Users and Groups
Account databases and identity changes
Linux account data lives in /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. /etc/passwd is world-readable and holds the username, UID, primary GID, home directory, and shell; /etc/shadow holds password hashes and aging fields and should not be world-readable. Use getent passwd user and getent group group to query the system resolver rather than reading files directly.
Know the management commands: useradd, usermod, userdel, groupadd, groupdel, passwd, and chage. useradd creates the account but does not normally set a usable password; use passwd afterward. useradd -m creates a home directory, and -s sets the login shell. -g sets the primary group; -G sets supplementary groups. When changing supplementary groups for an existing user, usermod -aG group user is essential because omitting -a replaces the entire supplementary list. chage -l shows password aging; chage -M and -E set maximum age and account expiration.
Traps: deleting a user does not always remove the home directory unless requested; locking a password is not the same as disabling a shell or expiring the account; and group membership changes affect new sessions, so existing sessions may retain old group IDs. Sudo access is usually granted by group membership or a sudoers drop-in, not by editing /etc/sudoers carelessly.
Worked rule of thumb: create an account with useradd -m -s /bin/bash -G developers alice, set the password with passwd alice, and verify with getent passwd alice plus id alice. To add a supplementary group later, use usermod -aG developers alice and have the user log in again before testing access.