Documentation
System StatusPortal Login

Basic Linux User Management

This article describes the options for basic Linux® server user management. It shows you how to add, remove, lock, expire, and modify users on a Linux server.

Prerequisites

You need to have the following prerequisites:

Log in to your server by using SSH and then complete the steps in the following sections to perform the actions:

Add a basic SSH user

Use the following steps to add a basic user to your Linux server with default settings:

  1. Run the following command to create the user:

      useradd <user>
    :~# adduser testing
Adding user `testing' ...
Adding new group `testing' (1001) ...
Adding new user `testing' (1001) with group `testing' ...
Creating home directory `/home/testing' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for testing
Enter the new value, or press ENTER for the default
        Full Name []: test
        Room Number []:
        Work Phone []:
        Home Phone []:
        Other []:
Is the information correct? [Y/n] y
:~#

  2. Set the password for the user:

     passwd <some-secure-password>

Add a user with flags

You can use the following common flags with the useradd command to specify the new user's configuration:

  • -G, --groups <group_names>: to add the new account to groups
  • -d, --home-dir <home_directory>: to set home directory of the new account
  • -s, --shell <shell_name>: to set the login shell of the new account

For example, you can create a user and specify the home directory, the login shell, and also add the user to a supplemental group, as shown in the following example:

   useradd -d /home/nonDefaultHome/ -s /bin/bash -G developers <newuser>

This command creates a new user with a home directory of /home/nonDefaultHome/ and the /bin/bash/
shell. The command also adds this user to the group developers.

You can see other options for customizing the new user by using the following command:

~]# useradd -h
Usage: useradd [options] LOGIN
       useradd -D
       useradd -D [options]

Options:
      --badname                 do not check for bad names
  -b, --base-dir BASE_DIR       base directory for the home directory of the
                                new account
      --btrfs-subvolume-home    use BTRFS subvolume for home directory
  -c, --comment COMMENT         GECOS field of the new account
  -d, --home-dir HOME_DIR       home directory of the new account
  -D, --defaults                print or change default useradd configuration
  -e, --expiredate EXPIRE_DATE  expiration date of the new account
  -f, --inactive INACTIVE       password inactivity period of the new account
  -g, --gid GROUP               name or ID of the primary group of the new
                                account
  -G, --groups GROUPS           list of supplementary groups of the new
                                account
  -h, --help                    display this help message and exit
  -k, --skel SKEL_DIR           use this alternative skeleton directory
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -l, --no-log-init             do not add the user to the lastlog and
                                faillog databases
  -m, --create-home             create the user's home directory
  -M, --no-create-home          do not create the user's home directory
  -N, --no-user-group           do not create a group with the same name as
                                the user
  -o, --non-unique              allow to create users with duplicate
                                (non-unique) UID
  -p, --password PASSWORD       encrypted password of the new account
  -r, --system                  create a system account
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -s, --shell SHELL             login shell of the new account
  -u, --uid UID                 user ID of the new account
  -U, --user-group              create a group with the same name as the user
  -Z, --selinux-user SEUSER     use a specific SEUSER for the SELinux user mapping


:~# useradd -h
Usage: useradd [options] LOGIN
       useradd -D
       useradd -D [options]

Options:
      --badnames                do not check for bad names
  -b, --base-dir BASE_DIR       base directory for the home directory of the
                                new account
      --btrfs-subvolume-home    use BTRFS subvolume for home directory
  -c, --comment COMMENT         GECOS field of the new account
  -d, --home-dir HOME_DIR       home directory of the new account
  -D, --defaults                print or change default useradd configuration
  -e, --expiredate EXPIRE_DATE  expiration date of the new account
  -f, --inactive INACTIVE       password inactivity period of the new account
  -g, --gid GROUP               name or ID of the primary group of the new
                                account
  -G, --groups GROUPS           list of supplementary groups of the new
                                account
  -h, --help                    display this help message and exit
  -k, --skel SKEL_DIR           use this alternative skeleton directory
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -l, --no-log-init             do not add the user to the lastlog and
                                faillog databases
  -m, --create-home             create the user's home directory
  -M, --no-create-home          do not create the user's home directory
  -N, --no-user-group           do not create a group with the same name as
                                the user
  -o, --non-unique              allow to create users with duplicate
                                (non-unique) UID
  -p, --password PASSWORD       encrypted password of the new account
  -r, --system                  create a system account
  -R, --root CHROOT_DIR         directory to chroot into
  -P, --prefix PREFIX_DIR       prefix directory where are located the /etc/* files
  -s, --shell SHELL             login shell of the new account
  -u, --uid UID                 user ID of the new account
  -U, --user-group              create a group with the same name as the user
  -Z, --selinux-user SEUSER     use a specific SEUSER for the SELinux user mapping
      --extrausers              Use the extra users database




:~# adduser --help
adduser [--home DIR] [--shell SHELL] [--no-create-home] [--uid ID]
[--firstuid ID] [--lastuid ID] [--gecos GECOS] [--ingroup GROUP | --gid ID]
[--disabled-password] [--disabled-login] [--add_extra_groups]
[--encrypt-home] USER
   Add a normal user

adduser --system [--home DIR] [--shell SHELL] [--no-create-home] [--uid ID]
[--gecos GECOS] [--group | --ingroup GROUP | --gid ID] [--disabled-password]
[--disabled-login] [--add_extra_groups] USER
   Add a system user

adduser --group [--gid ID] GROUP
addgroup [--gid ID] GROUP
   Add a user group

addgroup --system [--gid ID] GROUP
   Add a system group

adduser USER GROUP
   Add an existing user to an existing group

general options:
  --quiet | -q      don't give process information to stdout
  --force-badname   allow usernames which do not match the
                    NAME_REGEX[_SYSTEM] configuration variable
  --extrausers      uses extra users as the database
  --help | -h       usage message
  --version | -v    version number and copyright
  --conf | -c FILE  use FILE as configuration file

Locking or expiring users

If you need to disable a user's access to your server, you can either expire or lock the Linux user account.

Lock or unlock a user

Locking a user changes the user's password to an unreadable string, which prevents the user from logging in by using password authentication. Use the following command to lock a Linux user account:

   passwd -l <user>

You can verify the user was successfully locked by using the following command:

   passwd -S <user>

If the user was successfully locked, the following message displays:

 <user> LK <date> 0 99999 7 -1 (Password locked.)

If you need to unlock the user, use the following command:

 passwd -u <user>

You can verify the user is unlocked with the following command:

 passwd -S <user>

If the command was successful, the following message displays:

 <user> PS <date> 0 99999 7 -1 (Password set, SHA512 crypt.)

Expire and unexpired a user

While locking a user disables password access, this option does not disable other forms of authentication such as SSH Key authentication. To disable a user's access completely, expire the account by using the following command:

  usermod -e $(date '+1970-01-01') <user>
📘

This command expires the user as of the date January 1, 1970. You can also set the expiration date to the current date by replacing the date section with: $(date '+%Y-%m-%d')

You can verify the user was successfully expired by running the following command:

   chage -l <user>

The following output displays for the user:

Last password change                                    : Jun 22, 2026
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : Jul 22, 2026
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

If you need to unexpired the user on the server, run the following command:

   usermod -e -1 <user>

In order to verify the user has been unexpired, run the following command:

   chage -l <user>

The following output displays for the user:

Last password change                                    : Jun 22, 2026
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

Delete a user

If you are certain that you no longer need a Linux user, you can delete the user from the server.

📘

While this does not delete the user's home directory, this can cause issues with ownership or other permissions on the server. Before deleting the user, ensure removing the user does not cause applications on your server to break.

To delete a user on your server, run the following command:

   userdel <user>

You can verify the user has been deleted with the following command:

   getent passwd <user>

If the user was successfully deleted, you should not receive any output as the user does not exist within the /etc/passwd file.

Updated 5 days ago

Did this page help you?