User and Group Management

Linux is a multi‑user operating system. This means that a single system can be used by many people at the same time, and each person has their own identity and access rights. That identity is represented by the concepts of user and group. Understanding both is an important foundation before you learn about file permissions in the next chapter. In this chapter, you will become familiar with UID and GID, read user configuration files such as /etc/passwd and /etc/group, and practice commands to add, modify, and delete users and groups, both via the terminal and through the Settings application in GNOME.

The Concept of Users in Linux

Each user account in Linux is identified by the system not by its name, but by a number called the UID (User ID). Usernames like andi or siti are merely human‑readable labels. When that name is mapped to a number, it is the number that the system actually uses to recognise the owner of files, processes, and various other objects.

UID (User ID)

The UID is an integer that is unique for each user. Broadly, the UID range is divided into several groups.

The first user created during the installation of Ubuntu 26.04 LTS or Fedora Workstation 44 typically gets UID 1000. Subsequent users will get UIDs 1001, 1002, and so on. This dividing boundary is set by the UID_MIN and UID_MAX variables in the /etc/login.defs file. You can check the boundary values with the following command.

grep -E "^UID_MIN|^UID_MAX" /etc/login.defs

User Types: Regular User, System User, and Root

• Regular user is an account for humans who use the system on a daily basis. This account has its own home directory at /home/name, for example /home/andi.
• System user is an account created automatically by the system to run specific services, such as www-data for a web server or sshd for SSH. These accounts are not meant for interactive login.
• Root is the privileged user with UID 0 who has full control over the entire system. On modern desktops, you do not log in as root; instead, you use the sudo command, which will be discussed in the next chapter.

The /etc/passwd and /etc/shadow Files

Basic user information is stored in the /etc/passwd file. Although its name contains the word "password", this file no longer stores passwords, but only account information. Each line represents one user and consists of seven columns separated by colons (:).

name:x:UID:GID:info:home:shell

The actual passwords are stored in the /etc/shadow file. This file can only be read by root, because it contains password hashes as well as password ageing and expiration information. Its format also consists of several columns separated by colons.

name:password_hash:last_change:min_age:max_age:warning:grace:expire:reserved

Besides the password hash, the three columns most commonly used by administrators are max_age (the maximum number of days before the password must be changed), warning (how many days in advance the user is reminded to change the password), and expire (the date on which the account is completely disabled). This is why ordinary users only see an x in /etc/passwd, not the actual password.

The Concept of Groups

A group is a way to group several users together so that access rights can be granted collectively. Instead of giving permissions one by one to each person, an administrator simply grants permission to a group, and all its members receive that permission.

GID (Group ID)

Just like users, groups are also identified by a number called the GID (Group ID). The GID range follows a pattern similar to that of UIDs.

Every user belongs to at least one group called the primary group. This group is usually created automatically with the same name as the username. In addition to the primary group, a user can also be a member of one or more supplementary groups.

Primary Group and Supplementary Group

• Primary group is the user's main group. When a user creates a new file, that file is automatically owned by the user's primary group.
• Supplementary group is an additional group that a user is a member of, for example the sudo group on Ubuntu, the wheel group on Fedora, or the libvirt group for virtualization.

The difference between the two is important when you manage file permissions, because the group that owns a new file is determined by the primary group.

The /etc/group and /etc/gshadow Files

The list of groups is stored in the /etc/group file. Each line represents one group and consists of four columns.

name:x:GID:members

It is worth noting that the members column in /etc/group only lists the supplementary members of that group. Users who have that group as their primary group are not listed in this column, because their membership is already determined via the GID column in /etc/passwd. Meanwhile, the /etc/gshadow file stores group passwords and group administrators. Like /etc/shadow, this file can only be read by root.

Viewing User Information

A few simple commands help you find out your own identity on the system.

The whoami command answers the most basic question: "who am I logged in as?". The id command is more complete, because it displays the UID, primary GID, and all supplementary groups at once. Run id without arguments to see your own information, or id username to see another user's information.

id

The groups command focuses only on group membership, so it is useful when you want to check whether an account is already a member of a particular group. If at any time you need to look up a specific line in /etc/passwd or /etc/group without opening the file manually, you can also use the getent passwd username or getent group groupname commands; both read from the active identity sources on the system, including if the system is later connected to a central directory such as LDAP.

User Management (Commands)

To manage user accounts from the terminal, you need administrative privileges, so every command must be prefixed with sudo.

useradd and adduser: Adding Users

There are two commands for adding users. useradd is the low‑level command available on all distributions, but its parameters are quite lengthy. Meanwhile, adduser is a wrapper script that is more user‑friendly. On Ubuntu, adduser is interactive and guides you through filling in the password and user data, whereas on Fedora, adduser is simply a symbolic link to useradd, so its behaviour is exactly the same as useradd.

# on Ubuntu 26.04 LTS
sudo adduser budi

# on Fedora Workstation 44
sudo useradd -m budi
sudo passwd budi

The -m option on useradd forces the creation of the home directory. The default behaviour differs between distributions: on Ubuntu, the value of CREATE_HOME in /etc/login.defs defaults to no, so -m must be included to create the home directory. On Fedora, CREATE_HOME is already set to yes by default, so the home directory is actually created even if -m is omitted. Nevertheless, it is still recommended to always explicitly include -m so that your command is consistent and portable when used on other distributions.

usermod: Modifying User Attributes

The usermod command is used to change attributes of an existing user. Some commonly used options include:

Pay attention to the -a (append) option. Without -a, the -G option will overwrite the entire list of supplementary groups for the user, which means they could lose membership in older groups. Also note that -d without -m only changes the recorded home location in /etc/passwd, without moving any files that already exist in the old home directory.

sudo usermod -aG sudo budi

The command above adds budi to the sudo group on Ubuntu, allowing them to run administrative commands.

userdel: Deleting a User

The userdel command deletes a user account. By default, the user's home directory is not deleted. Use the -r option if you want to delete the account along with its home directory and mail spool.

sudo userdel budi
sudo userdel -r budi

On Ubuntu, the same package that provides adduser also provides the deluser command as its counterpart, which is functionally equivalent to userdel but with a few more beginner‑friendly options, for example sudo deluser --remove-home budi.

passwd: Setting Passwords

The passwd command is used to change a password. Run it without arguments to change your own password, or with a username to change another user's password (requires sudo).

passwd
sudo passwd budi

Group Management

Just like users, groups can also be managed with their own set of commands.

groupadd, groupmod, groupdel

sudo groupadd developer
sudo groupmod -n dev developer
sudo groupdel developer

The example above creates the group developer, then renames it to dev with the -n option, and finally deletes it. A group can only be deleted if it is no longer the primary group for any user. On Ubuntu, the delgroup command is available as an alternative to groupdel, in line with the adduser/deluser pairing.

gpasswd: Managing Group Members

The gpasswd command is the most practical way to add or remove members from a group.

sudo gpasswd -a budi developer
sudo gpasswd -d budi developer

The -a option adds a member, while the -d option removes a member. After you change group membership, the user usually needs to log out and then log back in for the changes to take effect in the current session.

User Management via the GUI Settings

If you prefer a graphical interface, GNOME 50 provides user settings through the Settings application. Open the System panel, then select Users. Here you can add new users, set profile pictures, change passwords, and specify the account type, namely Standard or Administrator. You can also enable the Automatic Login option and see the system language used by each user.

Keep in mind that some changes, such as creating a new user or changing another user's password, still require administrative authentication. This GUI also displays the list of existing users and allows you to delete an account with just a few clicks. The same panel is available on Ubuntu 26.04 LTS and Fedora Workstation 44 because both use GNOME.

Understanding users and groups is the first step toward managing access on Linux. Once you are able to create accounts, modify their attributes, and manage group membership, you have laid the foundation needed to understand file permissions. In the next chapter, you will learn how ordinary users run administrative tasks via sudo, and then how read, write, and execute permissions are applied to every file and directory.