Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Fedora User Docs / System Administrator’s Guide /

en-US
How to edit /this
Basic System Configuration page Users and Groups
Managing Search Docs In this section

Contents
Introduction to Users and Groups
User Private Groups
Shadow Passwords
Managing Users in a Graphical Environment
Using the Users Settings Tool
Using Command Line Tools
Adding a New User
Adding a New Group
Enabling Password Aging
Enabling Automatic Logouts
Creating Group Directories
Additional Resources

Managing Users and Groups

Contents
Introduction to Users and Groups
User Private Groups
Shadow Passwords
Managing Users in a Graphical Environment
Using the Users Settings Tool
Using Command Line Tools
Adding a New User
Adding a New Group
Enabling Password Aging
Enabling Automatic Logouts
Creating Group Directories
Additional Resources

The control of users and groups is a core element of Fedora system administra-

1 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

tion. This chapter explains how to add, manage, and delete users and groups in
How to edit this page In this section
the graphical user interface and on the command line, and covers advanced
topics, such as creating group directories.

Introduction to Users and Groups

While users can be either people (meaning accounts tied to physical users) or
accounts which exist for specific applications to use, groups are logical expres-
sions of organization, tying users together for a common purpose. Users within
a group share the same permissions to read, write, or execute files owned by
that group.

Each user is associated with a unique numerical identification number called a

user ID (UID). Likewise, each group is associated with a group ID (GID). A user
who creates a file is also the owner and group owner of that file. The file is as-
signed separate read, write, and execute permissions for the owner, the group,
and everyone else. The file owner can be changed only by root , and access
permissions can be changed by both the root user and file owner.

Additionally, Fedora supports access control lists (ACLs) for files and directories
which allow permissions for specific users outside of the owner to be set. For
more information about this feature, see the Access Control Lists chapter of the
Red Hat Enterprise Linux 7 System Administrators Guide.

User Private Groups

Fedora uses a user private group (UPG) scheme, which makes UNIX groups eas-
ier to manage. A user private group is created whenever a new user is added to
the system. It has the same name as the user for which it was created and that
user is the only member of the user private group.

User private groups make it safe to set default permissions for a newly created
file or directory, allowing both the user and the group of that user to make
modifications to the file or directory.

The setting which determines what permissions are applied to a newly created

2 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

file or directory is called a umask and is configured in the /etc/bashrc file.

How to edit this page In this section
Traditionally on UNIX-based systems, the umask is set to 022, which allows only
the user who created the file or directory to make modifications. Under this
scheme, all other users, including members of the creator’s group, are not
allowed to make any modifications. However, under the UPG scheme, this
“group protection” is not necessary since every user has their own private
group.

A list of all groups is stored in the /etc/group configuration file.

Shadow Passwords
In environments with multiple users, it is very important to use shadow pass-
words provided by the shadow-utils package to enhance the security of system
authentication files. For this reason, the installation program enables shadow
passwords by default.

The following is a list of the advantages shadow passwords have over the tradi-
tional way of storing passwords on UNIX-based systems:

Shadow passwords improve system security by moving encrypted password

hashes from the world-readable /etc/passwd file to /etc/shadow , which is
readable only by the root user.

Shadow passwords store information about password aging.

Shadow passwords allow the /etc/login.defs file to enforce security poli-
cies.

Most utilities provided by the shadow-utils package work properly whether or

not shadow passwords are enabled. However, since password aging informa-
tion is stored exclusively in the /etc/shadow file, some utilities and commands
do not work without first enabling shadow passwords:

The chage utility for setting password-aging parameters. For details, see the
Password Security section in the Red Hat Enterprise Linux 7 Security Guide.

The gpasswd utility for administrating the /etc/group file.

The usermod command with the -e, --expiredate or -f, --inactive op-

3 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

tion.
How to edit this page In this section
The useradd command with the -e, --expiredate or -f, --inactive op-
tion.

Managing Users in a Graphical

Environment
The Users utility allows you to view, modify, add, and delete local users in the
graphical user interface.

Using the Users Settings Tool

Press the Super key to enter the Activities Overview, type Users and then
press Enter . The Users settings tool appears. The Super key appears in a
variety of guises, depending on the keyboard and other hardware, but often as
either the Windows or Command key, and typically to the left of the Spacebar.

To make changes to the user accounts, first select the [ Unlock ] button and au-
thenticate yourself as indicated by the dialog box that appears. Note that un-
less you have superuser privileges, the application will prompt you to authenti-
cate as root . To add and remove users, select the [ + ] and [ - ] button respec-
tively. To add a user to the administrative group wheel , change the Account
Type from Standard to Administrator . To edit a user’s language setting, select
the language and a drop-down menu appears.

4 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Figure 1. The Users Settings Tool

The commandline for call this Gui is : [user@domain ~]$ kcmshell5 user_man-
ager When a new user is created, the account is disabled until a password is
set. The Add User menu contains the options to set a password by the adminis-
trator immediately, or to allow the user to choose a password at the first login.

Using Command Line Tools

Apart from the Users settings tool described in Managing Users in a Graphical
Environment, which is designed for basic managing of users, you can use com-
mand line tools for managing users and groups that are listed in Command line
utilities for managing users and groups.

Table 1. Command line utilities for managing users and groups

Utilities Description

id Displays user and group IDs.

useradd, usermod, userdel Standard utilities for adding, modifying, and

deleting user accounts.

groupadd, groupmod, groupdel Standard utilities for adding, modifying, and

deleting groups.

gpasswd Standard utility for administering the

/etc/group configuration file.

pwck, grpck Utilities that can be used for verification of the

password, group, and associated shadow files.

5 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Utilities Description
How to edit this page In this section

pwconv, pwunconv Utilities that can be used for the conversion of

passwords to shadow passwords, or back from
shadow passwords to standard passwords.

grpconv, grpunconv Similar to the previous, these utilities can be

used for conversion of shadowed information
for group accounts.

Adding a New User

To add a new user to the system, type the following at a shell prompt as root :

useradd options username

…where options are command-line options as described in Common useradd

command-line options. By default, the useradd command creates a locked user
account. To unlock the account, run the following command as root to assign a
password:

passwd username

Optionally, you can set a password aging policy. See Enabling Password Aging
for information on how to enable password aging.

Table 2. Common useradd command-line options

Option Description

-c  'comment' comment can be replaced with any string. This

option is generally used to specify the full name
of a user.

-d home_directory Home directory to be used instead of default

/home/username/ .

-e date Date for the account to be disabled in the for-

mat YYYY-MM-DD.

6 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Option Description
How to edit this page In this section

-f days Number of days after the password expires un-

til the account is disabled. If 0 is specified, the
account is disabled immediately after the pass-
word expires. If -1 is specified, the account is
not disabled after the password expires.

-g group_name Group name or group number for the user’s de-

fault (primary) group. The group must exist
prior to being specified here.

-G group_list List of additional (supplementary, other than

default) group names or group numbers, sepa-
rated by commas, of which the user is a mem-
ber. The groups must exist prior to being speci-
fied here.

-m Create the home directory if it does not exist.

-M Do not create the home directory.

-N Do not create a user private group for the user.

-p password The password encrypted with crypt.

-r Create a system account with a UID less than

1000 and without a home directory.

-s User’s login shell, which defaults to /bin/bash.

-u uid User ID for the user, which must be unique and

greater than 999.

The command-line options associated with the usermod command are essen-
tially the same. Note that if you want to add a user to another supplementary
group, you need to use the -a, --append option with the -G option. Otherwise
the list of supplementary groups for the user will be overwritten by those speci-
fied with the usermod -G command.

Explaining the Process

The following steps illustrate what happens if the command useradd juan is is-
sued on a system that has shadow passwords enabled:

7 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

A new line for juan is created in /etc/passwd :

How to edit this page In this section

juan:x:1001:1001::/home/juan:/bin/bash

The line has the following characteristics:

It begins with the user name juan .

There is an x for the password field indicating that the system is using
shadow passwords.
A UID greater than 999 is created. Under Fedora, UIDs below 1000 are
reserved for system use and should not be assigned to users.
A GID greater than 999 is created. Under Fedora, GIDs below 1000 are
reserved for system use and should not be assigned to users.

The optional GECOS information is left blank. The GECOS field can be
used to provide additional information about the user, such as their full
name or phone number.
The home directory for juan is set to /home/juan/ .

The default shell is set to /bin/bash.

A new line for juan is created in /etc/shadow :

juan:!!:14798:0:99999:7:::

The line has the following characteristics:

It begins with the username juan .

Two exclamation marks ( !! ) appear in the password field of the

/etc/shadow file, which locks the account.

Note
Note
If an encrypted password is passed using the -p flag, it is placed in the
/etc/shadow file on the new line for the user.

8 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

The password is set to never expire.

How to edit this page In this section
A new line for a group named juan is created in /etc/group :

juan:x:1001:

A group with the same name as a user is called a user private group. For
more information on user private groups, see User Private Groups.

The line created in /etc/group has the following characteristics:

It begins with the group name juan .

An x appears in the password field indicating that the system is using

shadow group passwords.
The GID matches the one listed for juan 's primary group in
/etc/passwd .

A new line for a group named juan is created in /etc/gshadow :

juan:!::

The line has the following characteristics:

It begins with the group name juan .

An exclamation mark ( ! ) appears in the password field of the

/etc/gshadow file, which locks the group.

All other fields are blank.

A directory for user juan is created in the /home/ directory:

~]# ls -ld /home/juan

drwx------. 4 juan juan 4096 Mar 3 18:23 /home/juan

This directory is owned by user juan and group juan . It has read, write,
and execute privileges only for the user juan . All other permissions are de-
nied.

9 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

The files within the /etc/skel/ directory (which contain default user set-
How to edit this page In this section
tings) are copied into the new /home/juan/ directory. The contents of
/etc/skel/ may vary depending on installed applications:

~]# ls -la /home/juan

total 24
drwx------. 4 juan juan 4096 Mar 3 18:23 .
drwxr-xr-x. 5 root root 4096 Mar 3 18:23 ..
-rw-r--r--. 1 juan juan 18 Jul 09 08:43 .bash_logout
-rw-r--r--. 1 juan juan 176 Jul 09 08:43 .bash_profile
-rw-r--r--. 1 juan juan 124 Jul 09 08:43 .bashrc
drwxr-xr-x. 4 juan juan 4096 Jul 09 08:43 .mozilla

At this point, a locked account called juan exists on the system. To activate it,
the administrator must next assign a password to the account using the
passwd command and, optionally, set password aging guidelines.

Adding a New Group

To add a new group to the system, type the following at a shell prompt as root :

groupadd options group_name

…where options are command-line options as described in Common groupadd

command-line options.

Table 3. Common groupadd command-line options

Option Description

-f , --force When used with -g gid and gid already exists,

groupadd will choose another unique gid for the
group.

-g gid Group ID for the group, which must be unique

and greater than 999.

-K , --key key=value Override /etc/login.defs defaults.

10 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Option Description
How to edit this page In this section

-o , --non-unique Allows creating groups with duplicate GID.

-p , --password password Use this encrypted password for the new group.

-r Create a system group with a GID less than

1000.

Enabling Password Aging

For security reasons, it is advisable to require users to change their passwords
periodically. This can be done by using the chage command.

Important
Shadow passwords must be enabled to use chage
Shadow passwords must be enabled to use the chage command. For more informa-
tion, see Shadow Passwords.

To configure password expiration for a user from a shell prompt, run the fol-
lowing command as root :

chage options username

…where options are command line options as described in chage command line
options. When the chage command is followed directly by a username (that is,
when no command line options are specified), it displays the specified users
current password aging values and allows you to change these values interac-
tively.

Table 4. chage command line options

Option Description

-d days Specifies the number of days since January 1,

1970 the password was changed.

11 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Option Description
How to edit this page In this section

-E date Specifies the date on which the account is

locked, in the format YYYY-MM-DD. Instead of
the date, the number of days since January 1,
1970 can also be used.

-I days Specifies the number of inactive days after the

password expiration before locking the account.
If the value is 0 , the account is not locked after
the password expires.

-l Lists current account aging settings.

-m days Specify the minimum number of days after

which the user must change passwords. If the
value is 0 , the password does not expire.

-M days Specify the maximum number of days for which

the password is valid. When the number of days
specified by this option plus the number of days
specified with the -d option is less than the
current day, the user must change passwords
before using the account.

-W days Specifies the number of days before the pass-

word expiration date to warn the user.

You can configure a password to expire the first time a user logs in. This forces
users to change passwords immediately.

Set up an initial password. There are two common approaches to this step:
you can either assign a default password, or you can use a null password.

To assign a default password, type the following at a shell prompt as root :

passwd username

To assign a null password instead, use the following command:

12 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

passwd -d username
How to edit this page In this section

Warning
Avoid using null passwords whenever possible
Using a null password, while convenient, is a highly insecure practice, as any
third party can log in first and access the system using the insecure username.
Always make sure that the user is ready to log in before unlocking an account
with a null password.

Force immediate password expiration by running the following command

as root :

chage -d 0 username

This command sets the value for the date the password was last changed
to the epoch (January 1, 1970). This value forces immediate password expi-
ration no matter what password aging policy, if any, is in place.

Upon the initial log in, the user is now prompted for a new password.

Enabling Automatic Logouts

Especially when the user is logged in as root , an unattended login session may
pose a significant security risk. To reduce this risk, you can configure the system
to automatically log out idle users after a fixed period of time:

Make sure the screen package is installed. You can do so by running the
following command as root :

dnf install screen

For more information on how to install packages in Fedora, refer to

Installing Packages.
As root , add the following line at the beginning of the /etc/profile file to

13 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

make sure the processing of this file cannot be interrupted:

How to edit this page In this section

trap "" 1 2 3 15

Add the following lines at the end of the /etc/profile file to start a screen
session each time a user logs in to a virtual console or remotely:

SCREENEXEC="screen"
if [ -w $(tty) ]; then
trap "exec $SCREENEXEC" 1 2 3 15
echo -n 'Starting session in 10 seconds'
sleep 10
exec $SCREENEXEC
fi

Note that each time a new session starts, a message will be displayed and
the user will have to wait ten seconds. To adjust the time to wait before
starting a session, change the value after the sleep command.

Add the following lines to the /etc/screenrc configuration file to close the
screen session after a given period of inactivity:

idle 120 quit

autodetach off

This will set the time limit to 120 seconds. To adjust this limit, change the
value after the idle directive.

Alternatively, you can configure the system to only lock the session by using
the following lines instead:

idle 120 lockscreen

autodetach off

This way, a password will be required to unlock the session.

The changes take effect the next time a user logs in to the system.

14 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Creating Group Directories

How to edit this page In this section

System administrators usually like to create a group for each major project and
assign people to the group when they need to access that project’s files. With
this traditional scheme, file management is difficult; when someone creates a
file, it is associated with the primary group to which they belong. When a single
person works on multiple projects, it becomes difficult to associate the right
files with the right group. However, with the UPG scheme, groups are automati-
cally assigned to files created within a directory with the setgid bit set. The set-
gid bit makes managing group projects that share a common directory very
simple because any files a user creates within the directory are owned by the
group that owns the directory.

For example, a group of people need to work on files in the /opt/myproject/ di-
rectory. Some people are trusted to modify the contents of this directory, but
not everyone.

As root , create the /opt/myproject/ directory by typing the following at a

shell prompt:

mkdir /opt/myproject

Add the myproject group to the system:

groupadd myproject

Associate the contents of the /opt/myproject/ directory with the mypro-

ject group:

chown root:myproject /opt/myproject

Allow users in the group to create files within the directory and set the set-
gid bit:

chmod 2775 /opt/myproject

15 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

At this point, all members of the myproject group can create and edit files
How to edit this page In this section
in the /opt/myproject/ directory without the administrator having to
change file permissions every time users write new files. To verify that the
permissions have been set correctly, run the following command:

~]# ls -ld /opt/myproject

drwxrwsr-x. 3 root myproject 4096 Mar 3 18:31 /opt/myproject

Add users to the myproject group:

usermod -aG myproject username

Additional Resources
For more information on how to manage users and groups on Fedora, see the
resources listed below.

Installed Documentation
For information about various utilities for managing users and groups, see the
following manual pages:

useradd (8) — The manual page for the useradd command documents how
to use it to create new users.
userdel (8) — The manual page for the userdel command documents how
to use it to delete users.
usermod (8) — The manual page for the usermod command documents how
to use it to modify users.
groupadd (8) — The manual page for the groupadd command documents
how to use it to create new groups.
groupdel (8) — The manual page for the groupdel command documents
how to use it to delete groups.
groupmod (8) — The manual page for the groupmod command documents

16 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

how to use it to modify group membership.

How to edit this page In this section
gpasswd (1) — The manual page for the gpasswd command documents how
to manage the /etc/group file.

grpck (8) — The manual page for the grpck command documents how to
use it to verify the integrity of the /etc/group file.

pwck (8) — The manual page for the pwck command documents how to use
it to verify the integrity of the /etc/passwd and /etc/shadow files.

pwconv (8) — The manual page for the pwconv, pwunconv, grpconv, and gr-
punconv commands documents how to convert shadowed information for
passwords and groups.
id (1) — The manual page for the id command documents how to display
user and group IDs.

For information about related configuration files, see:

group (5) — The manual page for the /etc/group file documents how to use
this file to define system groups.
passwd (5) — The manual page for the /etc/passwd file documents how to
use this file to define user information.
shadow (5) — The manual page for the /etc/shadow file documents how to
use this file to set passwords and account expiration information for the sys-
tem.

Want to help? Learn how to contribute to Fedora Docs ›

All Fedora Documentation content available under CC BY-SA 4.0 or, when specifically noted, under
another accepted free and open content license.

17 of 18 27-06-2023, 01:43 pm
Managing Users and Groups :: Fedora Docs https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators...

Privacy Statement Legal Code of Conduct Sponsors

How to edit this page In this section

Last build: 2023-06-27 06:50:09 UTC | Last content update: 2023-01-12

Fedora is sponsored by Red Hat.

Learn more about the relationship between Red Hat and Fedora.

18 of 18 27-06-2023, 01:43 pm