useraddCreate a user account
useradd creates a Linux account: a line in /etc/passwd and /etc/shadow, a private group, and (with -m) a home directory seeded from /etc/skel. It is the low-level tool every distro has, and its defaults are surprisingly bare, so you almost always pass options.
useradd [OPTIONS] LOGINA new engineer joins and needs a normal shell account with a home directory on devops-lab.
sudoCreating accounts edits /etc/passwd and /etc/shadow, which only root may write.
useradd reads its defaults from /etc/login.defs (UID_MIN 1000, HOME_MODE 0750, USERGROUPS_ENAB) and /etc/default/useradd (SHELL, SKEL). It locks the account databases, picks the next UID (the highest UID in use above UID_MIN plus one, or for -r the highest free ID below 1000) and appends a line to /etc/passwd (name:x:uid:gid:comment:home:shell) and /etc/shadow (name:!:days-since-1970:0:99999:7:::). The ! means no password is set yet, so password login is impossible until you run passwd. With USERGROUPS_ENAB it also creates a private group of the same name in /etc/group and /etc/gshadow and adds the user to each -G group. With -m it creates the home directory with mode 0750, copies /etc/skel (.bashrc, .profile) into it and chowns everything to the new UID. It never touches running processes; it only edits files.
useradd is a file editor: it reads the defaults, then writes one line to each account database and builds a home from /etc/skel.
Only root may write the account databases, so the command runs under sudo. useradd itself starts no daemon and talks to no service: it edits files.
-mCreate the home directory and copy /etc/skel into it-MDo not create a home directory (service accounts)-s SHELLLogin shell; /usr/sbin/nologin blocks interactive logins-G g1,g2Supplementary groups (must exist, comma separated)-g GROUPPrimary group instead of a new private group-u UIDPick the UID yourself (match UIDs across servers or NFS)-rSystem account: UID below 1000, no aging, no home unless -m-d DIRHome directory path (default /home/LOGIN)-c TEXTComment (GECOS) field, usually the full name-e YYYY-MM-DDDate the account expires (contractors)-k DIRUse a different skeleton directory than /etc/skel-DPrint (or with other options, change) the defaultssudo useradd priya on Ubuntu, then wondering why she has no home and a bare /bin/sh promptUbuntu's useradd defaults don't create a home and use /bin/sh. Those defaults differ by distro.
sudo useradd -m -s /bin/bash priya (or the interactive adduser priya on Debian/Ubuntu)sudo useradd -G sudo, docker priyaThe space ends the -G value: useradd gets the list 'sudo,' plus two names, docker and priya, and stops with a usage error.
sudo useradd -m -G sudo,docker priyaCreating the account and assuming the user can now log inuseradd leaves a ! in /etc/shadow. There is no password and no SSH key yet.
sudo passwd priya, or install ~priya/.ssh/authorized_keys with mode 600 owned by priyaRunning a service account as a normal login user with a shell and homeIf the service is compromised, the attacker gets an interactive shell and a writable home.
sudo useradd -r -s /usr/sbin/nologin -M -d /opt/app appsvcTry these on a Linux machine of your own. Each task has a hint and a solution.
Create a user dev1 with a home directory, bash as the shell and the comment 'Dev One'. Check the passwd entry.
Create a system user webapp that can't log in and has no home directory. What UID did it get?
Look at the defaults useradd will use on this machine, and the UID range for normal users.
Create user tester in the existing group adm as a supplementary group, then confirm both the private group and adm.
useraddCreate a user account
useradd creates a Linux account: a line in /etc/passwd and /etc/shadow, a private group, and (with -m) a home directory seeded from /etc/skel. It is the low-level tool every distro has, and its defaults are surprisingly bare, so you almost always pass options.
useradd [OPTIONS] LOGINA new engineer joins and needs a normal shell account with a home directory on devops-lab.
sudoCreating accounts edits /etc/passwd and /etc/shadow, which only root may write.
useradd reads its defaults from /etc/login.defs (UID_MIN 1000, HOME_MODE 0750, USERGROUPS_ENAB) and /etc/default/useradd (SHELL, SKEL). It locks the account databases, picks the next UID (the highest UID in use above UID_MIN plus one, or for -r the highest free ID below 1000) and appends a line to /etc/passwd (name:x:uid:gid:comment:home:shell) and /etc/shadow (name:!:days-since-1970:0:99999:7:::). The ! means no password is set yet, so password login is impossible until you run passwd. With USERGROUPS_ENAB it also creates a private group of the same name in /etc/group and /etc/gshadow and adds the user to each -G group. With -m it creates the home directory with mode 0750, copies /etc/skel (.bashrc, .profile) into it and chowns everything to the new UID. It never touches running processes; it only edits files.
useradd is a file editor: it reads the defaults, then writes one line to each account database and builds a home from /etc/skel.
Only root may write the account databases, so the command runs under sudo. useradd itself starts no daemon and talks to no service: it edits files.
-mCreate the home directory and copy /etc/skel into it-MDo not create a home directory (service accounts)-s SHELLLogin shell; /usr/sbin/nologin blocks interactive logins-G g1,g2Supplementary groups (must exist, comma separated)-g GROUPPrimary group instead of a new private group-u UIDPick the UID yourself (match UIDs across servers or NFS)-rSystem account: UID below 1000, no aging, no home unless -m-d DIRHome directory path (default /home/LOGIN)-c TEXTComment (GECOS) field, usually the full name-e YYYY-MM-DDDate the account expires (contractors)-k DIRUse a different skeleton directory than /etc/skel-DPrint (or with other options, change) the defaultssudo useradd priya on Ubuntu, then wondering why she has no home and a bare /bin/sh promptUbuntu's useradd defaults don't create a home and use /bin/sh. Those defaults differ by distro.
sudo useradd -m -s /bin/bash priya (or the interactive adduser priya on Debian/Ubuntu)sudo useradd -G sudo, docker priyaThe space ends the -G value: useradd gets the list 'sudo,' plus two names, docker and priya, and stops with a usage error.
sudo useradd -m -G sudo,docker priyaCreating the account and assuming the user can now log inuseradd leaves a ! in /etc/shadow. There is no password and no SSH key yet.
sudo passwd priya, or install ~priya/.ssh/authorized_keys with mode 600 owned by priyaRunning a service account as a normal login user with a shell and homeIf the service is compromised, the attacker gets an interactive shell and a writable home.
sudo useradd -r -s /usr/sbin/nologin -M -d /opt/app appsvcTry these on a Linux machine of your own. Each task has a hint and a solution.
Create a user dev1 with a home directory, bash as the shell and the comment 'Dev One'. Check the passwd entry.
Create a system user webapp that can't log in and has no home directory. What UID did it get?
Look at the defaults useradd will use on this machine, and the UID range for normal users.
Create user tester in the existing group adm as a supplementary group, then confirm both the private group and adm.