Managing users and sudo rules

Onboarding people, creating service accounts and limiting admin rights are routine server tasks.

The low-level tools work on every distribution:

useradd -m -s /bin/bash name creates a user with a home directory and shell (Debian's friendlier adduser asks interactively),
passwd name sets a password, passwd -l name locks it,
usermod -aG group name adds a supplementary group. Without -a, -G replaces all supplementary groups, a classic way to remove someone's sudo rights by accident,
groupadd, gpasswd -d user group (remove from a group), userdel -r name (also delete the home).

Group changes take effect at the user's next login (or with newgrp group in a single shell), since group membership is fixed when a session starts.

Service accounts for daemons are system users without a login shell: useradd --system --no-create-home --shell /usr/sbin/nologin myapp.

sudo rules live in /etc/sudoers. Never edit it directly: visudo checks the syntax, because a broken sudoers file can lock everyone out of root. Prefer small files in /etc/sudoers.d/, edited with visudo -f. A rule reads who where=(as_whom) what; for automation grant exact commands, optionally with NOPASSWD, rather than ALL. For people, SSH key logins plus sudo are the norm, and direct root login over SSH is disabled.

Example

sudo useradd -m -s /bin/bash -c "Bob Builder" bob   # -m creates /home/bob
sudo passwd bob                    # set a password
sudo usermod -aG docker bob        # ADD to a group (-a is essential!)
groups bob                         # bob : bob docker
sudo useradd --system --no-create-home --shell /usr/sbin/nologin myapp
sudo visudo -f /etc/sudoers.d/deploy
#   deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp
sudo -u postgres psql              # run a command as another user
sudo passwd -l bob                 # lock the password
sudo userdel -r bob                # delete user and home directory

Remember

usermod -aG adds a group; without -a you replace them all
Group changes apply at the next login
Edit sudo rules with visudo, in /etc/sudoers.d, granting exact commands

Watch out for

usermod -G docker bob without -a, silently removing bob from sudo and every other group.

Check yourself

Why use visudo instead of editing /etc/sudoers with any editor?
You added alice to the docker group, but `docker ps` still says permission denied in her open session. Why?

Official docs: man7.org/linux/man-pages/man8/useradd.8.html

Example

Remember

Watch out for

Check yourself

Builds on

Unlocks