The Ultimate Guide to User and Group Management in Ubuntu/Debian Linux

By Calabastro

In the Linux ecosystem, permissions are everything. Unlike some other operating systems where “admin” is a status you earn after a long tenure, in Linux, it’s strictly about group membership and ownership. Whether you are setting up a web server, a personal workstation, or a container environment, knowing how to manipulate users and groups is not just useful—it’s essential.

In this guide, we will cover everything from the basics of adduser and useradd to the nitty-gritty of group manipulation using command-line tools native to Ubuntu and Debian.

Prerequisites

To follow along with these examples, you need a terminal (bash) and root privileges.

Root Access: Commands requiring system changes usually need sudo.
The OS: Debian or Ubuntu derivatives (Linux Mint, Pop!_OS, etc.).

Part 1: The User Concept in Linux

A user account represents an individual or a service that needs to access the system. Every file and process on Linux belongs to a specific User ID (UID) and Group ID (GID).

Creating Users

On Debian/Ubuntu systems, you have two main tools for this: useradd and adduser. While they do similar things, they behave very differently.

1. The Interactive Way: `adduser`

This is the recommended way for human users on Debian/Ubuntu. It is a user-friendly Perl script that prompts for information, creates the home directory automatically, and copies skeleton files (like .bashrc).

Command:

bash

sudo adduser newuser

Example Output:

Adding user `newuser' ...

Adding new group `newuser' (1001) ...

Adding new user `newuser' (1001) with group `newuser' ...

Creating home directory `/home/newuser' ...

Copying files from `/etc/skel' ...

Enter new UNIX password:

Retype new UNIX password:

passwd: password updated successfully

Changing the user information for newuser

Enter the new value, or press ENTER for the default

Full Name []: New User

Room Number []:

Work Phone []:

Home Phone []:

Other []:

Is the information correct? [Y/n] Y

2. The Non-Interactive/Scriptable Way: `useradd`

This is the low-level binary command. It does not prompt for anything and does not create home directories by default. This makes it excellent for automation scripts but dangerous if you forget a flag.

Command:

bash

sudo useradd -m -s /bin/bash -c "John Doe" john

Flag Breakdown:

-m: Create the home directory (/home/john).
-s /bin/bash: Set the default shell to Bash (default might be /bin/sh).
-c "John Doe": Add a comment/full name.

Part 2: Creating Users with Groups

Sometimes you want to assign a user to a specific group immediately upon creation, or set their primary group identity.

Setting the Primary Group (-g)

Every user must belong to one primary group. By default, useradd creates a private group with the same name as the user. You can change this at creation time.

Scenario: Create a user named webadmin whose primary group is www-data.

bash

sudo useradd -m -g www-data -s /bin/bash webadmin

Setting Supplementary Groups (-G)

You can assign the user to secondary groups (e.g., sudo, docker) at the moment of creation. Note the capital -G.

Scenario: Create a user devops who is in both the sudo and docker groups immediately.

bash

sudo useradd -m -s /bin/bash -G sudo,docker devops

Part 3: Managing Users

Once a user exists, you need to manage them.

Changing Passwords

Regardless of how the user was created, use passwd to set or change passwords.

bash

sudo passwd newuser

Force the user to change their password on next login (good for temporary accounts)

sudo passwd -e newuser

Modifying User Properties (`usermod`)

Use usermod to update existing users without deleting and recreating them.

Example 1: Locking an account (Disables the password, user cannot log in, but files remain).

bash

sudo usermod -L newuser

Example 2: Unlocking an account

bash

sudo passwd -u newuser

Example 3: Changing the home directory path (User moves to /opt/new_home)

bash

sudo usermod -d /opt/new_home -m newuser

(Note: -m is used here to move the contents of the old home dir to the new one).

Part 4: Creating and Managing Groups

Groups are logical collections of users used for access control.

Creating a Group (`groupadd`)

Command:

bash

sudo groupadd developers

If you want to assign a specific Group ID (GID) rather than letting the system pick one automatically:

bash

sudo groupadd -g 1050 developers

Deleting a Group (`groupdel`)

Warning: If users belong to this group, their GID will become orphaned.

bash

sudo groupdel developers

Part 5: Managing Group Memberships

This is where the real power of Linux permissions lies. You rarely change the definition of a group; you change the membership of users within it.

Adding a User to a Supplementary Group

The golden rule here is using usermod with -aG. You must include the ‘a’ (append). Without it, the user will be removed from all other groups and added only to this one!

Scenario: Add newuser to the sudo group (so they can become root) and the www-data group.

bash

sudo usermod -aG sudo,www-data newuser

Removing a User from a Group

It is easiest to use gpasswd.

Scenario: Remove newuser from the docker group.

sudo gpasswd -d newuser docker

Note: You cannot easily remove a user from their Primary group without using usermod -u to change their primary UID/GID entirely, which is complex.

Part 6: Verifying Your Work

How do you know if your changes stuck?

Check User Identity

bash

id newuser

Output:

uid=1001(newuser) gid=1001(newuser) groups=1001(newuser),27(sudo),33(www-data)

Check Group Members

Use getent (gets entries from databases) or cat /etc/group.

bash

getent group sudo

Output:

sudo:x:27:root,newuser

(This tells us users root and newuser are members of the sudo group).

Summary Cheatsheet for Calabastro Fans

Action	Command	Notes
Create User (Interactive)	`adduser username`	Debian/Ubuntu preference. Prompts for info.
Create User (Silent)	`useradd -m username`	Scripting friendly. Requires flags like `-s`.
Change Password	`passwd username`	Requires sudo if changing others’ passwords.
Lock/Unlock Account	`passwd -l / -u`	Disables password login without deleting files.
Add to Group	`usermod -aG group user`	ALWAYS use -a (append) or lose other groups.
Create Group	`groupadd groupname`	Simple creation. Use `-g` for custom ID.
Remove from Group	`gpasswd -d user group`	Easy removal from supplementary groups.

Stay tuned, Linux lovers! Calabastro out.

Triii Technologies LLC