Manage users, groups and admin rights

• The prompt shows it: $ for a normal user, # for root.
• Use sudo COMMAND for one admin command, or sudo -i for a root shell when you have many tasks.
• Leave the root shell with exit as soon as you are done.

$su -
#exit
$su - lisa
$su -c 'tail /var/log/messages' -

• su - (with the dash) gives a full login shell: the new user's environment and home folder. Always use the dash.
• su without a user name means root.
• root can switch to any user without a password.

On RHEL, members of the group wheel may run everything:

%wheel  ALL=(ALL)       ALL

1. Give a user full admin rights by adding the user to wheel.

   #usermod -aG wheel lisa

2. Or give one user only some commands, in a separate file. Always edit with visudo, which checks the syntax before saving.

   #visudo -f /etc/sudoers.d/webadmins

   /etc/sudoers.d/webadmins

   %webadmins  ALL=(root)  /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd

3. Test it as that user.

   $sudo -l
   $sudo systemctl restart httpd

The rule format is: WHO WHERE=(AS_WHOM) COMMANDS. A % before the name means a group. NOPASSWD: before the commands means no password is asked.

• When a user without rights tries such an action, polkit asks for an admin password.
• Members of wheel count as administrators for polkit.
• pkexec COMMAND runs a command as root through polkit (like sudo, but with polkit rules).
• Rules are in /usr/share/polkit-1/ (do not change) and /etc/polkit-1/rules.d/ (your own).

$nmcli general permissions
$pkexec systemctl restart chronyd

lisa:x:1001:1001:Lisa Hassan:/home/lisa:/bin/bash

lisa:$6$aBc…:20385:0:90:7:::

Fields of shadow: user, password hash (! or !! = locked or no password), last change (days since 1970), min days, max days, warning days, inactive days, expire date.

1. Create a user with a full name.

   #useradd -c "Lisa Hassan" lisa

2. Set the password.

   #passwd lisa

3. Create a user with more settings in one go.

   #useradd -u 1500 -G wheel,webadmins -s /bin/bash -c "Omar Ali" omar

4. Create an account for a service that nobody logs in to.

   #useradd -r -s /sbin/nologin -d /var/lib/myapp myapp

$id omar
$getent passwd omar

#useradd -D
#useradd -D -s /bin/bash
$grep -E '^(UID_MIN|PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_WARN_AGE|CREATE_HOME|HOME_MODE)' /etc/login.defs

1. Make every new user get a file with company rules.

   #echo "Read the IT policy: https://intranet.example.com/policy" > /etc/skel/README.txt

2. Make new passwords expire after 90 days by default.

   #sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS   90/' /etc/login.defs

#usermod -aG webadmins lisa
#usermod -s /sbin/nologin olduser
#usermod -L lisa
#usermod -U lisa
#usermod -e 2026-12-31 contractor1
#usermod -l lisa.hassan lisa
#userdel -r contractor1

• -aG GROUP adds an extra group. Without -a, -G replaces all extra groups.
• -L / -U lock / unlock the password.
• -l NEW OLD renames the login (the home folder keeps its name unless you add -d NEWHOME -m).
• userdel -r also removes the home folder and the mail spool.

• Put files for all new users in /etc/skel (like .bashrc with company aliases).
• Settings for all users at every login: a file in /etc/profile.d/.
• Accounts that must not log in get the shell /sbin/nologin.

$ls -la /etc/skel
#usermod -s /sbin/nologin backup
#su - backup
This account is currently not available.

• The primary group is the group of new files a user makes. On RHEL each user gets a private group with the same name.
• Secondary groups give access to shared files and folders.
• Groups are in /etc/group (name, password placeholder, GID, members) and /etc/gshadow.

$id lisa
uid=1001(lisa) gid=1001(lisa) groups=1001(lisa),1100(webadmins)
$groups lisa
$getent group webadmins
webadmins:x:1100:lisa,omar

#groupadd webadmins
#groupadd -g 2000 dbadmins
#groupmod -n web-admins webadmins
#gpasswd -a lisa web-admins
#gpasswd -d lisa web-admins
#groupdel dbadmins

To edit the files by hand safely, use vigr (for /etc/group) and vipw (for /etc/passwd). They lock the files while you edit.

$getent group web-admins

• root (UID 0) can do everything; system accounts run services; normal users start at UID 1000.
• Use sudo for admin work: members of the wheel group may run all commands; own rules go in /etc/sudoers.d/ with visudo.
• User data is in /etc/passwd, passwords and aging in /etc/shadow, groups in /etc/group.
• useradd, usermod, userdel manage users; defaults come from /etc/login.defs and /etc/default/useradd; new home folders get the files of /etc/skel.
• passwd sets a password; chage sets password aging (-M max days, -m min days, -W warn, -E expire date).
• Every user has one primary group and can have secondary groups (usermod -aG group user).
• groupadd, groupmod, groupdel and gpasswd manage groups.