Intro to the Linux useradd command

Adding a consumer is among the most elementary workouts on any laptop system; this text focuses on find out how to do it on a Linux system.

Before getting began, I need to point out three fundamentals to remember. First, like with most working methods, Linux customers want an account to have the ability to log in. This article particularly covers native accounts, not community accounts reminiscent of LDAP. Second, accounts have each a reputation (referred to as a username) and a quantity (referred to as a consumer ID). Third, customers are usually positioned into a bunch. Groups even have a reputation and group ID.

As you’d anticipate, Linux features a command-line utility for including customers; it is referred to as useradd. You may additionally discover the command adduser. Many distributions have added this symbolic hyperlink to the useradd command as a matter of comfort.

$ file `which adduser`
/usr/sbin/adduser: symbolic hyperlink to useradd

Let’s check out useradd.

Note: The defaults described on this article mirror these in Red Hat Enterprise Linux eight.zero. You could discover refined variations in these information and sure defaults on different Linux distributions or different Unix working methods reminiscent of FreeBSD or Solaris.

Default habits

The primary utilization of useradd is sort of easy: A consumer could be added simply by offering their username.

$ sudo useradd sonny

In this instance, the useradd command creates an account referred to as sonny. A gaggle with the identical identify can be created, and sonny is positioned in it for use as the first group. There are different parameters, reminiscent of language and shell, which might be utilized in response to defaults and values set within the configuration information /and so on/default/useradd and /and so on/login.defs. This is usually ample for a single, private system or a small, one-server enterprise atmosphere.

While the 2 information above govern the habits of useradd, consumer data is saved in different information discovered within the /and so on listing, which I’ll confer with all through this text.

Customizable habits

The command line permits customization for instances when an administrator wants finer management, reminiscent of to specify a consumer’s ID quantity.

User and group ID numbers

By default, useradd tries to make use of the identical quantity for the consumer ID (UID) and first group ID (GID), however there aren’t any ensures. Although it is not vital for the UID and GID to match, it is simpler for directors to handle them after they do.

I’ve simply the situation to elucidate. Suppose I add one other account, this time for Timmy. Comparing the 2 customers, sonny and timmy, exhibits that each customers and their respective main teams had been created by utilizing the getent command.

$ getent passwd sonny timmy

sonny:x:1001:1002:Sonny:/dwelling/sonny:/bin/bash

timmy:x:1002:1003::/dwelling/timmy:/bin/bash
$ getent group sonny timmy
sonny:x:1002:
timmy:x:1003:

Unfortunately, neither customers’ UID nor main GID match. This is as a result of the default habits is to assign the subsequent obtainable UID to the consumer after which try and assign the identical quantity to the first group. However, if that quantity is already used, the subsequent obtainable GID is assigned to the group. To clarify what occurred, I hypothesize that a group with GID 1001 already exists and enter a command to substantiate.

$ getent group 1001
ebook:x:1001:alan

The group ebook with the ID 1001 has brought on the GIDs to be off by one. This is an instance the place a system administrator would wish to take extra management of the user-creation course of. To resolve this challenge, I need to first decide the subsequent obtainable consumer and group ID that may match. The instructions getent group and getent passwd can be useful in figuring out the subsequent obtainable quantity. This quantity could be handed with the -u argument.

$ sudo useradd -u 1004 bobby
$ getent passwd bobby; getent group bobby
bobby:x:1004:1004::/dwelling/bobby:/bin/bash
bobby:x:1004:

Another good motive to specify the ID is for customers that can be accessing information on a distant system utilizing the Network File System (NFS). NFS is simpler to manage when all consumer and server methods have the identical ID configured for a given consumer. I cowl this in a bit extra element in my article on using autofs to mount NFS shares.

More customization

Very usually although, different account parameters should be specified for a consumer. Here are transient examples of the commonest customizations it’s possible you’ll want to make use of.

The remark choice is a plain-text discipline for offering a brief description or different data utilizing the -c argument.

$ sudo useradd -c "Bailey is cool" bailey
$ getent passwd bailey
bailey:x:1011:1011:Bailey is cool:/dwelling/bailey:/bin/bash

Groups

A consumer could be assigned one main group and a number of secondary teams. The -g argument specifies the identify or GID of the first group. If it is not specified, useradd creates a main group with the consumer’s identical identify (as demonstrated above). The -G (uppercase) argument is used to move a comma-separated record of teams that the consumer can be positioned into; these are generally known as secondary teams.

$ sudo useradd -G tgroup,fgroup,libvirt milly 
$ id milly
uid=1012(milly) gid=1012(milly) teams=1012(milly),981(libvirt),4000(fgroup),3000(tgroup)

Home listing

The default habits of useradd is to create the consumer’s dwelling listing in /dwelling. However, completely different facets of the house listing could be overridden with the next arguments. The -b units one other listing the place consumer houses could be positioned. For instance, /home2 as an alternative of the default /dwelling.

$ sudo useradd -b /home2 vicky
$ getent passwd vicky
vicky:x:1013:1013::/home2/vicky:/bin/bash

The -d permits you to specify a house listing with a unique identify from the consumer.

$ sudo useradd -d /dwelling/ben jerry
$ getent passwd jerry
jerry:x:1014:1014::/dwelling/ben:/bin/bash

The skeleton listing

The -k instructs the brand new consumer’s new dwelling listing to be populated with any information within the /and so on/skel listing. These are normally shell configuration information, however they are often something that a system administrator wish to make obtainable to all new customers.

Shell

The -s argument can be utilized to specify the shell. The default is used if nothing else is specified. For instance, within the following, shell bash is outlined within the default configuration file, however Wally has requested zsh.

$ grep SHELL /and so on/default/useradd 
SHELL=/bin/bash
$ sudo useradd -s /usr/bin/zsh wally
$ getent passwd wally
wally:x:1004:1004::/dwelling/wally:/usr/bin/zsh

Security

Security is a vital a part of consumer administration, so there are a number of choices obtainable with the useradd command. A consumer account could be given an expiration date, within the kind YYYY-MM-DD, utilizing the -e argument.

$ sudo useradd -e 20191231 sammy
$ sudo getent shadow sammy
sammy:!!:18171:zero:99999:7::20191231:

An account will also be disabled mechanically if the password expires. The -f argument will set the variety of days after the password expires earlier than the account is disabled. Zero is rapid.

$ sudo useradd -f 30 willy
$ sudo getent shadow willy
willy:!!:18171:zero:99999:7:30::

An actual-world instance

In apply, a number of of those arguments could also be used when creating a brand new consumer account. For instance, if I must create an account for Perry, I’d use the next command:

$ sudo useradd -u 1020 -c "Perry Example" 
-G tgroup -b /home2 
-s /usr/bin/zsh 
-e 20201201 -f 5 perry

Refer to the sections above to grasp every choice. Verify the outcomes with:

$ getent passwd perry; getent group perry; getent shadow perry; id perry
perry:x:1020:1020:Perry Example:/home2/perry:/usr/bin/zsh
perry:x:1020:
perry:!!:18171:zero:99999:7:5:20201201:
uid=1020(perry) gid=1020(perry) teams=1020(perry),3000(tgroup)

Some remaining recommendation

The useradd command is a “must-know” for any Unix (not simply Linux) administrator. It is essential to grasp all of its choices since consumer creation is one thing that you just need to get proper the primary time. This means having a well-thought-out naming conference that features a devoted UID/GID vary reserved on your customers throughout your enterprise, not simply on a single system—significantly whenever you’re working in a rising group.