Linux · users & permissions

usermod

change a user

usermod modifies an account that already exists. Its commonest use by far is adding a user to a group with -aG — and the commonest mistake is forgetting the a, which removes them from every other group.

-aG adds to a group. -G alone replaces the whole list. Always type the a.

Add to a group

-aG GROUP NAME

append, do not replace

Change shell

-s /bin/zsh

or nologin to block login

Lock

-L

-U unlocks

Takes effect

At next login

for group changes

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

root@netflow — bashpasswd

# usermod -aG docker asha

1# id asha

uid=1002(asha) gid=1002(asha) groups=1002(asha),998(docker)

2# usermod -s /usr/sbin/nologin olduser

3# usermod -L olduser

# passwd -S olduser

4olduser L 2026-08-11 0 99999 7 -1

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Added, and nothing lost

asha is now in docker as well as her own group. With -G and no -a, docker would have become her only extra group.

Taking away the shell

nologin as the shell means any login attempt is refused with a polite message.

Locking the password

-L puts a ! in front of the password hash, so no password can ever match.

L for locked

The status confirms it. The account and its files remain; it simply cannot be logged in to with a password.

Switches

A switch changes how the command behaves. These are the ones used day to day; man usermod lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-aG GROUPS: Append the user to these groups, keeping the existing ones.
-G GROUPS: Replace the supplementary group list entirely.
-s SHELL: Change the login shell.
-L: Lock the password. -U unlocks it.
-l NAME: Change the login name.
-d DIR -m: Change the home directory and move its contents.
-e DATE: Set the account’s expiry date.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

sudo usermod -aG sudo asha

Makes a user an administrator on Debian and Ubuntu. On Fedora the group is wheel.

sudo gpasswd -d asha docker

Removes a user from one group.

sudo usermod -l newname oldname

Renames an account.

sudo usermod -e 2026-12-31 contractor

Sets the date on which an account expires.

In cybersecurity

Adding someone to a group is granting them a privilege, and should be treated as one.

The missing -a

"usermod -G docker asha" silently removes asha from sudo and every other group. If that was the only administrator, nobody can fix it without rescue media.

Disable fully

Locking the password does not stop SSH key logins. For a departed user: lock it, expire it with -e 1, and set the shell to nologin.

Watch the admin groups

Changes to the membership of sudo, wheel and docker deserve logging and review; that is how privilege quietly grows.

Filed under

Users & permissions

Read alongside

useraddCreates a new user account: an entry in /etc/passwd, a group, and optionally a home directory.idPrints a user’s numeric id, primary group, and every group they belong to.