Account management: useradd, passwd, usermod and userdel

You run an account’s whole life cycle: create an account for a new employee, give it a password and password-age rules, add it to the team’s group; from the HR list you find the former employee whose account is still open, lock it first, archive the files, delete the account and hand over the files left without an owner.

Level 101 · 50 min

Two e-mails came from HR on Monday morning. The first: "Mert Yılmaz starts in the support team today." The second: "We put the list of leavers in /srv/hr/leavers.txt. Is anyone’s account still open?"

These are jobs IT teams do every week, and they matter a lot for security. Forgotten accounts of people who left are one of attackers’ favourite ways in, because nobody watches them. So are accounts whose password never changes.

In this lesson you use the commands that create an account (useradd), set its password (passwd), set password rules (chage), change it (usermod) and delete it (userdel). The first steps are guided; for the leaver you find the way yourself.

What you will do in this lesson

Create the account: useradd -m
Set a password: passwd
Change it at first login: chage -d 0
Password age: chage -M and -W
Add them to their team: groupadd, usermod -aG
Whose account is still open?
Lock it first
Archive and delete
Files left without an owner
Short quiz

Skills you will earn

Creating an account with a home directory (useradd -m -s -c)
Setting a password and reading its hash in shadow
Forcing a password change at first login (chage -d 0)
Setting password-age rules (chage -M, -W)
Creating a group (groupadd)
Adding a user to a group safely (usermod -aG)
Looking up accounts with getent
Locking an account before deleting it (usermod -L, passwd -S)
Closing a leaver’s account (userdel -r)
Archiving files (tar czf)
Finding and handing over ownerless files (find -nouser)

← Quick task: lock down a team folder left wide open · Linux quick start · Borrowing admin rights with sudo →

Start for free