4.4. Using Command Line Tools

⁠4.4. Using Command Line Tools

The easiest say to manage users and groups on Fedora is to use the User Manager application as described in Section 4.3, “Using the User Manager Tool”. However, if you prefer command line tools or do not have the X Window System installed, you can use command line utilities that are listed in Table 4.1, “Command line utilities for managing users and groups”.

⁠

Table 4.1. Command line utilities for managing users and groups

Utilities	Description
`useradd`, `usermod`, `userdel`	Standard utilities for adding, modifying, and deleting user accounts.
`groupadd`, `groupmod`, `groupdel`	Standard utilities for adding, modifying, and deleting groups.
`gpasswd`	Standard utility for administering the `/etc/group` configuration file.
`pwck`, `grpck`	Utilities that can be used for verification of the password, group, and associated shadow files.
`pwconv`, `pwunconv`	Utilities that can be used for the conversion of passwords to shadow passwords, or back from shadow passwords to standard passwords.

⁠4.4.1. Adding a New User

To add a new user to the system, typing the following at a shell prompt as root:

useradd [options] username

…where options are command line options as described in Table 4.2, “useradd command line options”.

By default, the useradd command creates a locked user account. To unlock the account, run the following command as root to assign a password:

passwd username

Optionally, you can set password aging policy. See Section 4.4.3, “Enabling Password Aging” for information on how to enable password aging.

⁠

Table 4.2. useradd command line options

Option	Description
`-c` 'comment'	comment can be replaced with any string. This option is generally used to specify the full name of a user.
`-d` home_directory	Home directory to be used instead of default `/home/username/`.
`-e` date	Date for the account to be disabled in the format YYYY-MM-DD.
`-f` days	Number of days after the password expires until the account is disabled. If `0` is specified, the account is disabled immediately after the password expires. If `-1` is specified, the account is not be disabled after the password expires.
`-g` group_name	Group name or group number for the user's default group. The group must exist prior to being specified here.
`-G` group_list	List of additional (other than default) group names or group numbers, separated by commas, of which the user is a member. The groups must exist prior to being specified here.
`-m`	Create the home directory if it does not exist.
`-M`	Do not create the home directory.
`-N`	Do not create a user private group for the user.
`-p` password	The password encrypted with `crypt`.
`-r`	Create a system account with a UID less than 1000 and without a home directory.
`-s`	User's login shell, which defaults to `/bin/bash`.
`-u` uid	User ID for the user, which must be unique and greater than 999.

⁠ Explaining the Process

The following steps illustrate what happens if the command useradd juan is issued on a system that has shadow passwords enabled:

A new line for juan is created in /etc/passwd:
```
juan:x:501:501::/home/juan:/bin/bash
```
The line has the following characteristics:
- It begins with the username juan.
- There is an x for the password field indicating that the system is using shadow passwords.
- A UID greater than 999 is created. Under Fedora, UIDs below 1000 are reserved for system use and should not be assigned to users.
- A GID greater than 999 is created. Under Fedora, GIDs below 1000 are reserved for system use and should not be assigned to users.
- The optional GECOS information is left blank.
- The home directory for juan is set to /home/juan/.
- The default shell is set to /bin/bash.
A new line for juan is created in /etc/shadow:
```
juan:!!:14798:0:99999:7:::
```
The line has the following characteristics:
- It begins with the username juan.
- Two exclamation marks (!!) appear in the password field of the /etc/shadow file, which locks the account.
  Note
  If an encrypted password is passed using the -p flag, it is placed in the /etc/shadow file on the new line for the user.
- The password is set to never expire.
A new line for a group named juan is created in /etc/group:
```
juan:x:501:
```
A group with the same name as a user is called a user private group. For more information on user private groups, refer to Section 4.1.1, “User Private Groups”.
The line created in /etc/group has the following characteristics:
- It begins with the group name juan.
- An x appears in the password field indicating that the system is using shadow group passwords.
- The GID matches the one listed for user juan in /etc/passwd.
A new line for a group named juan is created in /etc/gshadow:
```
juan:!::
```
The line has the following characteristics:
- It begins with the group name juan.
- An exclamation mark (!) appears in the password field of the /etc/gshadow file, which locks the group.
- All other fields are blank.
A directory for user juan is created in the /home/ directory:
```
~]# ls -l /home
total 4
drwx------. 4 juan juan 4096 Mar  3 18:23 juan
```
This directory is owned by user juan and group juan. It has read, write, and execute privileges only for the user juan. All other permissions are denied.

The files within the /etc/skel/ directory (which contain default user settings) are copied into the new /home/juan/ directory. The contents of /etc/skel/ may vary depending on installed applications.

~]# ls -la /home/juan
total 28
drwx------. 4 juan juan 4096 Mar  3 18:23 .
drwxr-xr-x. 5 root root 4096 Mar  3 18:23 ..
-rw-r--r--. 1 juan juan   18 Jul 09 08:43 .bash_logout
-rw-r--r--. 1 juan juan  176 Jul 09 08:43 .bash_profile
-rw-r--r--. 1 juan juan  124 Jul 09 08:43 .bashrc
drwxr-xr-x. 4 juan juan 4096 Jul 09 08:43 .mozilla
-rw-r--r--. 1 juan juan  658 Jul 09 08:43 .zshrc

At this point, a locked account called juan exists on the system. To activate it, the administrator must next assign a password to the account using the passwd command and, optionally, set password aging guidelines.