Local users and groups.
A user account isn't one thing — it's a few lines spread across /etc/passwd, /etc/shadow, and /etc/group, plus a home directory and a mail spool. Read each field, then learn the commands that create, modify, lock, and delete accounts.
Linux local users and groups animated tutorial. Covers /etc/passwd, /etc/shadow, /etc/group fields, useradd, usermod, userdel, passwd, chage, primary vs supplementary groups, and account locking. RHCSA EX200 ready.A Linux account is a few lines of text plus a home directory. Once you can read /etc/passwd, /etc/shadow, and /etc/group, the management commands stop feeling magic.
- ·Comfortable viewing files (cat, less) and basic permissions
- ·Know that root is the admin account
- ·Helpful: the file-permissions / chmod tool for the next lesson
Read every field of a passwd/shadow/group line, and run the commands to create, modify, lock, and delete accounts safely.
pace: 10 minutes
/etc/passwd — seven colon-separated fields
Every account has one line in /etc/passwd with seven fields separated by colons: username, password placeholder (almost always 'x'), UID, primary GID, GECOS (a free-text comment, historically the user's full name), home directory, and login shell. This file is world-readable — that's fine, because the actual password hash lives elsewhere.
The kernel only knows numbers — UIDs and GIDs. Usernames and group names are a convenience layer that /etc/passwd and /etc/group map to those numbers. That's why a file copied to another system can suddenly be "owned" by a different user: same UID, different name-to-number mapping.
$id alice$getent passwd alice$useradd -m -s /bin/bash alice$useradd -r svc$usermod -aG wheel alice$usermod -L / -U alice$userdel -r alice$passwd alice$passwd -l / -u alice$chage -l alice$chage -M 90 -W 7 alice$groupadd developers$gpasswd -a alice developers$newgrp developers$/etc/skel$/etc/login.defsWhere is a user's actual hashed password stored?
You run `usermod -G developers alice` to add alice to the developers group. What's the bug?
What's the difference between a primary and a supplementary group?
You want to disable password login for a departing employee but keep their files and audit trail. Best move?
These aren't graded — they're just for active recall, which is what actually makes the lesson stick.
chmod calculator
Now that you can create users and groups, decide what they can read and write. Flip permission bits and watch rwx ↔ octal update in lockstep.
Read this lesson as text6 chapters · quiz answers
01/etc/passwd — seven colon-separated fields
Every account has one line in /etc/passwd with seven fields separated by colons: username, password placeholder (almost always 'x'), UID, primary GID, GECOS (a free-text comment, historically the user's full name), home directory, and login shell. This file is world-readable — that's fine, because the actual password hash lives elsewhere.
02UID and GID — the numbers that actually matter
The kernel doesn't care about your username — it tracks you by UID. UID 0 is root. By convention 1–999 are system/service accounts, and 1000+ are regular humans (1–999 + 1000+ split varies by distro). The fourth field is your PRIMARY group's GID — the group new files you create are owned by.
03/etc/shadow — where the password actually lives
The 'x' in passwd points here. /etc/shadow is readable only by root and holds the hashed password ($6$ = SHA-512) plus password-aging fields: last change date, min days between changes, max days before expiry, warning period, inactive period, and the account-expiry date. This separation is why passwd can be world-readable but your hash isn't.
04Primary vs supplementary groups
Your PRIMARY group is the GID in /etc/passwd — exactly one. SUPPLEMENTARY groups are extra memberships listed in /etc/group (the last field is a comma-separated member list). You're always 'in' your primary group; supplementary groups grant extra access without changing file ownership defaults.
id aliceshows all of them at once.05Create, modify, delete
useradd makes the account (and, with -m, the home dir from /etc/skel). usermod changes it — note
-aG(APPEND to supplementary groups); forgetting the -a and using just -G REPLACES all supplementary groups, a classic way to lock yourself out of sudo. userdel removes it; add -r to also delete the home directory and mail spool.$ useradd -m -s /bin/bash -G wheel alice— create alice, home dir, in wheel group$ usermod -aG developers alice— APPEND alice to developers (note -a!)$ userdel -r alice— delete alice + her home + mail
06Passwords, aging, and locking
passwd sets or changes a password. chage manages aging (max days, expiry, etc.) and
chage -l alicelists it. To LOCK an account,usermod -L(orpasswd -l) prepends a ! to the hash so no password matches — the account still exists and key-based SSH may still work. To fully block login, also set the shell to /sbin/nologin.$ passwd alice— set/change alice's password$ chage -l alice— show password-aging info$ chage -M 90 alice— password expires every 90 days$ usermod -L alice— lock (disable password login)$ usermod -U alice— unlock
Quiz — answers
- Where is a user's actual hashed password stored?
- →In /etc/shadow — /etc/passwd just has an 'x' placeholder pointing there./etc/passwd is world-readable, so storing the hash there would be a disaster. The 'x' in field 2 means 'look in /etc/shadow', which is readable only by root. /etc/shadow also holds the password-aging fields.
- You run
usermod -G developers aliceto add alice to the developers group. What's the bug? - →Without -a, -G REPLACES all of alice's supplementary groups with just 'developers' — she loses every other group, including wheel/sudo.
-Gsets the COMPLETE supplementary group list. Use-aGto APPEND. Dropping the -a is a classic way to accidentally remove yourself from the wheel/sudo group and lose admin access. - What's the difference between a primary and a supplementary group?
- →Primary is the single GID in /etc/passwd (owns your new files by default); supplementary groups are extra memberships in /etc/group for additional access.You have exactly one primary group (the GID in passwd) — files you create are group-owned by it. Supplementary groups (listed in /etc/group) grant extra access.
idshows both: 'gid=' is primary, 'groups=' lists all. - You want to disable password login for a departing employee but keep their files and audit trail. Best move?
- →usermod -L alice (lock the password) and optionally set the shell to /sbin/nologinusermod -L prepends ! to the hash so no password matches, without deleting anything. Setting the shell to /sbin/nologin blocks interactive login entirely. userdel -r would destroy their home and break file ownership/audit.
keep going — these pair well with what you just learned.
SELinux contexts
Why Apache can't read your file. Watch the policy engine decide — and learn the workflow for fixing denials. RHCSA-ready.
Linux boot process
From power button to login prompt. Every stage in the chain — UEFI, GRUB, kernel, initramfs, systemd — with the rescue moves that save you. RHCSA-ready.
LVM stacking
Layer-by-layer build of an LVM stack: disks → PVs → VG → LVs → filesystem. Then extend live and snapshot. RHCSA-ready.