User Management

Create, change and remove users and groups, set up sudo and SSH keys, and inspect logins. Debian/Ubuntu adduser is a friendlier wrapper around the lower-level useradd found on every distribution. See also Linux, OpenSSH Cheat-Sheet and Linux Basics.

Verification: commands follow the man pages. No command was executed. Always keep a second root session open when changing sudo or SSH settings.

Users #

New group membership applies at the next login. Use newgrp <GROUP> or log out and in. For Docker see Docker.

Groups #

Inspect Users and Logins #

sudo #

Examples for /etc/sudoers.d/deploy (mode 0440):

# full sudo without a password (use for automation accounts only)
deploy ALL=(ALL) NOPASSWD:ALL

# a few specific commands without a password
deploy ALL=(root) NOPASSWD: /bin/systemctl restart myapp, /bin/systemctl status myapp

# a group
%admins ALL=(ALL) ALL

Never edit sudoers with a plain editor. A syntax error locks everyone out of sudo.

SSH Keys for a User #

sudo install -d -m 700 -o <USER> -g <USER> /home/<USER>/.ssh
echo '<PUBLIC-KEY>' | sudo tee -a /home/<USER>/.ssh/authorized_keys
sudo chown <USER>:<USER> /home/<USER>/.ssh/authorized_keys
sudo chmod 600 /home/<USER>/.ssh/authorized_keys

Or, from the client: ssh-copy-id -i ~/.ssh/id_ed25519.pub <USER>@<HOST>. Hardening the daemon (PasswordAuthentication no, PermitRootLogin no) is covered in OpenSSH Cheat-Sheet.

Files and Defaults #

sudo vipw and sudo vigr edit passwd and group with locking.

Lock Down an Account #

sudo usermod -L -e 1 <USER>          # lock password and expire the account
sudo pkill -KILL -u <USER>           # end running sessions
sudo mv /home/<USER>/.ssh/authorized_keys{,.disabled}