Users and groups: useradd, passwd, chage and the account files

Do this lab on rocky01 as student, who has sudo through the wheel group. Later lessons use these exact names and numbers (Lesson 16 gives webteam sudo rights, Lessons 17 to 19 build a shared folder for it), so type them as shown. Step 9 repeats the important part on ubu01.

1Look at your own account first

Run this:

id student
getent passwd student
getent group wheel

You should see something like this:

uid=1000(student) gid=1000(student) groups=1000(student),10(wheel)
student:x:1000:1000:student:/home/student:/bin/bash
wheel:x:10:student

id shows the numbers the kernel uses. getent reads the account databases the same way the system does, so it also finds users that come from a directory such as AD, which a plain grep /etc/passwd would miss. The installer put student in wheel because you ticked “Make this user administrator”.

✅ Checkpoint: student has UID 1000 and is a member of wheel.

2Read the defaults useradd will use

Run this:

grep -E '^(SYS_)?(UID|GID)_(MIN|MAX)' /etc/login.defs
useradd -D

You should see something like this:

UID_MIN                  1000
UID_MAX                 60000
SYS_UID_MIN               201
SYS_UID_MAX               999
GID_MIN                  1000
GID_MAX                 60000
SYS_GID_MIN               201
SYS_GID_MAX               999
GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes
LOG_INIT=yes

People get 1000 to 60000 and useradd -r picks system accounts from 201 to 999, counting down from the top. useradd -D shows the rest of the defaults, including the bash shell. On ubu01 the SYS_ lines are commented out (the built-in defaults apply) and useradd -D says SHELL=/bin/sh.

✅ Checkpoint: You can name the first UID a new human user will get on rocky01.

3Create the webteam group with a fixed GID

Run this:

sudo groupadd -g 2001 webteam
getent group webteam

You should see this:

webteam:x:2001:

A fixed GID matters as soon as more than one server shares files, for example over NFS in Lesson 47, because the number travels with the file and must mean the same group everywhere. 2001 sits safely above the range useradd hands out for private groups on a small lab.

✅ Checkpoint: getent shows webteam with GID 2001 and no members yet.

4Create priya and arjun

Run this:

sudo useradd -m -s /bin/bash -u 1001 -c "Priya Nair" -G webteam priya
sudo useradd -m -s /bin/bash -u 1002 -c "Arjun Rao" -G webteam arjun
id priya; id arjun
getent group webteam
sudo stat -c '%A %U %G %n' /home/priya

You should see something like this:

uid=1001(priya) gid=1001(priya) groups=1001(priya),2001(webteam)
uid=1002(arjun) gid=1002(arjun) groups=1002(arjun),2001(webteam)
webteam:x:2001:priya,arjun
drwx------ priya priya /home/priya

-m makes the home folder, -s sets the shell, -u fixes the UID, -c is the full name and -G adds supplementary groups. Each user also got a private primary group with the same number. Rocky makes home folders mode 700 (only the owner gets in), while on ubu01 the same folder is drwxr-x--- (mode 750).

Try it yourself: build a create-user command (with optional sudo) in the Command Builder.

✅ Checkpoint: priya is UID 1001, arjun is UID 1002 and both appear on the webteam line.

5Set a password and read /etc/shadow

Run this, and type a password for priya twice when asked:

sudo passwd priya
sudo grep -E '^(priya|arjun):' /etc/shadow | awk -F: '{print $1, substr($2,1,4) "...", $3, $4, $5, $6}'

You should see something like this:

New password:
Retype new password:
passwd: password updated successfully
priya $6$r... 20753 0 99999 7
arjun !... 20753 0 99999 7

The awk from Lesson 14 hides the hash and prints the useful fields. 20753 is the date of the last change counted in days since 1 January 1970 (27 October 2026), then come the minimum days (0), maximum days (99999, never expires) and warning days (7). arjun still has !, so he can’t log in with a password yet. The first characters of the hash name the algorithm: $6$ is SHA-512 and $y$ is yescrypt, which ubu01 uses.

Rocky Linux and RHEL 10 take passwd from the same shadow-utils package as Ubuntu, so the messages match. On RHEL 9 and older, passwd was a separate package and says “all authentication tokens updated successfully” instead.

✅ Checkpoint: priya has a hash in field 2 and arjun still shows !.

6Give arjun a password policy

Run this:

sudo passwd arjun
sudo chage -M 90 -m 1 -W 14 arjun
sudo chage -d 0 arjun
sudo chage -l arjun

You should see this (after the passwd prompts):

Last password change					: password must be changed
Password expires					: password must be changed
Password inactive					: password must be changed
Account expires						: never
Minimum number of days between password change		: 1
Maximum number of days between password change		: 90
Number of days of warning before password expires	: 14

-M 90 makes the password last 90 days, -m 1 stops him changing it again within a day (so he can’t cycle back to an old one), and -W 14 warns him two weeks ahead. -d 0 sets the last change to day zero, which forces a new password at his next login. That’s how you hand over a temporary password safely.

Try it yourself: build a chage command for password ageing in the Command Builder.

✅ Checkpoint: chage -l shows 1, 90 and 14, and “password must be changed”.

7Lock an account and open it again

Run this:

sudo usermod -L priya
sudo passwd -S priya
sudo usermod -U priya
sudo passwd -S priya

You should see something like this:

priya L 2026-10-27 0 99999 7 -1
priya P 2026-10-27 0 99999 7 -1

-L puts a ! in front of the hash so no password can match, and passwd -S shows L for locked or P for a usable password. A locked password doesn’t stop SSH key logins, so when someone leaves, also expire the account with sudo chage -E 0 priya (or set the shell to /sbin/nologin), then remove keys and sudo rights.

Try it yourself: build the commands to lock a user and let them back in, in the Command Builder.

✅ Checkpoint: passwd -S showed L, then P again after usermod -U.

8Create the appsvc service account

Run this:

sudo useradd -r -s /sbin/nologin -c "SaatShop app service" appsvc
getent passwd appsvc
sudo su - appsvc

You should see something like this:

appsvc:x:991:991:SaatShop app service:/home/appsvc:/sbin/nologin
su: warning: cannot change directory to /home/appsvc: No such file or directory
This account is currently not available.

-r takes a UID from the system range (yours may be a little different), creates no home folder (hence the warning) and sets no password ageing. The nologin shell prints that message and exits, so even someone with the password, or root using su, can’t get an interactive shell as appsvc. A service started by systemd as User=appsvc still runs fine, which you’ll do in Lesson 27.

✅ Checkpoint: appsvc has a UID below 1000 and su refuses to give a shell.

9Do the same on ubu01, and meet adduser

On ubu01, run this:

sudo groupadd -g 2001 webteam
sudo useradd -m -s /bin/bash -u 1001 -c "Priya Nair" -G webteam priya
sudo useradd -m -s /bin/bash -u 1002 -c "Arjun Rao" -G webteam arjun
sudo useradd -r -s /usr/sbin/nologin -c "SaatShop app service" appsvc
getent group webteam sudo

You should see something like this:

webteam:x:2001:priya,arjun
sudo:x:27:student

The same commands work because you named every option. Ubuntu’s admin group is sudo, not wheel. Ubuntu also ships adduser, a friendlier Perl wrapper that asks for a password and the full name, creates a home with mode 750 and sets bash, so sudo adduser kiran is one interactive step.

Use it by hand if you like, but keep useradd with explicit options in scripts, because adduser doesn’t exist on Rocky.

✅ Checkpoint: On ubu01, webteam has GID 2001 with priya and arjun, and priya and arjun have the same UIDs as on rocky01.