8

I'm basically asking about user management from the command line (e.g. on a system where there are no graphical tools available). In the past I've used several different programs to add or delete users and groups or to modify their attributes: adduser, useradd, usermod, gpasswd, and perhaps others I've forgotten. I've also heard a couple times that some of these programs are low-level and should be avoided for general use, but I can never remember which. So I'd like to get a definitive answer for which programs are the recommended ones for at least the following tasks:

  • Create a new user
  • Add a user to a group
  • Remove a user from a group
  • Change a user's primary group
  • Change a user's login shell or home directory
  • Delete a user

I'm looking for standard tools which I can expect to be available on pretty much any Linux system (of any distribution).

Improve this question
2
  • 1
    also groupmod. I'm not going to make this an answer.... but the most standard way is probably to use your text editor... remember the files affected are just delimited text. Commented Aug 19, 2010 at 1:53
  • Interestingly, prior to asking this question, I had never once seen so much as a mention of directly editing the files. (Somehow I had the impression that /etc/passwd was just one part of a complex system) Commented Aug 19, 2010 at 7:41

9 Answers 9

Reset to default
9

Sadly, none of those operations were ever standardized.

Some operating systems offer this functionality as part of the OS, like Linux, but even if your Linux system includes them, over time and across Linux distributions the tools and their names changed so you can not really depend on a standard set of tools to do those tasks.

You need to have a per-operating system set of tools.

Improve this answer
2
  • I've never had the names change... but I have had the switches change. I recall once finding out that a linux didn't have gpasswd -a. Commented Aug 19, 2010 at 1:52
  • 1
    If memory serves-- RedHat once used 'adduser' instead of 'useradd', and it behaved differently (I think useradd was more Debianish). They later made 'adduser' a symlink to 'useradd'. See some old references at redhat.com/docs/manuals/linux/RHL-5.2-Manual/install-guide/… Commented Aug 19, 2010 at 3:17
8

On Debian (and derived) systems, adduser and deluser are higher-level wrappers around useradd and related functionality. The cover user creation, group membership addition and subtraction, and user deletion. The corresponding commands from making/deleting groups are, sensibly enough, addgroup and delgroup. usermod appears to cover the remaining use case you name.

UPDATE: these are the standard commands (examples):

>useradd -m john -m = creates home directory >userdel -r john -r = removes home directory >groupadd devs >groupdel devs >usermod -a -G devs john -a = append -G = group name >id john lists the users id and group ids >groups john lists the users groups >passwd john will ask you for current password and new password >sudo passwd john will ask you for only new password >sudo passwd -l john will lock the user out >sudo passwd -a -G sudo john or >sudo passwd -a -G wheel john or >sudo nano /etc/sudoders different OS variants, adds user to the sudo group wheel = CENTOS/RHEL
Improve this answer
6

You mention Linux in the last part of your question, but since the title is generic I'll answer for FreeBSD.

FreeBSD has similar commands as Linux but they are commands passed to the pw utility: 

pw useradd [user|uid] ... pw usermod [user|uid] ...

and so on. However, one can parse the command into two parts: user and mod; a noun and a verb. Moreover, one can also use group and del:

pw groupdel [group|gid] ...

to, for example, delete a group. So here's what I think is really cool: the order doesn't matter, nor does the spacing! What this means, is that you can remember what to call by thinking about what you want to do (in English anyway):

pw del user [user|uid] ... pw mod group [group|gid] ... pw show user [user|uid] ... pw next user [user|uid] ...

and more! The pw utility also lets you lock and unlock accounts:

pw lock [user|uid] ... pw unlock [user|uid] ...

Options and any parameters that you pass are all standardized (although don't always apply to call commands) so memorization is minimized. All in all a nice way to do things.

Note: the ellipses in the above examples represent options and parameters passed to pw not additional users or groups.

Improve this answer
3
  • It was a Linux question but the information is appreciated anyway. It would be great if Linux had something like this. Commented Aug 19, 2010 at 3:19
  • Noun and verb, you mean. Commented Aug 19, 2010 at 13:19
  • D'oh! Fixed it. Commented Aug 19, 2010 at 13:44
2

Just for completeness, in the low-level end of the spectrum I'd mention vipw(8) and vigr(8), just above "vi /etc/passwd" and "cat > /etc/passwd" but right below "useradd". Oh, and they exist in most Unix variants.

Improve this answer
2

All of these tools are ultimately built to edit text files for you. If you want to know how to manage users and groups over systems, you should get familiar with these underlying text files. Lucky for you, there's just two of them, /etc/passwd and /etc/group. There are also complementary /etc/shadow and /etc/gshadow files for shadowing passwd and group respectively.

Improve this answer
1
  • 4
    ...and /etc/shadow, since most systems will croak if i is inconsistent with /etc/passwd Commented Aug 19, 2010 at 11:03
1

In many situations, knowing how to edit "/etc/passwd" is still useful.

Improve this answer
2
  • 1
    Knowing how to read /etc/passwd is useful, but modifying it directly is a bad practice. On some *ixes I've used (modern SysV, OS X...) these files aren't the primary place the user and group data is stored. They're either shadow copies for compatibility, or they are primary sources but there is a database or index that needs to be updated whenever they change. On those systems, if you don't update the files through the official tools, the changes won't immediately take effect, if ever they do. Commented Aug 19, 2010 at 13:21
  • Just don't munge /etc/passwd Commented Aug 19, 2010 at 17:02
1

If you are using a backend other than the default local machine backend - OpenLDAP being the most common - then cpu (change password utility) might be the command you are looking for. It can be run on machines other than the LDAP master if configured correctly, and it's syntax is mostly just the same as useradd etc with a prefix of cpu. So to add myself I could do

$ sudo cpu useradd hamish

See the cpu man page for more details.

Improve this answer
1
  • Interesting, but an answer that only applies on a machine which gets its user info from LDAP is of very limited use to me. Commented Aug 20, 2010 at 1:06
0

If your question was limited to

any Linux system (of any distribution)

but all of the systems have network access to a single server. You could use something like NIS or YP. So this answer is limited to admins within a single organization.

You still have the issue where almost every distribution has slightly different ways to configure YP, but configuration only happens once. Also, this type of network is not trivial.

Within a single site/network you will gain a lot doing this. In combination with automount, my favorite is being able to SSH to any *nix machine and have all my home files and tools available to me.

To the point, the distribution you choose for the master is the system you use for managing users. You then will have a single set of tools/documentation to manage users and groups.

It is even possible to use something like LDAP and samba tools on the master. Using samba also allows me to have my home files available to me on windows machines.

Improve this answer
1
  • Thanks, but I'm looking for an answer that applies just as well to non-networked systems. Commented Aug 20, 2010 at 1:07
0

The closest thing to a standard you'll get is vi /etc/passwd, vi /etc/shadow, and vi /etc/groups. (Heretics may substitute emacs.) Everything since then that I've found will only work on some systems.

Seriously, find out what tools your OS has, and use them. Just don't expect them to work the same on all systems. It would be nice if they were standardized, but they aren't.

Improve this answer
2
  • Using a text editor to edit configuration files that tools can, and should edit for you is not a standard. You should never use a text editor to change a configuration file, when the operating system, or application provides a utility to do this for you. This is especially true for /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. This is what the tools are for. Humans are prone to error, whereas tools have been tested and are (hopefully) bug-free. Commented Aug 19, 2010 at 23:04
  • Never call an editor on /etc/passwd and friends directly. Use vipw and vigr, which: lock the file against concurrent edition; run your favorite editor ($VISUAL); don't change the file if you make a syntax error; on some systems (e.g. FreeBSD) also regenerate other files that must be kept in sync. Commented Aug 20, 2010 at 13:34

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.