User and group accounts

Four files, and which one holds the password

/etc/passwd has one line per account with seven colon-separated fields: name, an x standing in for the password, UID, GID, the comment or GECOS field, home directory, and login shell. It is world-readable, which is exactly why the password is not in it. /etc/shadow holds the hashed password and the ageing fields — last change, minimum and maximum age, warning period, inactivity, expiry — and is readable only by root.

/etc/group lists groups with their GIDs and their supplementary members, and /etc/gshadow holds group passwords and administrators. A user's PRIMARY group is the GID in their passwd line and is not listed in /etc/group as a member; supplementary groups are. id prints both, groups prints the names, and getent looks an entry up through whatever name service is configured rather than only in the local file — which matters the moment LDAP is involved.

The commands, and what they do to the filesystem

useradd creates an account, with -m to create the home directory (copied from /etc/skel), -s for the shell and -G for supplementary groups; adduser on Debian systems is an interactive wrapper over it. usermod changes an existing account — and the trap is that usermod -G REPLACES the supplementary group list, so adding a group means usermod -aG, with the -a for append. userdel removes the account and userdel -r also removes the home directory and mail spool.

groupadd, groupmod and groupdel do the same for groups. passwd sets a password; passwd -l locks an account by prefixing the hash with a character that can never match, and passwd -u unlocks it. chage manages the ageing fields — chage -l lists them — and setting a shell of /sbin/nologin or /bin/false is the other way to stop an account being used interactively while leaving it functional for a service.

gpasswd is the one that maintains /etc/gshadow, and it is how group membership is delegated without handing out root or writing a sudo rule: gpasswd -A alice developers makes alice an ADMINISTRATOR of that group, recorded in /etc/gshadow, after which she may add and remove members herself. Its other flags act on the membership rather than the delegation — -a adds one member and -d removes one, -M replaces the member list outright, and gpasswd with only a group name sets the group password that newgrp asks for. /etc/gshadow is to /etc/group what /etc/shadow is to /etc/passwd: the root-only companion file.

The two fields a user might reasonably want to change themselves have their own commands. chfn -f "Alice Okafor" alice writes the fifth field of the /etc/passwd line — the GECOS or comment field, conventionally full name, room, work phone and home phone, and where a mail client picks up a display name — and chsh -s /bin/bash alice writes the seventh, the login shell. Both are setuid so that a user may correct their own entry. usermod does the same two jobs from the administrator's side with -c and -s, replacing the whole field rather than editing named parts of it, so usermod -c and chfn -f are two correct answers to the same question.

A UID of 0 means root, whatever the account is called; there is nothing else special about the name. System accounts conventionally take low UIDs, with the boundary set in /etc/login.defs.