Cheat sheet

Users, groups and sudo

Adding and removing accounts, managing groups, locking someone out properly, and who's allowed to sudo.

Nothing you type here is sent. Nothing is saved, unless you switch on Remember. Privacy policy

These work the same on Debian, Ubuntu, Fedora, Rocky and RHEL, except where a section says otherwise. Anything that changes an account needs sudo.

Who's who

whoami

Which user you are right now.

id deploy

A user's ID number, their main group, and every group they're in.

getent passwd deploy

The account's details: user ID, home folder and login shell. Also works for accounts that come from LDAP or Active Directory.

getent group developers

A group's ID and who's in it.

w

Who's logged in right now, and what they're running.

last -n 20

The last 20 logins, with where they came from.

Adding and removing users

sudo useradd -m -s /bin/bash deploy

Create a user, with a home folder and a proper shell. Works everywhere.

-m: make the home folder
-s: the login shell (without it, some systems give you plain sh)

sudo adduser deploy

The friendlier way on Debian and Ubuntu: it makes the home folder and asks for a password as it goes.

sudo passwd deploy

Set or change a user's password.

sudo usermod -s /usr/sbin/nologin deploy

Stop someone getting a shell, while the account still exists (for service accounts).

sudo userdel deploy

Delete an account, but leave their home folder and files where they are.

sudo userdel -r deploy

Delete an account and their home folder. Back up anything you might want first.

-r: remove the home folder and mail too

Locking someone out

sudo chage -E 0 deploy

Switch an account off completely, SSH keys included. The reliable way to lock someone out.

-E 0: the account expired on 1 January 1970, so every login is refused

sudo chage -E -1 deploy

Switch it back on.

sudo passwd -l deploy

Lock the password only. Careful: they can still log in with an SSH key.

sudo passwd -u deploy

Unlock the password again.

sudo faillock --user deploy --reset

Clear failed login attempts after someone's been locked out for typing the wrong password too often (on systems using pam_faillock, like RHEL and Rocky).

Groups

sudo groupadd developers

Create a group.

sudo usermod -aG developers deploy

Add a user to a group. It takes effect the next time they log in.

-a: append. Leave it out and they're removed from every other group they were in
-G: the group (or several, separated by commas)

sudo gpasswd -d deploy developers

Take a user out of a group.

newgrp developers

Use a group you were just added to, without logging out and back in.

sudo groupdel developers

Delete a group (its members keep their accounts).

sudo

sudo -l

What you're allowed to run with sudo.

sudo -l -U deploy

What someone else is allowed to run with sudo.

sudo usermod -aG sudo deploy

Make someone an admin on Debian and Ubuntu.

sudo usermod -aG wheel deploy

Make someone an admin on Fedora, Rocky and RHEL.

sudo visudo -f /etc/sudoers.d/deploy

Give someone a narrower sudo rule in its own file. visudo checks the syntax before saving, so a typo can't lock everyone out of sudo. A line like deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx allows exactly one command.

Passwords and expiry

sudo chage -l deploy

When the password was last changed, and when it (or the account) expires.

sudo chage -M 90 deploy

Make the password expire after this many days.

-M: maximum age in days

sudo passwd -e deploy

Make them choose a new password the next time they log in.

SSH keys for someone else

sudo install -d -m 700 -o deploy -g deploy /home/deploy/.ssh

Make a user's .ssh folder with the ownership and permissions SSH insists on.

-d: make a folder
-m 700: only they can open it
-o: owned by them
-g: and their group (most systems give each user a group of the same name)

sudo install -m 600 -o deploy -g deploy key.pub /home/deploy/.ssh/authorized_keys

Install their public key (key.pub) as the one key that can log in as them. This replaces any keys already there.