Every person and every service on a server should have its own account. Creating users is quick, but Linux has two commands for it — adduser and useradd — that behave differently. Here’s when to use each.

adduser vs useradd

adduser useradd
Type Friendly interactive script (Debian/Ubuntu) Low-level tool (all distributions)
Creates home directory Yes Only with -m (or per distro defaults)
Asks for a password Yes No — set it with passwd
Default shell /bin/bash Often /bin/sh unless -s is given
Best for Creating people interactively on Debian/Ubuntu Scripts, and RHEL-family systems

On AlmaLinux and Rocky, adduser is just a link to useradd, so learn useradd’s options too.

Create a regular user

Debian/Ubuntu, interactive:

sudo adduser alice

It creates the user and group alice, the home directory /home/alice (copied from /etc/skel), and asks for a password and optional details.

Any distribution, with useradd:

sudo useradd -m -s /bin/bash -c "Alice Example" alice
sudo passwd alice
  • -m — create the home directory.
  • -s /bin/bash — login shell.
  • -c — comment (full name).

Give the user sudo rights

sudo usermod -aG sudo alice        # Debian/Ubuntu
sudo usermod -aG wheel alice       # AlmaLinux/Rocky/Fedora

-aG appends to supplementary groups. Without -a, -G replaces all of the user’s groups — a classic mistake that can remove someone from docker or www-data. The user must log out and back in for new groups to apply. See sudo and sudoers.

Set up SSH key login for the user

sudo mkdir -p /home/alice/.ssh
sudo nano /home/alice/.ssh/authorized_keys      # paste alice's public key
sudo chown -R alice:alice /home/alice/.ssh
sudo chmod 700 /home/alice/.ssh
sudo chmod 600 /home/alice/.ssh/authorized_keys

See SSH keys with ssh-keygen.

Create a system user for a service

Applications should run as dedicated, unprivileged users with no login shell and no password:

sudo useradd --system --no-create-home --shell /usr/sbin/nologin myapp
# or with a home directory for the app's data:
sudo useradd --system --create-home --home-dir /srv/myapp --shell /usr/sbin/nologin myapp

Debian/Ubuntu equivalent:

sudo adduser --system --group --home /srv/myapp myapp

System users get a UID below 1000 and don’t appear on login screens. If the service is compromised, the attacker is confined to what myapp can access.

Other useful useradd options

sudo useradd -m -u 1500 -g developers -G docker,www-data -e 2026-12-31 bob
  • -u 1500 — specific UID (keep UIDs consistent across servers sharing files over NFS).
  • -g developers — primary group (must exist).
  • -G docker,www-data — supplementary groups.
  • -e 2026-12-31 — account expiry date (contractors, temporary access).
  • -d /data/bob — custom home path.

Check defaults with useradd -D and in /etc/login.defs.

Check a user

id alice
getent passwd alice
groups alice
sudo chage -l alice          # password ageing and expiry
lastlog -u alice             # last login

Modify a user

sudo usermod -s /bin/zsh alice              # change shell
sudo usermod -l alicia alice                # rename the login
sudo usermod -d /home/alicia -m alicia      # move the home directory
sudo usermod -L alice                       # lock the password
sudo usermod -U alice                       # unlock
sudo usermod -e 1 alice                     # expire the account (blocks SSH key logins too)

usermod -L only locks the password — SSH keys still work. To block all logins, expire the account (-e 1) or set the shell to nologin, and remove keys. More in usermod.

Delete a user

sudo deluser alice                    # Debian/Ubuntu, keeps the home directory
sudo deluser --remove-home alice
sudo userdel -r alice                 # any distribution, removes home and mail spool

Before deleting, check for running processes (pgrep -u alice), cron jobs (sudo crontab -u alice -l) and files elsewhere:

sudo find / -xdev -user alice 2>/dev/null

Files left behind show a numeric UID owner and may be adopted by a future user with the same UID — reassign or remove them.

Where account data lives

  • /etc/passwd — accounts (name, UID, GID, home, shell)
  • /etc/shadow — password hashes (root-only)
  • /etc/group — groups and members
  • /etc/skel/ — template files copied into new home directories

Edit these only with the tools above (or vipw/vigr), never by hand with a regular editor.

Good practice

  • One account per person — no shared logins.
  • Key-based SSH, passwords disabled for SSH.
  • Sudo only for those who need it.
  • Service accounts with nologin shells.
  • Remove or expire accounts promptly when people leave.

Related: Linux groups, passwd and Debian user and permission management.

  • Linux
  • Users
  • Security