Linux uses user accounts and groups to control access to files, directories, applications, and system resources. Whether you administer a personal Linux workstation, a web server, or an enterprise infrastructure environment, understanding these commands helps you implement permissions consistently and follow the principle of least privilege.

In this guide, you will learn the difference between primary and supplementary groups, how to create and modify accounts, how to verify changes, and which mistakes to avoid when managing production systems.

1. Why Linux Users and Groups Matter

Linux identifies users with user IDs (UIDs) and groups with group IDs (GIDs). The operating system uses this identity information, together with file permissions and other security controls, to determine which operations a process can perform.

• Users: Identify individual accounts and processes.
• Groups: Allow permissions to be assigned to a collection of users.
• UID: The numerical identity associated with a user.
• GID: The numerical identity associated with a group.
• File ownership: Associates files and directories with a user and a group.

For example, a development team might share access to a project directory through a group named developers. Instead of granting broad access to every local account, an administrator can assign the directory to that group and configure appropriate permissions.

2. Primary Groups vs. Supplementary Groups

A Linux user has a primary group and may also belong to multiple supplementary groups.

A user’s primary group is not necessarily a private group named after the user. The default depends on distribution policy and account-creation settings.

3. View Linux Users and Groups

3.1 Display your current identity

id

The command displays your UID, primary GID, and group memberships. To inspect another account, specify its username:

id username
id -gn username
id -Gn username

• id username displays the account’s identity information.
• id -gn username prints the primary group name.
• id -Gn username prints group names associated with the account.

3.2 List group database entries

getent group

To look up a particular group:

getent group developers

getent queries the configured name service database. Depending on your system, account information may come from local files, LDAP, or another configured source.

3.3 Check whether a user exists

getent passwd username

You can also inspect local account records, although the local /etc/passwd file does not necessarily contain all accounts visible through the system’s configured name services.

cat /etc/passwd
cat /etc/group

4. Create Linux Users

4.1 Create a user with a home directory

sudo useradd -m alex

The -m option requests creation of the user’s home directory if it does not already exist. Exact defaults, including the initial group and shell, depend on the distribution and local configuration.

4.2 Set the user’s password

sudo passwd alex

Enter the password when prompted. Do not place plaintext passwords in shell commands, scripts, screenshots, or shared logs.

4.3 Create a user with a specified shell

sudo useradd -m -s /bin/bash alex

This example requests Bash as the login shell. Confirm that the desired shell exists on the target system before using it.

4.4 Create a user with a supplementary group

sudo useradd -m -G developers alex

The -G option specifies supplementary groups. In this example, the developers group must already exist. For a new account, use -g to specify an existing primary group.

5. Create, Rename, and Modify Groups

5.1 Create a new group

sudo groupadd developers

This creates a group named developers using the system’s default group ID allocation policy.

5.2 Create a group with a specific GID

sudo groupadd -g 2500 developers

Use a fixed GID only when your identity-management or deployment requirements call for it. Confirm that the ID is available and consistent with your environment.

5.3 Rename a group

sudo groupmod -n engineering developers

This changes the group name from developers to engineering. Review scripts, configuration files, and access-control rules that refer to the old group name.

5.4 Change a group’s numeric ID

sudo groupmod -g 2600 engineering

6. Add or Remove Users From Groups

6.1 Add a user to a supplementary group

sudo usermod -aG developers alex

The combination -aG appends the specified supplementary group to the user’s existing group list.

6.2 Add a user to multiple groups

sudo usermod -aG developers,qa alex

Both groups must exist. Confirm the result after making the change:

id alex
getent group developers
getent group qa

6.3 Add a user with gpasswd

sudo gpasswd -a alex developers

The gpasswd utility can add a user to a supplementary group in the local group database.

6.4 Remove a user from a supplementary group

sudo gpasswd -d alex developers

Alternatively, on systems that support the relevant Shadow utilities option, use:

sudo usermod -rG developers alex

Review the local usermod manual before using less familiar options, and verify the user’s memberships afterward.

7. Change a User’s Primary Group

Use the -g option with usermod to change an account’s primary group. The target group must already exist.

sudo usermod -g engineering alex

Verify the primary group:

id -gn alex
id alex

Changing a primary group does not automatically resolve every existing file’s group ownership across all mounted filesystems. Review file ownership and application requirements separately.

8. Delete Linux Users and Groups

8.1 Delete a user but retain the home directory

sudo userdel alex

This removes the local account entry but normally leaves the user’s home directory and other files behind. Search for remaining files and transfer any data that must be retained.

8.2 Delete a user and request home-directory removal

sudo userdel -r alex

8.3 Delete a group

sudo groupdel developers

A group cannot normally be deleted while it is the primary group of an existing user. Before removal, check group membership, file ownership, service configuration, and any shared directories.

9. Manage Group Ownership and File Permissions

Group administration is most useful when paired with appropriate file permissions. These commands help assign and inspect group ownership.

9.1 Change a file’s group ownership

sudo chgrp developers project.txt

9.2 Change a directory’s group ownership

sudo chgrp developers /srv/project

9.3 Grant group read and write access

sudo chmod 660 project.txt
ls -l project.txt

Mode 660 grants read and write permissions to the owner and group, with no permissions for other users. Apply it only when that access model matches the file’s purpose.

9.4 Configure a shared team directory

sudo mkdir -p /srv/project
sudo chown root:developers /srv/project
sudo chmod 2770 /srv/project

The leading set-group-ID bit in 2770 helps newly created items inherit the directory’s group on typical Linux filesystems. The precise outcome can also depend on application behavior, ACLs, and filesystem settings.

Check the result with:

ls -ld /srv/project
stat /srv/project

10. Practical Lab: Create a Linux Team Group

This lab demonstrates a basic workflow for setting up a shared directory for a team. Run it on a test machine or in a controlled lab before adapting it to production.

Step 1: Create the team group

sudo groupadd labteam

Step 2: Create a user

sudo useradd -m labuser
sudo passwd labuser

Step 3: Add the user to the group

sudo usermod -aG labteam labuser

Step 4: Create a shared directory

sudo mkdir -p /srv/labteam
sudo chown root:labteam /srv/labteam
sudo chmod 2770 /srv/labteam

Step 5: Verify group membership and directory settings

id labuser
getent group labteam
ls -ld /srv/labteam

The output should show the configured group and directory ownership. The id command queries the account’s current identity information; it does not prove that an already-running session has refreshed its supplementary group list.

Step 6: Test access in a fresh session

Log in as labuser in a new session, then run:

id
touch /srv/labteam/test-file
ls -l /srv/labteam/test-file

If the write succeeds, inspect the file’s group ownership and permissions. If it fails, check the user’s active group list, directory permissions, ACLs, and any mandatory access-control policy in place.

11. Security Best Practices and Common Mistakes

• Use least privilege: Add accounts only to groups required for their work.
• Use sudo carefully: Administrative commands can affect other users and critical system services.
• Preserve existing memberships: Use usermod -aG when appending supplementary groups.
• Review access after changes: Verify group membership, file permissions, and service access.
• Plan account deletion: Check files, scheduled tasks, service ownership, and retention requirements first.
• Avoid unnecessary group privileges: Membership in groups such as sudo, docker, or other privileged groups may grant significant control over the system. Evaluate the security impact before granting access.
• Understand centralized identity: On LDAP, Active Directory integration, or other centrally managed systems, local commands may not be the correct place to change centrally managed accounts and groups.
• Back up and document changes: Record important account-management changes according to your organization’s policy.

12. Troubleshooting Common Problems

Problem: The group does not exist

Check whether it is visible through the configured group database:

getent group developers

If the command returns no entry, verify the group name and determine whether it must be created locally or managed by a central identity service.

Problem: New group access is not available

A running session may not have refreshed supplementary group membership. Log out and start a new login session, then check:

id

Problem: Permission denied when writing to a directory

Inspect ownership and permission bits:

ls -ld /srv/project
namei -l /srv/project

Also inspect access-control lists where available:

getfacl /srv/project

Check every parent directory in the path, not only the final directory. A missing execute/search permission on a parent directory can prevent access even if the final directory looks correct.

Problem: A user is missing expected group memberships

Review the account and configured group records:

id username
getent passwd username
getent group developers

Depending on the identity backend, supplementary membership may be resolved through the user’s group list or through configured directory services. Do not assume every centrally managed membership is stored in the local /etc/group file.

13. Linux User and Group Commands: Quick Reference

14. Conclusion

Linux user and group management is a core system administration skill. Commands such as useradd, usermod, groupadd, groupmod, and gpasswd help administrators manage account identity and group membership, while id, getent, chgrp, and chmod help verify identity and control resource access.

For reliable administration, verify changes after every important operation, preserve existing group memberships when appending access, and assess the consequences before changing IDs or deleting accounts. Always consult the manual pages installed on your own distribution because supported options and defaults can vary.

15. Official Documentation and Further Reading

• Linux useradd manual — account creation and options.
• Linux usermod manual — modifying users and supplementary groups.
• Linux groupadd manual — creating groups.
• Linux groupmod manual — changing group names and IDs.
• Linux groupdel manual — deleting groups and related cautions.
• Linux userdel manual — deleting accounts.
• Linux id manual — viewing user and group IDs.
• Linux gpasswd manual — administering group membership.
• Ubuntu manual pages — distribution-specific documentation.

Khurram Shahzad — Hybrid Cloud & Virtualization Engineer

Hybrid Cloud & Virtualization Engineer specializing in VMware, Azure, AWS, Windows Server, Microsoft 365, Linux, networking, backup & disaster recovery. I share practical guides, technical projects and insights into modern IT infrastructure through VMoreCloud.

Disclaimer: Commands are provided for educational and administrative reference. Review their effects and your distribution’s documentation before applying them to production systems. Examples use illustrative usernames and group names; replace them with values appropriate for your environment.