Unit

Create a User Account on Linux

Learn how to create, configure, secure, and verify Linux user accounts with useradd, adduser, passwd, groups, and related commands.

Why Linux Uses User Accounts

A user account is a system identity used for authentication, file ownership, permissions, personal settings, and accountability. Separate accounts let several people share one computer without sharing all of their files or privileges.

• Identity: The system can distinguish one person or service from another.
• Ownership: Files and processes can belong to a specific account.
• Permissions: Access can be granted to one user, a group, or neither.
• Personalization: Each user can have a separate home directory and shell configuration.
• Accountability: Logs can associate actions with individual accounts.
• Safer administration: Users can perform ordinary work without operating as an unrestricted administrator.

The root account is the unrestricted administrative identity on Unix-like systems. It can read, modify, or delete almost anything and can change system configuration. A normal account has limited permissions. When a normal user is approved for administrative work, sudo can run selected commands with elevated privileges without requiring the user to work as root continuously.

Information Stored for an Account

Linux account databases associate a login name with numeric identifiers and environment settings. A UID is the numeric user identifier used internally by the operating system. A group is a collection of users used to assign shared permissions, and a GID is that group's numeric identifier.

On systems using local files, /etc/passwd contains public account attributes such as the username, UID, primary GID, comment, home directory, and shell. Password hashes and aging information are commonly kept separately in the protected /etc/shadow file. The password field in /etc/passwd is normally a marker rather than the password hash itself.

A user's primary group is the default group for newly created files. Supplementary groups are additional memberships that provide access to shared resources such as project directories, devices, or administrative roles.

Choose a Username and Account Type

Choose a short, meaningful, unique username that follows local policy. Avoid spaces, ambiguous punctuation, names that could be confused with system accounts, and names that conflict with an existing local or directory-backed identity. Check the complete configured name-service view before creating an account:

getent passwd alice

A regular interactive account represents a person. A service account represents an application or system service and normally should not be used for interactive work.

Create a Normal Interactive User

Account creation requires root privileges or an authorized sudo rule. The common low-level Linux tool is useradd. The following command creates a user, creates the home directory, and selects Bash as the login shell:

sudo useradd -m -s /bin/bash alice

The -m option requests creation of the home directory. This is important on systems whose defaults do not create one automatically. The shell path must exist on the target system; check available shells in /etc/shells or follow distribution policy.

Many distributions also provide adduser, an interactive helper:

sudo adduser alice

useradd is predictable and useful in scripts, but it is lower level and may require you to specify more settings. adduser is distribution-specific and may prompt for a password, full name, home-directory choices, and other details. Read the local command's documentation before relying on options across distributions.

Depending on distribution defaults, account creation may create a matching private primary group, may place the user in a general default group, or may use an existing group. Confirm the result rather than assuming a policy:

id alice

Set Account Properties During Creation

Common useradd options allow you to define the account's environment and group memberships.

• -m creates the home directory.
• -d /path selects a custom home directory.
• -s /bin/bash selects the login shell.
• -g groupname selects the primary group, which must already exist unless local behavior supports creating it.
• -G group1,group2 assigns supplementary groups.
• -c "Full Name" sets the comment or descriptive full-name field.
• -r creates a system-oriented account on implementations that support this option.

For example, if the group projectteam already exists:

sudo useradd -m -s /bin/bash -c "Alice Smith" -G projectteam alice

Use groups to grant narrowly defined shared access instead of making project files broadly writable. A group membership may not appear in an already open session; the user should start a new login session after the change.

Regular Accounts Versus System Accounts

A system account is intended for a service rather than a person. It commonly receives a UID from the system-account range, does not need a home directory, and uses a non-interactive shell. Exact ranges and defaults differ between distributions.

sudo useradd -r -M -s /usr/sbin/nologin appsvc

Use a non-login shell path that exists on the system. Do not use this pattern for a person who needs an interactive terminal. A service account should receive only the file, process, and network permissions required by its application.

Initialize the Home Directory

A home directory is a user's personal directory for documents, application data, and shell configuration. When an account-management tool creates it, it commonly copies default startup files from /etc/skel. These files can include shell profiles and default configuration files.

Creating a home directory is not the same as proving it is configured correctly. Check its path, owner, group, and permission bits:

getent passwd alice
ls -ld /home/alice

The directory should normally be owned by the new user and the intended primary group. If a directory was created manually or copied from another location, correct ownership and permissions according to local policy before allowing the user to store private data. Avoid copying another user's private configuration without reviewing its ownership and contents.

Set a Password and Secure the First Login

Set an initial password interactively so it is not exposed in shell history, process listings, scripts, or command logs:

sudo passwd alice

Use a long, unique password that meets the site's quality requirements. Never share it in an insecure channel, and do not place it directly in a command or script. Password-quality checks and aging rules are controlled by local authentication policy.

If policy requires the user to replace an administrator-provided initial password at first login, expire the password after setting it:

sudo chage -d 0 alice

This option is appropriate for a password-based human login workflow. An account created without a usable password can be intentional for a service account or for an account that authenticates with approved SSH keys. It does not automatically make that account secure: confirm that unwanted authentication methods are disabled and that remote-login policy is appropriate.

Grant Administrative Access Carefully

Creating a user does not automatically grant administrative privileges. If the person must run approved administrative commands, add the account to the administrator-approved group used by the distribution. Common names include sudo and wheel, but the correct group and sudo policy are local configuration decisions.

sudo usermod -aG sudo alice

Do not run this command unless the account genuinely needs administrative access. The -a option means append; when used with -G, it preserves existing supplementary groups. Omitting -a can replace the user's supplementary group list. The user must usually begin a new login session before the membership is effective.

Verify the New Account

Verification should confirm both the account database entry and the filesystem state.

1. Confirm the account record and its configured home directory and shell.
2. Inspect the UID, primary GID, and supplementary groups.
3. Check home-directory ownership and permissions.
4. Test a login or local user switch where permitted.

getent passwd alice
id alice
groups alice
ls -ld /home/alice
su - alice

The su - alice command starts a login-style shell and loads the user's login environment. Enter the appropriate password if prompted, then use exit to return to the previous shell. A local security policy may restrict user switching. Do not test with a real password in documentation, scripts, or screenshots.

Common User-Management Commands

Troubleshooting

No Home Directory Exists

Check the configured path with getent passwd alice. The command may have been run without -m, system defaults may disable home creation, or a custom path may not have been created. Create or select the directory according to local policy, then verify that the user and primary group own it.

The User Cannot Log In

Check whether a password was set for password authentication, whether the account is locked or expired, and whether the configured shell exists. A shell such as /usr/sbin/nologin is intentionally non-interactive. For remote access, also check the SSH or other authentication policy; creating an account alone does not guarantee remote login.

Project-Group Access Does Not Work

Run id alice to confirm membership. If usermod -G was used without -a, existing supplementary memberships may have been replaced. Start a new login session and inspect the project directory's group ownership and permission bits.

The Username Already Exists

Run getent passwd proposedname. The name may exist locally or may be supplied by an external identity provider. Choose a unique name or follow the organization's centralized identity-management process.

UID or Group Assignments Are Unexpected

System allocation defaults differ. A matching private group may not be created, or the account may have been created as a system account. Inspect id and local account defaults. Specify a UID or GID only when policy requires it; changing identifiers later can require migrating ownership of existing files.

Account Lifecycle

Creation is only one part of account management. Related tasks include modifying properties, locking or disabling access, expiring accounts, and removing accounts. Locking an account generally prevents a selected authentication method while preserving its files and record; exact behavior depends on the authentication stack.

userdel removes the account record. Removing the record is separate from removing the user's home directory and files. Before deleting data, determine whether files exist elsewhere, whether the account owns scheduled jobs or services, and whether retention requirements apply. A command such as userdel -r may remove the home directory and associated local mail, but its exact behavior and risks should be checked against local policy.

Exam-Relevant Notes

• UID identifies a user numerically; GID identifies a group numerically.
• The primary group is not the same as supplementary groups.
• /etc/passwd commonly stores public account attributes; /etc/shadow normally stores protected password hashes and aging data.
• useradd -m requests home-directory creation, while distribution defaults may change behavior.
• usermod -aG group user appends a supplementary group; omitting -a can replace existing memberships.
• A service account should not receive an interactive shell, password, or sudo access unless a documented requirement exists.
• Deleting an account record does not necessarily delete the user's files unless a separate removal option is used.

For further practice, review administering groups, modifying file permissions, and the shadow file format.