Users, Groups & Authentication

/etc/passwd, /etc/shadow, useradd/usermod, and the distinction between su and sudo.

Overview

Linux has three categories of users, and knowing which type to use — and when — is a core sysadmin skill.

Three User Types

Root (UID 0) — unrestricted access to everything. Use sparingly, always via sudo rather than a direct root session. The golden rule: *grant the least access needed*.
Regular users (UID ≥ 1000) — standard login accounts with a home directory and a login shell. These are real humans.
Service accounts (UID 1-999) — created by packages for daemons (nginx, postgres, redis). No login shell (/sbin/nologin), no password, no home directory beyond what the service needs.

The Three Key Files

Linux user management is built around two core files and a set of commands that modify them.

/etc/passwd format — seven colon-delimited fields: username:x:UID:GID:GECOS:home_directory:shell. The 'x' in the password field means the actual hash is in /etc/shadow. UID 0 is root; UIDs 1-999 are typically system accounts; UIDs 1000+ are regular users. The GECOS field holds the full name and other info (visible in finger command). The shell field determines the login shell — /sbin/nologin or /bin/false blocks interactive login for service accounts.

/etc/shadow stores the actual password hashes, readable only by root. Format: username:hash:last_change:min_days:max_days:warn_days:inactive_days:expiry. Hash format: $id$salt$hash where id identifies the algorithm (6=SHA-512, 5=SHA-256, 1=MD5-deprecated).

useradd vs adduser: useradd is the low-level tool (requires explicit flags for home dir, shell, etc.). adduser (Debian/Ubuntu) is a higher-level script with interactive prompts and sensible defaults. In RHEL/CentOS, useradd is configured via /etc/login.defs and /etc/default/useradd.

Group management: Each user has a primary group (set at login, files created with this GID) and supplementary groups (additional access). id command shows all. usermod -aG groupname username adds to a supplementary group without removing existing ones — the -a flag is critical.

su vs sudo: su switches to another user entirely (needs that user's password; switches environment). sudo runs a single command as another user (needs your own password; logged to syslog; controlled by /etc/sudoers). For system administration, sudo is preferred because it provides accountability.

Key concepts

/etc/passwd 7-field format: username:x:UID:GID:GECOS:home:shell — the x means password hash is in /etc/shadow. UID 0=root, 1-999=system, 1000+=users.
/etc/shadow: Stores password hashes readable only by root. Format: user:$alg$salt$hash:last_change:min:max:warn:inactive:expiry. $6$=SHA-512.
useradd vs adduser: useradd is low-level (requires flags). adduser (Debian) is a friendlier wrapper. useradd -m -s /bin/bash -G sudo username is a typical invocation.
su vs sudo: su switches full user context (needs target password). sudo runs one command elevated (needs your password, logs to syslog, controlled by /etc/sudoers). sudo is preferred for auditability.

When to use it

Provisioning new user accounts on a server
Managing service accounts for applications
Auditing who has access to what groups
Troubleshooting permission denied errors related to group membership

Interview questions

Walk through the /etc/passwd and /etc/shadow file formats. Why are they separate?
What is the difference between su and sudo? When would you use each?