LPIC-1 107.1 — Manage User and Group Accounts

Exam weight: 5 — LPIC-1 v5, Exam 102

What You Need to Know

From the official LPIC-1 objectives:

• Add, modify, and remove users and groups.
• Manage user/group info in password and group databases.
• Create and manage special-purpose and limited accounts.

Key files and commands: /etc/passwd, /etc/shadow, /etc/group, /etc/gshadow, /etc/skel, /etc/login.defs, useradd, usermod, userdel, groupadd, groupmod, groupdel, passwd, chage, getent.

User Account Files

/etc/passwd

Every local user has one line in /etc/passwd with seven colon-separated fields:

frank:x:1001:1001:Frank User:/home/frank:/bin/bash

System accounts typically have UIDs below 1000; ordinary user accounts use UIDs of 1000 and above.

/etc/shadow

Stores password hashes and aging information (readable by root only):

frank:$6$...:18600:0:99999:7:::

/etc/group

Each group occupies one line with four fields:

db-admin:x:1050:frank,emma

/etc/gshadow

Group shadow file with four fields: group name, encrypted password (! = no newgrp access), group administrators, group members.

Managing Users

useradd

Creates a new user account. Common options:

Example — create user emma with home directory and bash shell:

useradd -m -s /bin/bash -c "Emma User" emma

usermod

Modifies an existing user account. Options mirror useradd with additions:

userdel

Removes a user account. Use -r to also delete the home directory and mail spool:

userdel -r emma

Managing Groups

Password and Aging — passwd and chage

passwd

Manages user passwords and account locking:

chage

Manages password expiry and aging:

passwd ↔ chage equivalents

To lock an account: usermod -L username or passwd -l username.
To unlock an account: usermod -U username or passwd -u username.

Skeleton and Login Defaults

/etc/skel

When useradd -m creates a home directory, the contents of /etc/skel are copied into it. Place default config files (.bashrc, .profile, etc.) here.

/etc/login.defs

System-wide defaults for user/group creation:

Querying Accounts — getent

getent retrieves entries from Name Service Switch (NSS) databases, supporting both local files and network directories (LDAP, NIS):

getent passwd emma
# emma:x:1020:1020:User Emma:/home/emma:/bin/bash

getent group db-admin
# db-admin:x:1050:frank,emma

Quick Reference

User account files:
  /etc/passwd      7 fields: username:x:UID:GID:GECOS:home:shell
  /etc/shadow      9 fields: username:hash:lastchg:min:max:warn:inactive:expire:reserved
  /etc/group       4 fields: groupname:x:GID:members
  /etc/gshadow     4 fields: groupname:hash:admins:members

Creating users:
  useradd -m -s /bin/bash -c "Name" -G group1,group2 username
  useradd flags: -c -d -e -f -g -G -k -m -M -s -u

Modifying users:
  usermod -d -m   move home directory
  usermod -G -a   append secondary groups
  usermod -l      rename login
  usermod -L/-U   lock / unlock

Deleting users:
  userdel -r username    remove user + home + mail spool

Groups:
  groupadd -g GID name
  groupmod -n newname -g GID name
  groupdel name

Passwords & aging:
  passwd -l/-u    lock / unlock
  passwd -x/-n/-w/-i   max/min/warn/inactive days
  chage -M/-m/-W/-I    same via chage
  chage -E YYYY-MM-DD  set account expiry
  chage -l username    list aging info

Skeleton & defaults:
  /etc/skel        copied to new home directories
  /etc/login.defs  system defaults for UIDs, GIDs, password aging

Query NSS databases:
  getent passwd username
  getent group groupname

Exam Questions

1. What command creates user frank with a home directory and bash shell? → useradd -m -s /bin/bash frank
2. What does usermod -L username do? → Locks the account by prepending ! to the password hash in /etc/shadow.
3. What is the equivalent of passwd -l? → usermod -L — both lock the account.
4. How do you append a user to secondary group staff without removing existing groups? → usermod -aG staff username
5. What command changes the maximum password age to 90 days? → chage -M 90 username or passwd -x 90 username
6. What file stores password hashes on Linux? → /etc/shadow
7. What does a ! prefix in the password field of /etc/shadow mean? → The account is locked.
8. What is /etc/skel? → Directory whose contents are copied to a new user’s home directory when it is created.
9. What command removes user emma and her home directory? → userdel -r emma
10. What does getent passwd emma do? → Queries the NSS passwd database for user emma — works with local files and network directories.
11. How many fields does /etc/passwd have? → 7: username, password placeholder, UID, GID, GECOS, home, shell.
12. How many fields does /etc/shadow have? → 9: username, hash, last-change, min, max, warn, inactive, expire, reserved.
13. What UID range is typically used for ordinary users? → 1000 and above (system accounts are below 1000).
14. What file defines system-wide defaults for user creation such as UID_MIN? → /etc/login.defs
15. What command lists aging information for a user account? → chage -l username
16. Which option of chage sets the account expiry date? → -E YYYY-MM-DD
17. What does userdel do without the -r flag? → Removes the user account but leaves the home directory and mail spool intact.
18. How do you force a user to change their password on next login? → passwd -e username or chage -d 0 username

Exercises

Exercise 1 — Create a Developer Account

Create user dev1 with UID 2001, home directory /home/dev1, bash shell, and secondary group developers. What command achieves this?

useradd -u 2001 -m -s /bin/bash -G developers dev1

Exercise 2 — Lock and Unlock an Account

A user account must be temporarily disabled while an employee is on leave. What are two ways to lock it, and how do you unlock it?

Exercise 3 — Password Aging Policy

Set a password policy for user frank where: maximum age is 60 days, minimum age is 2 days, warning 7 days before expiry, and inactivity lock after 14 days.

chage -M 60 -m 2 -W 7 -I 14 frank

passwd -x 60 -n 2 -w 7 -i 14 frank

Exercise 4 — Reading /etc/shadow

Given this shadow entry: emma:$6$abc:19000:5:90:7:30:19365:

Interpret each field.

Exercise 5 — Group Membership

User kevin needs to be added to the sysadmin group as a secondary group without losing existing group memberships. What command achieves this?

usermod -aG sysadmin kevin

LPIC-1 Study Notes | Topic 107: Administrative Tasks