What is/are the standard CLI program(s) to manage users and groups?

Question

I'm basically asking about user management from the command line (e.g. on a system where there are no graphical tools available). In the past I've used several different programs to add or delete users and groups or to modify their attributes: adduser, useradd, usermod, gpasswd, and perhaps others I've forgotten. I've also heard a couple times that some of these programs are low-level and should be avoided for general use, but I can never remember which. So I'd like to get a definitive answer for which programs are the recommended ones for at least the following tasks:

• Create a new user
• Add a user to a group
• Remove a user from a group
• Change a user's primary group
• Change a user's login shell or home directory
• Delete a user

I'm looking for standard tools which I can expect to be available on pretty much any Linux system (of any distribution).

Answer 1

Sadly, none of those operations were ever standardized.

Some operating systems offer this functionality as part of the OS, like Linux, but even if your Linux system includes them, over time and across Linux distributions the tools and their names changed so you can not really depend on a standard set of tools to do those tasks.

You need to have a per-operating system set of tools.

Answer 2

On Debian (and derived) systems, adduser and deluser are higher-level wrappers around useradd and related functionality. The cover user creation, group membership addition and subtraction, and user deletion. The corresponding commands from making/deleting groups are, sensibly enough, addgroup and delgroup. usermod appears to cover the remaining use case you name.

UPDATE: these are the standard commands (examples):

>useradd -m  john
-m = creates home directory

>userdel -r john
-r = removes home directory

>groupadd devs

>groupdel devs

>usermod -a -G devs john
-a = append
-G = group name

>id john
lists the users id and group ids
>groups john
lists the users groups

>passwd john
will ask you for current password and new password

>sudo passwd john
will ask you for only new password

>sudo passwd -l john
will lock the user out

>sudo passwd -a -G sudo john
or
>sudo passwd -a -G wheel john
or
>sudo nano /etc/sudoders
different OS variants, adds user to the sudo group
wheel = CENTOS/RHEL

Answer 3

You mention Linux in the last part of your question, but since the title is generic I'll answer for FreeBSD.

FreeBSD has similar commands as Linux but they are commands passed to the pw utility:

pw useradd [user|uid] ...
pw usermod [user|uid] ...

and so on. However, one can parse the command into two parts: user and mod; a noun and a verb. Moreover, one can also use group and del:

pw groupdel [group|gid] ...

to, for example, delete a group. So here's what I think is really cool: the order doesn't matter, nor does the spacing! What this means, is that you can remember what to call by thinking about what you want to do (in English anyway):

pw del user [user|uid] ...
pw mod group [group|gid] ...
pw show user [user|uid] ...
pw next user [user|uid] ...

and more! The pw utility also lets you lock and unlock accounts:

pw lock [user|uid] ...
pw unlock [user|uid] ...

Options and any parameters that you pass are all standardized (although don't always apply to call commands) so memorization is minimized. All in all a nice way to do things.

Note: the ellipses in the above examples represent options and parameters passed to pw not additional users or groups.

Answer 4

Just for completeness, in the low-level end of the spectrum I'd mention vipw(8) and vigr(8), just above "vi /etc/passwd" and "cat > /etc/passwd" but right below "useradd". Oh, and they exist in most Unix variants.

Answer 5

All of these tools are ultimately built to edit text files for you. If you want to know how to manage users and groups over systems, you should get familiar with these underlying text files. Lucky for you, there's just two of them, /etc/passwd and /etc/group. There are also complementary /etc/shadow and /etc/gshadow files for shadowing passwd and group respectively.

Answer 6

In many situations, knowing how to edit "/etc/passwd" is still useful.

Answer 7

If you are using a backend other than the default local machine backend - OpenLDAP being the most common - then cpu (change password utility) might be the command you are looking for. It can be run on machines other than the LDAP master if configured correctly, and it's syntax is mostly just the same as useradd etc with a prefix of cpu. So to add myself I could do

$ sudo cpu useradd hamish

See the cpu man page for more details.

Answer 8

If your question was limited to

any Linux system (of any distribution)

but all of the systems have network access to a single server. You could use something like NIS or YP. So this answer is limited to admins within a single organization.

You still have the issue where almost every distribution has slightly different ways to configure YP, but configuration only happens once. Also, this type of network is not trivial.

Within a single site/network you will gain a lot doing this. In combination with automount, my favorite is being able to SSH to any *nix machine and have all my home files and tools available to me.

To the point, the distribution you choose for the master is the system you use for managing users. You then will have a single set of tools/documentation to manage users and groups.

It is even possible to use something like LDAP and samba tools on the master. Using samba also allows me to have my home files available to me on windows machines.

Answer 9

The closest thing to a standard you'll get is vi /etc/passwd, vi /etc/shadow, and vi /etc/groups. (Heretics may substitute emacs.) Everything since then that I've found will only work on some systems.

Seriously, find out what tools your OS has, and use them. Just don't expect them to work the same on all systems. It would be nice if they were standardized, but they aren't.