18.1 Create, Delete, and Modify Local User Accounts

18.1 Create, Delete, and Modify Local User Accounts

Quick Answer: Create accounts with useradd (options for home, shell, UID, groups, comment). Modify with usermod. Remove with userdel (add -r to remove home and mail spool). Verify in /etc/passwd, /etc/shadow, /etc/group, and with id, getent passwd, and ls -ld /home/user. Defaults come from /etc/login.defs and /etc/default/useradd.

Why local users matter on EX200

Under Manage users and groups, Red Hat expects you to create, delete, and modify local user accounts so people and service identities exist with the right UID, home, shell, and group memberships. Tasks look like:

• “Create user ops1 with UID 1500, home /home/ops1, and shell /bin/bash.”
• “Add a comment (GECOS) and force the account to use /sbin/nologin.”
• “Delete user temp and remove the home directory.”
• “Lock an account” or “change the primary group / supplementary groups” (often with password and group objectives in the same scenario).

You are graded on end state in the account databases and filesystem, not on interactive GUI tools. Prefer useradd / usermod / userdel over hand-editing /etc/passwd under exam pressure.

Account databases (what you are changing)

getent passwd alice
getent shadow alice    # as root; may be restricted
id alice
ls -ld /home/alice

getent uses NSS (Name Service Switch)—prefer it over only cat /etc/passwd so you see the same resolution path the system uses. On pure local EX200 machines, local files dominate.

/etc/passwd fields

name:x:UID:GID:GECOS:home:shell
alice:x:1001:1001:Alice Admin:/home/alice:/bin/bash

System vs ordinary UIDs

RHEL/login.defs define ranges (UID_MIN, UID_MAX, system ranges). System accounts (daemons) often use lower UIDs and /sbin/nologin or /bin/false. Ordinary interactive users typically get UIDs ≥ UID_MIN (commonly 1000). If a task specifies a UID, set it explicitly with useradd -u.

Create users with useradd

Minimal create

sudo useradd alice
id alice
getent passwd alice
ls -ld /home/alice     # if CREATE_HOME is yes

Without extra options, useradd applies defaults from /etc/default/useradd and /etc/login.defs (primary group strategy, home creation, shell, skeleton).

Essential options (memorize)

sudo groupadd developers 2>/dev/null || true
sudo useradd -u 1500 -g developers -G wheel -c "Ops Alice" \
  -d /home/alice -m -s /bin/bash alice
id alice
getent passwd alice
ls -la /home/alice

Order habit: create required groups first, then useradd -g / -G. Primary group with -g must already exist unless you rely on the default “user private group” behavior.

User private groups (UPG)

On modern RHEL, creating alice often creates a group alice with the same GID as the UID and sets that as primary. That isolates default file group ownership. Tasks that say “primary group must be developers” require -g developers (and usually that group already exists).

grep ^USERGROUPS_ENAB /etc/login.defs
grep ^GROUP= /etc/default/useradd

Home and skeleton

ls -la /etc/skel
sudo useradd -m -k /etc/skel bob
ls -la /home/bob

-m ensures the home directory is created and populated from skel. If home should live outside /home:

sudo useradd -d /srv/appuser -m -s /sbin/nologin appuser
ls -ld /srv/appuser

Non-login / service-style accounts

sudo useradd -r -s /sbin/nologin -c "App runtime" -d /var/lib/myapp -m myapp
getent passwd myapp

-r requests a system account. Shell /sbin/nologin or /usr/sbin/nologin blocks interactive login while still allowing ownership of files and services.

Modify users with usermod

# Common modifications
sudo usermod -c "New Comment" alice
sudo usermod -s /bin/bash alice
sudo usermod -d /home/alice2 -m alice   # -m moves home content when changing -d
sudo usermod -u 1600 alice              # change UID (files keep old numeric ownership!)
sudo usermod -g developers alice        # change primary group
sudo usermod -L alice                   # lock password
sudo usermod -U alice                   # unlock
sudo usermod -e 2026-12-31 alice        # account expire date
sudo usermod -f 7 alice                 # inactive days after password expire

Supplementary groups: replace vs append

Exam trap: Forgetting -a with -G wipes previous supplementary memberships (for example silently removing wheel). Always:

id alice
sudo usermod -aG projectx alice
id alice

Primary group is not listed the same way as supplementary in all tools—use id and groups.

Locking vs deleting

sudo usermod -L alice          # lock: '!' or '!!' in shadow password field
sudo passwd -l alice           # also locks via passwd
sudo passwd -u alice           # unlock (if a password hash exists)
sudo usermod -s /sbin/nologin alice   # block interactive shell without deleting

Locking is for temporary disable. Deleting is permanent removal of the account entry.

Delete users with userdel

sudo userdel alice              # remove account; home may remain
sudo userdel -r alice           # remove home directory and mail spool

Exam reading: If the task says remove the user and home directory, you need userdel -r. Without -r, leftover /home/alice with orphaned UID ownership is a common miss.

getent passwd alice || echo "no passwd entry"
ls -ld /home/alice 2>/dev/null || echo "home gone"
find / -xdev -uid 1500 2>/dev/null | head   # leftover files if UID known

After userdel without -r, you may need manual rm -rf of home only if the task requires cleanup—prefer userdel -r when that matches the requirement.

Inspect defaults before you fight the tools

sudo useradd -D                 # show useradd defaults
sudo cat /etc/default/useradd
grep -E '^(UID_MIN|UID_MAX|CREATE_HOME|SYS_UID)' /etc/login.defs

Changing global defaults mid-exam is rarely required; per-user options on the command line are safer and clearer for graders.

Password is separate (but often same task)

useradd does not set a usable interactive password unless you pass a carefully prepared hash. Typical exam flow:

sudo useradd -m -s /bin/bash alice
echo 'AlicePass123' | sudo passwd --stdin alice    # RHEL passwd supports --stdin
# or: sudo passwd alice   # interactive

Password aging and chage are Section 18.2. Create the account correctly first, then set password/aging as specified.

Ownership after UID change

If you change UID with usermod -u, files already owned by the old numeric UID do not magically rewrite. For a home you control:

sudo usermod -u 1600 alice
sudo chown -R alice:alice /home/alice

On the exam, set the correct -u at create time whenever the task specifies a UID—avoid mid-flight UID renumbering.

Verification checklist (grader style)

id alice
getent passwd alice
getent group developers
ls -ld /home/alice
grep '^alice:' /etc/passwd
sudo grep '^alice:' /etc/shadow

Check every field the task mentioned: name, UID, primary GID/group, supplementary groups, home path existence, shell, comment.

Exam workflows

Workflow A — Interactive user with exact UID and shell

sudo useradd -u 1500 -c "Ops Alice" -m -s /bin/bash alice
echo 'ExamP@ss1' | sudo passwd --stdin alice
id alice
getent passwd alice

Workflow B — Primary group + supplementary groups at create

sudo groupadd -f developers
sudo groupadd -f contractors
sudo useradd -m -s /bin/bash -g developers -G contractors,wheel bob
id bob

Workflow C — Service account without login

sudo useradd -r -m -d /var/lib/svcapp -s /sbin/nologin svcapp
id svcapp
getent passwd svcapp

Workflow D — Modify existing: shell, comment, append group

sudo usermod -s /bin/bash -c "Bob Ops" bob
sudo usermod -aG wheel bob
id bob

Workflow E — Delete including home

sudo userdel -r tempuser
getent passwd tempuser || echo removed
ls /home/tempuser 2>/dev/null || echo home removed

Common traps

1. usermod -G without -a wiping supplementary groups (especially wheel).
2. userdel without -r when the task requires home removal.
3. Specifying -g primary group that does not exist—create the group first.
4. Assuming useradd sets a password—still run passwd.
5. Wrong shell path: prefer /bin/bash, /sbin/nologin as commonly used on RHEL.
6. Creating home with wrong path and forgetting -m / -d.
7. Hand-editing /etc/passwd and breaking field counts—use the tools.
8. Changing UID and forgetting file ownership still shows old numbers.
9. Expecting group membership to apply in a session that was already open—user must re-login for new groups in interactive sessions.
10. Skipping id / getent verification before moving to the next task.

Relationship to other sections

• 18.2 Password aging: passwd and chage after the account exists.
• 18.3 Groups: groupadd / gpasswd / membership details.
• 18.4 Privileged access: wheel and sudo depend on correct group membership.
• Permissions chapters: files you create as root under a user’s home often need chown.
• SSH / multiuser login: shell and account lock state affect interactive access.

Section checkpoint

You should create local users with useradd (UID, home, shell, comment, primary/supplementary groups), modify them with usermod (especially -aG vs -G), lock when required, delete with userdel / userdel -r, and prove results with id, getent, and home directory checks against /etc/passwd and /etc/shadow. That is the EX200 bar for local user accounts on RHEL 10.