Manage users and groups
Creating accounts
useradd -m -u 1500 -g devs -G wheel -s /bin/bash -c 'Comment' alice creates the account, populates the home directory from /etc/skel, and sets group membership. Defaults come from /etc/default/useradd and /etc/login.defs (UID ranges, password aging). Use groupadd, groupmod -n, groupdel for groups and gpasswd -a user group for membership. The underlying files are /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow.
Modifying and locking
usermod -aG wheel alice appends a supplementary group; usermod -G by itself replaces the entire list. usermod -L/-U lock and unlock, -s changes the shell, and -d with -m relocates the home directory. passwd -l/-u/-e/-S lock, unlock, expire, and report status. chage -l alice shows aging, chage -M 90 alice sets the maximum, and chage -d 0 alice forces a change at next login. userdel -r removes the home directory and mail spool.
Privilege
Use visudo or a drop-in under /etc/sudoers.d/; a typical line is %wheel ALL=(ALL) ALL. Verify with sudo -l -U alice. su - alice starts a login shell with the target's environment; su alice keeps the current one.
Traps: the classic failure is usermod -G wheel alice, which silently strips every other supplementary group. userdel without -r leaves files behind, and -r can delete files owned by that user elsewhere on the system. Locking a password (the ! in shadow) does not stop key-based SSH login.
Rule of thumb: use -aG to add a group, -G only to replace the whole list.
Worked example: usermod -aG wheel alice && id alice