Linux · users & permissions

useradd

create a user

useradd adds an account to the system. It is deliberately minimal: without -m no home directory is made, and the account has no password until passwd sets one.

useradd -m -s /bin/bash name, then passwd name — two steps to a usable account.

Home directory

-m

not created without it

Shell

-s /bin/bash

the default may be /bin/sh

Extra groups

-G sudo,docker

besides the primary one

Then

passwd NAME

the account starts locked

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

root@netflow — bashpasswd

# useradd -m -s /bin/bash -c "Asha Verma" asha

1# passwd asha

New password:

passwd: password updated successfully

2# getent passwd asha

asha:x:1002:1002:Asha Verma:/home/asha:/bin/bash

3# ls -ld /home/asha

drwxr-x--- 2 asha asha 4096 Sep 30 11:20 /home/asha

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Give it a password

useradd printed nothing — it worked — but the account cannot log in until a password or an SSH key is set.

The new account record

Name, an x in place of the password, user id, group id, the comment, the home directory and the login shell.

The home directory

Created by -m and owned by the new user. Mode drwxr-x--- keeps other users out.

Switches

A switch changes how the command behaves. These are the ones used day to day; man useradd lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-m: Create the home directory.
-s SHELL: Set the login shell.
-G GROUPS: Supplementary groups, comma-separated.
-c COMMENT: A description, usually the full name.
-d DIR: Use this as the home directory.
-r: Create a system account, with a low id.
-u UID: Use this user id.
-e DATE: Set the date the account expires.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo useradd -m -G sudo -s /bin/bash asha

Creates an administrator who can use sudo.

sudo useradd -r -s /usr/sbin/nologin appsvc

Creates a system account for a service: low id, no login.

sudo adduser asha

On Debian and Ubuntu, a friendlier tool that asks questions and does every step.

useradd -D

Shows the defaults used when no switch is given.

In cybersecurity

Every account is another way in, so create them on purpose and keep count.

One person, one account

Shared accounts make it impossible to say who did what, and cannot be taken away from one person without affecting the rest.

Services get no shell

An account that exists only to run a program should have /usr/sbin/nologin as its shell, so nobody can log in as it.

New accounts are a red flag

An account nobody remembers creating — especially one in the sudo group — is a classic sign of a break-in. Review /etc/passwd regularly.

Filed under

Users & permissions

Read alongside

passwdChanges a password — your own, or as root anyone’s — and locks or unlocks accounts.usermodChanges an existing account: its groups, shell, home directory, name, or whether it is locked.