Linux User and Group Management: useradd, sudo and Authorization

Setting up a correct user and group structure on a server is the foundation of both security and orderly management. Doing everything as root is a serious risk; instead you should distribute privileges across users and groups. This guide explains Linux user and group management together with sudo authorization.

Related reading: Linux file permissions · Connecting to a server with SSH

The User and Group Concept on Linux

Linux is a multi-user system. Each user has an identity (UID), a home directory and a shell. A group is the way to collect multiple users under a shared privilege — for example, giving an entire web team access to one directory.

There are two kinds of users on the system: normal users for real people, and system users used to run services (for example www-data for the web server).

Creating and Managing Users

Creating a new user and setting its home directory and password is done with a few commands:

# Create a new user (with home directory)
sudo adduser james

# Set/change the user's password
sudo passwd james

# Delete the user (along with the home directory)
sudo deluser --remove-home james

adduser is interactive and user-friendly; the lower-level useradd is more suitable for scripts. To modify an existing user you use usermod.

Creating Groups and Adding Users

Groups let you grant the same privilege to multiple users from a single point:

# Create a new group
sudo groupadd webteam

# Add a user to a group (-aG: preserving existing groups)
sudo usermod -aG webteam james

# View a user's groups
groups james

Authorization with sudo

sudo lets a user run commands that require administrator privileges without the root password and in an auditable way. Giving a user administrator rights is done by adding them to the sudo group (wheel on RHEL-based systems):

# Give the user sudo privileges
sudo usermod -aG sudo james

The Principle of Least Privilege

The golden rule of server security is the principle of least privilege: give every user and service only the minimum privilege needed to do its job.

• Use a normal user + sudo instead of root for daily work.
• Create a separate user for each team member — a shared account leaves "who did what" unanswered.
• Run services under their own system user, not under root.
• Disable the account of departing staff without delay.

Frequently Asked Questions

What is the difference between adduser and useradd?

adduser is a high-level, interactive script; it sets up the home directory and basic settings automatically. useradd is the lower-level command — it needs more parameters but is preferred in scripts.

How do I remove a user's sudo privileges?

Remove the user from the sudo group: sudo deluser james sudo. The change takes effect at the user's next login.

Should I disable the root account entirely?

You do not need to delete the root account; however, it is recommended to disable direct root SSH login (PermitRootLogin no) and do daily work with a normal user + sudo.