newgrp docker. This is the usual fix for Docker socket permission denied after adding yourself to the docker group.

Common groups and what they grant:

Give a user sudo access

If you are already locked out of sudo, see user is not in the sudoers file, which covers fixing it with su, recovery mode or a live USB.

Custom sudo rules

Put rules in a separate file under /etc/sudoers.d/ and always edit with visudo, which checks the syntax before saving. A syntax error in sudoers breaks sudo for everyone.

sudo visudo -f /etc/sudoers.d/alice
# allow one command without a password
alice ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx
# check the syntax of all sudoers files
sudo visudo -c
# what can this user run?
sudo -l -U alice

Passwords and account expiry

# change your own password / someone else's
passwd
sudo passwd alice
# force a password change at next login
sudo passwd -e alice
# show ageing information
sudo chage -l alice
# maximum 90 days between changes, warn 7 days before
sudo chage -M 90 -W 7 alice
# account expires on a date (contractors, temporary access)
sudo chage -E 2026-12-31 alice

Lock, disable and delete accounts

# lock password login (SSH keys still work!)
sudo usermod -L alice
# fully disable: lock and expire the account
sudo usermod -L -e 1 alice
# unlock
sudo usermod -U -e "" alice
# deny interactive login, keep the account
sudo usermod -s /usr/sbin/nologin alice

Locking the password does not stop SSH key logins, which is why expiring the account (-e 1) is the reliable way to disable it. See SSH keys for managing authorized_keys.

To delete:

# check for running processes and kill them first
pgrep -u alice -l
sudo pkill -KILL -u alice
# remove the user, keep their files
sudo userdel alice
# remove the user, their home directory and mail spool
sudo userdel -r alice
# find files elsewhere still owned by the deleted UID
sudo find / -xdev -nouser 2>/dev/null

Modify existing users

# rename a user and move their home directory
sudo usermod -l alicia -d /home/alicia -m alice
sudo groupmod -n alicia alice
# change the login shell
sudo usermod -s /usr/bin/zsh alice
chsh -s /usr/bin/zsh       # for yourself
# change the comment / full name
sudo usermod -c "Alicia Smith" alicia

The user must be logged out for renames and UID changes. If you change a UID, fix file ownership afterwards (sudo find / -xdev -uid OLD_UID -exec chown -h NEW_UID {} +). For what ownership and permission bits mean, see Linux file permissions.

Desktop tools

On desktops you can do the basics graphically: Settings → System → Users in GNOME, System Settings → Users in KDE Plasma, and Users and Groups on Linux Mint. They cover creating accounts, setting administrator status (which adds the user to sudo or wheel) and passwords; use the commands above for groups, expiry and service accounts.

Frequently asked questions