Beginner · Permissions, users and sudo · topic 8 of 57 · 30 min
Creating and managing users and passwords
Explanation
Creating users
# useradd asha
# passwd asha
Changing password for user asha.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
# useradd -u 1500 -c "Ravi Kumar" -s /bin/bash -G wheel ravi
# id ravi
uid=1500(ravi) gid=1500(ravi) groups=1500(ravi),10(wheel)Useful useradd options: -u UID, -g primary group, -G extra groups (comma-separated), -c comment, -d home directory, -s shell, -m create the home (already the default on RHEL), -M do not create a home. The new home is filled with copies of the files in /etc/skel, so put a standard .bashrc there for every new user.
Defaults come from /etc/login.defs (UID ranges, password ageing defaults, whether to create the home) and /etc/default/useradd (default shell, skel directory). useradd -D shows the second one.
Changing users: usermod
# usermod -aG developers asha # ADD asha to developers, keep her other groups
# usermod -s /sbin/nologin backup # change the shell
# usermod -L ravi # lock the password (puts ! in /etc/shadow)
# usermod -U ravi # unlock
# usermod -c "Asha Rao, DBA" asha # change the commentRemoving users and groups
# userdel ravi # remove the account, keep /home/ravi
# userdel -r ravi # remove the account AND its home directory and mail spool
# groupadd -g 2000 finance
# groupmod -n accounts finance # rename the group
# groupdel accountsIf you delete a user but keep the files, the files still belong to the old UID number. ls -l will show a number instead of a name. If a new user later gets that same UID, they silently own the old files. Find such files with find / -nouser.
Password ageing with chage
# chage -l asha
Last password change : Oct 19, 2026
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires: 7
# chage -M 90 -W 7 asha # must change every 90 days, warn 7 days before
# chage -d 0 asha # force a password change at next login
# chage -E 2026-12-31 intern1 # account stops working after 31 Dec 2026| chage option | Meaning | /etc/shadow field |
|---|---|---|
| -d | Date of last change (0 = must change now) | 3 |
| -m | Minimum days between changes | 4 |
| -M | Maximum days a password is valid | 5 |
| -W | Days of warning before expiry | 6 |
| -I | Inactive days allowed after expiry | 7 |
| -E | Account expiry date (YYYY-MM-DD, or -1 to remove) | 8 |
To change the defaults for future users, edit PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE in /etc/login.defs. These only affect users created afterwards; existing users need chage.
Common mistakes
- Forgetting -a with usermod -G (see the warning above).
- Setting PASS_MAX_DAYS in /etc/login.defs and expecting existing users to change. Use chage for them.
- Putting a password on the command line in scripts. It ends up in the shell history. If you must script it, read it from a protected file: echo "asha:NewPass" | chpasswd from a root-only script is the usual way.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Creating and managing users and passwords · 1/7
useradd asha
passwd ashauseradd creates a user. On RHEL it also makes the home folder and a private group.
Prefer a video by a teacher? Find free videos on “rhcsa useradd usermod chage password aging tutorial” on YouTube ↗
In real life: Interns joining a Hyderabad IT services company
Every June, 40 interns join a support team in Hyderabad for six months. The admin creates their accounts with an expiry date at the end of the internship, puts them in a "support" group, and forces each to set their own password at first login. When an intern leaves early, usermod -L locks the account at once, and userdel -r runs after the data is checked.
# groupadd support
# useradd -G support -c "Intern 2026" -e 2026-12-31 intern07
# echo 'intern07:Welcome@2026' | chpasswd
# chage -d 0 intern07
# chage -l intern07 | head -4
Last password change : password must be changed
Password expires : password must be changed
Password inactive : password must be changed
Account expires : Dec 31, 2026Practice (0/3 done)
Which command adds asha to the group devops without removing her other groups?
What does chage -d 0 ravi do?
In your lab, create the group "sysadmins" with GID 3000, the user "harry" with UID 3001, comment "Harry Admin", member of sysadmins, whose password must be changed every 60 days and who must set a new password at first login.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- File permissions: rwx, chmod and chownPermissions, users and sudo · same module
- umask and the special bits: SUID, SGID and stickyPermissions, users and sudo · same module
- Linux security basicsCyber Security: from zero to SOC analyst · Systems and cryptography
- Users, groups and permissionsDevOps: Git, Docker, Kubernetes and CI/CD · Linux for DevOps
- SSH: keys, ssh-copy-id and hardening sshdSELinux and SSH
- Storing passwords safelyBackend Development · Authentication and authorization
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Where do new home directories get their starting files from?
Answer: /etc/skel
useradd copies /etc/skel into the new home.
Which removes the user and the home directory?
Answer: userdel -r ravi
-r removes the home and mail spool too.
Which chage option sets the date an account stops working?
Answer: -E
-E sets the account expiry date.
You change PASS_MAX_DAYS in /etc/login.defs to 90. Who is affected?
Answer: Only users created after the change
login.defs gives defaults to new accounts; existing ones keep their values.
What does usermod -L do?
Answer: Locks the password so password login fails
It puts ! in front of the hash in /etc/shadow.
What is the 7th field of an /etc/passwd line?Related
Whose password does sudo ask for by default?Related
"Failed password for invalid user oracle from 203.0.113.9" means…Related
Answer: Someone tried a username that does not exist on this server
"invalid user" means the account is not on the system: typical of automated guessing.
Which command adds user ravi to the docker group without removing his other groups?Related
Answer: sudo usermod -aG docker ravi
-a appends. Without it, -G replaces all extra groups.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 4 more topics in “Permissions, users and sudo” before its exam: File permissions: rwx, chmod and chown, umask and the special bits: SUID, SGID and sticky, Access control lists (ACLs), sudo and the sudoers file.
- Module 2 exam: Permissions, users and sudo · 14 questions · 25 min, without help. 6 topics of this module still to finish first.
- Then the next module, Processes, services and logs. 57 topics left in the course before the final exam.