Manage Linux users and groups

A server shared by several people or applications must not rely on a single root account. One user per person makes actions traceable and lets you revoke access without changing everyone's password. Groups organise rights, and service accounts run daemons without an interactive shell.

Create and remove an account

On Debian 13, adduser is the friendly command:

sudo adduser alice
sudo adduser alice sudo

adduser alice creates the home, asks for a password and configures the account. The second command adds it to the sudo group, which allows privilege escalation. The admin group is sudo. Check with id alice and groups alice.

Removal:

sudo deluser --remove-home alice
sudo userdel -r alice

--remove-home and -r delete the home and mail spool. Without them, files remain and a future account with the same UID could access them.

Groups and sudo

sudo groupadd projects
sudo usermod -aG projects alice
getent group projects
sudo -l -U alice

-aG is essential: usermod -G without -a replaces all secondary groups. Membership applies at the next login; newgrp projects opens a shell with the new group for an immediate test.

For sudo, do not edit /etc/sudoers directly:

sudo visudo -f /etc/sudoers.d/alice

Minimal example:

alice ALL=(ALL) ALL

visudo validates syntax before saving, which prevents breaking sudo. Reserve NOPASSWD for precise automation, never for a human account.

Service accounts and audit

Daemons should run with an unprivileged account and no shell:

sudo useradd --system --home /srv/my-app --shell /usr/sbin/nologin app
sudo chown -R app:app /srv/my-app

Then, in the systemd unit: User=app and Group=app. A --system account has no usable password and does not appear in normal login listings.

Regular audit:

awk -F: '($3==0){print $1}' /etc/passwd
getent passwd
last -n 20
lastlog
sudo passwd -S alice
sudo chage -l alice

Only root should have UID 0. passwd -S shows whether an account is locked (L) or active (P), and chage -l shows password expiry. Remove unused accounts and any keys in ~/.ssh/authorized_keys you do not recognise.

Verify

id alice
sudo -l -U alice
sudo getent group sudo

id must show the expected groups, sudo -l the allowed commands. Test a real login with the new account before closing your root session. If a service stops starting after an ownership change, check User= in its unit and the permissions of its working directory.