Must-know cold
id · id USER · getent passwd USER · getent group GROUPsudo useradd -m -s /bin/bash USER · sudo passwd USERsudo usermod -aG GROUP USER (-a when appending; bare -G replaces the list)sudo visudo / visudo -f for sudoers · sudo -l- Group changes apply to new sessions (
id USER updates immediately; id in this shell does not)
Key files
Definition: Core identity files: passwd, shadow, group, sudoers.
| File | Role |
|---|
/etc/passwd | User account metadata (hash field is just x) |
/etc/shadow | Password hashes (root + group shadow) |
/etc/group | Groups (also /etc/gshadow) |
/etc/sudoers + /etc/sudoers.d/ | sudo policy. Drop-in names must not contain a . (deploy OK, deploy.conf ignored) |
Commands
id
Definition: Show user identity and group memberships for access debugging.
| Option | Argument | Meaning | Example |
|---|
| (none) | — | Current user identity | id |
| (none) | USER | That user’s identity | id jenkins |
-u / -un | — | UID / username | id -un |
-g / -gn | — | Primary GID / name | id -gn |
-G / -Gn | — | All groups IDs / names | id -Gn deploy |
Flag combos
| Combo | Meaning | Example |
|---|
id USER / id -Gn USER | Database membership (updates immediately) | |
id / id -Gn | This session’s groups (stale until re-login) | |
getent
Definition: Query system databases (passwd, group, hosts) via Name Service Switch.
| Option | Argument | Meaning | Example |
|---|
passwd | USER | Resolve user via nss (local/LDAP) | getent passwd jenkins |
group | GROUP | Resolve group | getent group docker |
shadow | USER | Shadow line (if permitted) | sudo getent shadow USER |
hosts | NAME | Host resolution | getent hosts api |
Flag combos
| Combo | Meaning | Example |
|---|
getent passwd USER | Prefer over grepping /etc/passwd | Network accounts |
useradd
Definition: Create a new user account (low-level; non-interactive).
| Option | Argument | Meaning | Example |
|---|
| (none) | USER | Create user (defaults vary by distro) | sudo useradd app |
-m | USER | Create home directory | sudo useradd -m app |
-d | HOME USER | Home path | sudo useradd -m -d /opt/app app |
-s | SHELL USER | Login shell | sudo useradd -s /bin/bash app |
-s | /usr/sbin/nologin USER | No login shell (/sbin/nologin on some distros). sudo -u and SSH forced commands still work | sudo useradd -r -s /usr/sbin/nologin svc |
-g | GROUP USER | Primary group | sudo useradd -g app app |
-G | G1,G2 USER | Supplementary groups at create | sudo useradd -G docker app |
-u | UID USER | Specific UID | sudo useradd -u 1100 app |
-r | USER | System account (low UID) | sudo useradd -r svc |
-c | COMMENT USER | GECOS/comment field | sudo useradd -c 'CI agent' agent |
-e | YYYY-MM-DD USER | Account expiry date | sudo useradd -e 2026-12-31 c |
Flag combos
| Combo | Meaning | Example |
|---|
useradd -m -s /bin/bash -c 'Dev' devuser | Human account baseline | |
useradd -r -s /usr/sbin/nologin -d /nonexistent svc | Service user | |
Debian often prefers adduser (friendlier, interactive); useradd is the portable low-level tool.
usermod
Definition: Modify an existing user (groups, shell, lock, home, rename).
| Option | Argument | Meaning | Example |
|---|
-aG | GROUP USER | Append supplementary group(s) | sudo usermod -aG docker u |
-G | G1,G2 USER | Replace supplementary list (primary -g is unchanged) | Dangerous without -a |
-l | NEW OLD | Rename login only (home/mail/group stay) | sudo usermod -l new old |
-d | HOME USER | Home path | sudo usermod -d /new/home u |
-m | — | With -d: move home contents | sudo usermod -d /new -m u |
-s | SHELL USER | Change shell | sudo usermod -s /bin/bash u |
-L | USER | Lock password (! prefix). SSH keys still work | sudo usermod -L u |
-U | USER | Unlock password | sudo usermod -U u |
-e | DATE USER | Expiry | sudo usermod -e 2026-01-01 u |
-g | GROUP USER | Primary group | sudo usermod -g staff u |
-c | COMMENT USER | Comment | sudo usermod -c 'x' u |
Flag combos
| Combo | Meaning | Example |
|---|
usermod -aG GROUP USER | Safe add group | Always -a with -G for add |
usermod -L USER | Lock without delete | Offboarding temp |
userdel
Definition: Delete a user account (optionally remove home).
| Option | Argument | Meaning | Example |
|---|
| (none) | USER | Delete account; keep home by default | sudo userdel u |
-r | USER | Remove home + mail spool | sudo userdel -r u |
-f | USER | Force even if logged in (dangerous) | Avoid casually |
Flag combos
| Combo | Meaning | Example |
|---|
| Stop processes first | pkill -u USER then userdel -r | Clean removal |
groupadd
Definition: Create/delete groups and manage membership (groupdel, gpasswd).
| Command | Argument | Meaning | Example |
|---|
groupadd | GROUP | Create group | sudo groupadd deploy |
groupadd -g | GID GROUP | Specific GID | sudo groupadd -g 2001 deploy |
groupdel | GROUP | Delete group (fails if it is someone’s primary group) | sudo groupdel deploy |
gpasswd -a | USER GROUP | Add user to group | sudo gpasswd -a u deploy |
gpasswd -d | USER GROUP | Remove user from group | sudo gpasswd -d u deploy |
gpasswd -A | USER GROUP | Group admins | Rare |
Flag combos
| Combo | Meaning | Example |
|---|
groupadd deploy && usermod -aG deploy u | New shared group | |
passwd
Definition: Set or lock a user’s login password.
| Option | Argument | Meaning | Example |
|---|
| (none) | — | Change your password | passwd |
| (none) | USER | Set USER password (root) | sudo passwd jenkins |
-l | USER | Lock password (not the account; SSH keys still work) | sudo passwd -l u |
-u | USER | Unlock password (fails if there was never a hash) | sudo passwd -u u |
-d | USER | Delete password (empty; careful) | Avoid |
-e | USER | Expire password; force change next login | sudo passwd -e u |
-S | USER | Status of password | sudo passwd -S u |
-n | DAYS USER | Min days between changes | sudo passwd -n 1 u |
-x | DAYS USER | Max password age | sudo passwd -x 90 u |
Flag combos
| Combo | Meaning | Example |
|---|
passwd -e USER | Force reset on next login | Contractor onboarding |
chage
Definition: View or change password aging and account expiry.
| Option | Argument | Meaning | Example |
|---|
-l | USER | List ageing info | sudo chage -l u |
-E | DATE USER | Account expire | sudo chage -E 2026-12-31 u |
-M | DAYS USER | Max password age | sudo chage -M 90 u |
-m | DAYS USER | Min password age | sudo chage -m 1 u |
-W | DAYS USER | Warn before expiry | sudo chage -W 7 u |
-I | DAYS USER | Inactive after password expires (not account -E) | sudo chage -I 14 u |
-d | DATE USER | Last password change. 0 ≈ force change next login (passwd -e) | sudo chage -d 0 u |
Flag combos
| Combo | Meaning | Example |
|---|
chage -l USER | Audit expiry | |
sudo
Definition: Run commands as another user (usually root); edit sudoers safely with visudo.
| Option / command | Argument | Meaning | Example |
|---|
sudo | CMD | Run CMD as root (default) | sudo systemctl status nginx |
sudo -u | USER CMD | Run as another user | sudo -u jenkins whoami |
sudo -i | — | Login shell as target (usually root): HOME/cwd/profile like a real login | sudo -i |
sudo -s | — | Shell as target (env_reset still applies; not a login) | sudo -s |
sudo -l | — | List your allowed sudo rules | sudo -l |
sudo -k | — | Invalidate cached credentials | sudo -k |
sudo -v | — | Extend/validate timestamp | sudo -v |
sudo -n | CMD | Non-interactive; fail if password needed | sudo -n true |
sudo -E | CMD | Preserve environment (careful) | sudo -E cmd |
sudo -g | GROUP CMD | Set group | Rare |
visudo | — | Edit sudoers with syntax check | sudo visudo |
visudo -f | FILE | Edit drop-in under sudoers.d | sudo visudo -f /etc/sudoers.d/deploy |
visudo -c | — | Check syntax only | sudo visudo -c |
Flag combos
| Combo | Meaning | Example |
|---|
sudo -u app -H bash -lc 'cmd' | Simulate service user | Works-manual, fails-systemd RCA |
Never chmod 777 instead of sudo design | Least privilege | |
sudoers idea (narrow): deploy ALL=(ALL) NOPASSWD: /bin/systemctl restart myapp — avoid NOPASSWD: ALL.
session helpers
Definition: who / w / last helpers for who is logged in and recent logins.
| Command | Argument | Meaning | Example |
|---|
whoami | — | Effective username | whoami |
who | — | Logged-in users | who |
w | — | Who + load + what running | w |
last | — | Login history | last -n 20 |
lastlog | — | Last login per user | lastlog | head |
groups | — | Groups of current/user | groups · groups u |
Common recipes
| Goal | Command |
|---|
| Create human user | sudo useradd -m -s /bin/bash devuser && sudo passwd devuser |
| Service user | sudo useradd -r -s /usr/sbin/nologin -d /nonexistent svc |
| Add to docker group | sudo usermod -aG docker $USER then re-login |
| Verify groups | id -Gn USER |
| Lock password | sudo usermod -L USER or passwd -l |
| Disable account | sudo usermod -e 1 USER (expire 1970-01-02) + lock / nologin |
| Delete with home | sudo userdel -r USER |
| What can I sudo? | sudo -l |
| Edit sudo safely | sudo visudo |
| Run as app user | sudo -u app -H command |
Pitfalls
usermod -G without -a replaces the supplementary list (primary group stays). For add, always -aG.id USER shows the database immediately; this shell still has the old groups until re-login (newgrp / sg / su - as a shortcut).passwd -l / usermod -L lock the password, not SSH keys. To disable the account use expiry (usermod -e 1) and/or nologin.nologin / false blocks an interactive login shell. sudo -u svc cmd and SSH command= / keys can still run.useradd defaults differ by distro (Debian: no home and often sh unless you pass -m -s). Prefer adduser only on Debian/Ubuntu.usermod -l does not rename the home directory or the user-private group.groupdel refuses if the group is anyone’s primary group.userdel -r is irreversible for home/mail — stop processes first (pkill -u).- Broken sudoers can lock out sudo users (root console still works). Only
visudo / visudo -f. Files in sudoers.d with a dot in the name are ignored.
NOPASSWD: ALL is a major security smell on shared hosts.- Docker group ≈ root (docker.sock) — say so in interviews.
For more details, try man <command> in your terminal.