Linux User Account Creation and Management (LFCS)

Objective

This guide covers Linux user account management using standard administration commands. By the end, you will know how to:

• Create user accounts with useradd, including custom home directories and login shells
• Modify existing user properties with usermod
• Set and manage passwords with passwd
• Configure password and account expiry with chage
• Verify user information using id and system account files
• Delete users and clean up their home directories with userdel
• Understand the default user creation configuration in /etc/default/useradd and /etc/login.defs
• Apply these skills to LFCS and RHCSA exam tasks involving user management

User account management is one of the most fundamental Linux administration skills. Every service, application, and person on a Linux system operates as a user. Understanding how to create, configure, and manage these accounts correctly, and how to use the configuration files that control their defaults, is essential for anyone working toward LFCS or RHCSA certification.

How Linux User Accounts Work

Every user on a Linux system has a set of properties stored in the system account files. Understanding these files is as important as knowing the commands, because the commands simply read from and write to these files.

File	Contents	Readable by
/etc/passwd	Username, UID, GID, home directory, login shell. One line per user.	All users
/etc/shadow	Encrypted password hash, password expiry dates, account lock status	Root only
/etc/group	Group names, GIDs, and group membership lists	All users
/etc/default/useradd	Default values used by useradd: home directory base, shell, group, skeleton dir	All users (read), root (write)
/etc/login.defs	UID/GID ranges, password policy defaults, mailbox settings	All users (read), root (write)
/etc/skel/	Skeleton directory: files copied into every new user's home directory on creation	All users (read), root (write)

# Read a user entry from /etc/passwd
grep "^alice:" /etc/passwd

# Format: username:x:UID:GID:comment:home_directory:login_shell
# alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash
#   |   |  |    |       |           |            |
# name  |  UID  GID   GECOS      home dir      shell
#      'x' means password is in /etc/shadow

# View the shadow entry (requires root)
sudo grep "^alice:" /etc/shadow

# Format: username:hash:last_change:min:max:warn:inactive:expire
# alice:$6$...:19800:0:99999:7:::
#          |      |   |   |   |
#        hash  days  min max warn

Creating User Accounts with useradd

Basic useradd Syntax

# Create a minimal user (no home directory created by default on some systems)
useradd alice

# Create a user with a home directory and Bash shell (most common for interactive users)
useradd -m -s /bin/bash bob

# Verify the user was created
id alice
id bob

# View the new entries in /etc/passwd
grep "^alice:\|^bob:" /etc/passwd

Key useradd Options

Option	What It Does	Example
-m	Create the home directory if it doesn't exist	useradd -m alice
-d /path	Set a custom home directory path	useradd -m -d /data/alice alice
-s /bin/bash	Set the login shell	useradd -s /bin/bash alice
-u UID	Assign a specific UID	useradd -u 1500 alice
-g group	Set the primary group	useradd -g developers alice
-G group1,group2	Add the user to supplementary groups	useradd -G wheel,docker alice
-c "comment"	Set the GECOS comment field (full name, etc.)	useradd -c "Alice Smith" alice
-e YYYY-MM-DD	Set account expiry date	useradd -e 2026-12-31 alice
-r	Create a system account (UID below the regular user range, no home directory by default)	useradd -r svcaccount

Creating Users with All Common Options

# Create a fully configured interactive user account
useradd \
  -m \
  -d /home/alice \
  -s /bin/bash \
  -c "Alice Smith" \
  -G wheel,developers \
  alice

# Create a user with a custom home directory outside /home
useradd -m -d /srv/webapps/deploy -s /bin/bash -c "Deploy User" deploy

# Create a system service account (no login shell, no home directory)
useradd -r -s /sbin/nologin -c "Nginx Web Server" nginx

# Verify everything looks correct
id alice
grep "^alice:" /etc/passwd
ls -la /home/alice

Setting Passwords with passwd

# Set a password interactively (prompts for input)
passwd alice

# Root can change any user's password without knowing the current one
sudo passwd bob

# Lock a user account (prepends ! to the password hash in /etc/shadow)
passwd -l alice

# Unlock a locked account
passwd -u alice

# Force the user to change their password at next login
passwd -e alice

# Check the password status of an account
passwd -S alice

# Sample passwd -S output:
# alice PS 2026-06-15 0 99999 7 -1 (Password set, SHA512 crypt.)
#        |     |       |   |   |  |
#       PS=set date   min max warn inactive

Modifying Users with usermod

usermod uses mostly the same options as useradd but applies them to an existing account.

# Change a user's login shell
usermod -s /bin/bash alice

# Change a user's home directory (use -m to move existing files)
usermod -m -d /data/alice alice

# Change a user's full name (GECOS comment field)
usermod -c "Alice J. Smith" alice

# Add a user to a supplementary group
# Warning: -G replaces ALL supplementary groups. Use -aG to add without removing others.
usermod -aG docker alice
usermod -aG wheel alice

# Replace ALL supplementary groups with a new list
usermod -G developers,testers alice

# Change a user's primary group
usermod -g developers alice

# Change a user's login name
usermod -l alicejsmith alice

# Lock a user account
usermod -L alice

# Unlock a user account
usermod -U alice

# Set an account expiry date
usermod -e 2026-12-31 alice

# Remove account expiry (set expiry to empty)
usermod -e "" alice

The most important flag to remember: always use -aG (append to groups), not just -G, when adding a user to a group. Using -G alone replaces all existing supplementary group memberships.

Managing Password and Account Expiry with chage

chage (change age) manages the password aging and account expiry settings stored in /etc/shadow.

# View current expiry settings for a user
chage -l alice

# Sample output:
# Last password change                    : Jun 15, 2026
# Password expires                        : never
# Password inactive                       : never
# Account expires                         : never
# Minimum number of days between password change : 0
# Maximum number of days between password change : 99999
# Number of days of warning before password expires : 7

Option	What It Controls	Example
-l	List current expiry information	chage -l alice
-E YYYY-MM-DD	Account expiry date (the account is locked after this date)	chage -E 2026-12-31 alice
-M days	Maximum days before password must be changed	chage -M 90 alice
-m days	Minimum days between password changes	chage -m 7 alice
-W days	Days before expiry to warn user	chage -W 14 alice
-I days	Days after password expires before account is locked	chage -I 30 alice
-d 0	Force password change at next login	chage -d 0 alice

# Configure a complete password policy for a user
chage -M 90 -m 7 -W 14 -I 30 alice

# Force a password change at next login
chage -d 0 alice

# Set an account to expire at the end of a contract period
chage -E 2026-12-31 alice

# Remove account expiry
chage -E -1 alice

# Verify all settings look correct
chage -l alice

Verifying User Information

# Display UID, GID, and all group memberships
id alice

# Sample output:
# uid=1001(alice) gid=1001(alice) groups=1001(alice),10(wheel),995(docker)

# Show only the username
id -un alice

# Show only the UID
id -u alice

# Show all groups the user belongs to
id -G alice     # numeric GIDs
id -Gn alice    # group names

# View the user's entry in /etc/passwd directly
grep "^alice:" /etc/passwd

# View current login sessions
who
w

# Check when a user last logged in
last alice

# Verify the home directory was created with correct ownership
ls -la /home/alice

Deleting Users with userdel

# Delete a user account (keeps the home directory)
userdel alice

# Delete a user AND remove their home directory and mail spool
userdel -r bob

# Check that the user no longer exists
id alice   # should return: no such user
grep "^alice:" /etc/passwd   # should return nothing

# Find any files still owned by the deleted user's UID
# Useful for cleaning up after userdel without -r
find / -uid 1001 2>/dev/null

Using userdel without -r leaves the home directory in place. This is sometimes intentional (preserving files for handover) and sometimes an oversight. Always confirm whether you need to remove the home directory as part of the deletion.

Understanding Default User Creation Settings

# View defaults used by useradd when options are not specified
useradd -D

# Sample output:
# GROUP=100
# HOME=/home
# INACTIVE=-1
# EXPIRE=
# SHELL=/bin/bash
# SKEL=/etc/skel
# CREATE_MAIL_SPOOL=no

# These defaults are stored in /etc/default/useradd
cat /etc/default/useradd

# System-wide password and UID policy is in /etc/login.defs
grep -E "^(UID_MIN|UID_MAX|GID_MIN|GID_MAX|PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_WARN_AGE)" \
  /etc/login.defs

# The skeleton directory contains files copied to every new home directory
ls -la /etc/skel/

Practical Examples: Complete User Setup Workflows

Creating a Standard Interactive User

# 1. Create the account
useradd -m -s /bin/bash -c "Carol Jones" carol

# 2. Set an initial password
passwd carol

# 3. Force password change at first login
chage -d 0 carol

# 4. Set password expiry policy (90 day max, 7 day min, 14 day warning)
chage -M 90 -m 7 -W 14 carol

# 5. Add to necessary groups
usermod -aG wheel carol

# 6. Verify the complete setup
id carol
chage -l carol
ls -la /home/carol

Creating a Service Account

# Service accounts should not have a login shell or interactive home directory
useradd -r -s /sbin/nologin -c "Application Service Account" appservice

# Verify it cannot be used for interactive login
id appservice
grep "^appservice:" /etc/passwd

# The shell /sbin/nologin prints a message and exits if someone tries to log in
# This is the correct shell for service accounts

Creating a Temporary User with Expiry

# Create a contractor account that expires automatically
useradd -m -s /bin/bash -c "Contractor Account" -e 2026-12-31 contractor

# Set initial password
passwd contractor

# Verify the expiry date is set
chage -l contractor

# When the expiry date passes, the account is automatically locked
# The user cannot log in even with the correct password

Common Mistakes

• Using -G instead of -aG with usermod to add a group. usermod -G docker alice removes alice from ALL existing supplementary groups and adds only docker. usermod -aG docker alice appends docker to her existing groups.
  • Always use -aG when adding a user to a group unless you specifically want to replace all group memberships
• Creating interactive users without -m. On some distributions useradd does not create a home directory by default. Without -m the user exists but has no home directory, which causes login problems.
  • Always use useradd -m for users who need to log in interactively
• Forgetting to set a password after useradd. A newly created account has no password set (or a locked password on some systems). The user cannot log in until a password is assigned with passwd.
  • Run passwd username immediately after useradd for interactive accounts
• Not specifying /sbin/nologin for service accounts. A service account with /bin/bash as its shell can potentially be used for interactive login if its password is known or cracked. Service accounts should always use /sbin/nologin or /bin/false.
  • Check all service accounts with: grep -v "nologin\|false" /etc/passwd and verify each non-nologin account genuinely needs interactive access
• Confusing chage -E (account expiry) with chage -M (password expiry). -E sets the date after which the account itself is locked. -M sets the maximum number of days a password is valid before it must be changed. These are independent settings that behave differently.
  • Use chage -l username to see both clearly after making changes

Quick Reference

Task	Command
Create user with home and bash shell	useradd -m -s /bin/bash username
Set user password	passwd username
Force password change at next login	chage -d 0 username
Add user to a group without removing others	usermod -aG groupname username
Change login shell	usermod -s /bin/bash username
View UID, GID, and group memberships	id username
View password and expiry settings	chage -l username
Set account expiry date	chage -E YYYY-MM-DD username
Set max password age	chage -M 90 username
Lock a user account	usermod -L username or passwd -l username
Unlock a user account	usermod -U username or passwd -u username
Delete user and home directory	userdel -r username
View useradd defaults	useradd -D

User Account Management and the LFCS Exam

User account creation and management is a direct LFCS exam objective. Exam tasks in this area typically require:

• Creating a user with specific properties: custom home directory, specific shell, GECOS comment, group memberships
• Setting a password and configuring password expiry policy with chage
• Modifying an existing account: adding to a group, changing the shell, setting an expiry date
• Verifying configuration using id, chage -l, and grep against /etc/passwd
• Locking or deleting accounts

The most common exam mistake is using usermod -G instead of usermod -aG when adding a user to a group, which removes all existing group memberships. Always append with -aG unless the task specifically says to replace group memberships.

Conclusion

User account management is foundational Linux administration. The four core commands cover the full lifecycle:

• useradd: create accounts with the right properties from the start. Use -m for home directories, -s for shells, -G for groups at creation time.
• passwd: set passwords and manage lock status. Always set a password immediately after creating an interactive account.
• usermod: change existing account properties. Always use -aG not -G when adding to groups.
• chage: manage password and account expiry. Use -l to verify all expiry settings after making changes.
• userdel -r: remove accounts and their home directories when they are no longer needed.

Understand /etc/passwd, /etc/shadow, and /etc/group as the source of truth for user configuration. The commands modify these files. Reading the files directly with grep is the fastest way to verify that your commands did what you intended.

Start the User Account Creation lab at LinuxCert.Guru → https://linuxcert.guru/lfcs/?name=lfcs-user-account-creation