Take the 2-minute tour ×

As the title says, I'm basically asking about user management from the command line (e.g. on a system where there are no graphical tools available). In the past I've used several different programs to add or delete users and groups or to modify their attributes: adduser, useradd, usermod, gpasswd, and perhaps others I've forgotten. I've also heard a couple times that some of these programs are low-level and should be avoided for general use, but I can never remember which. So I'd like to get a definitive answer for which programs are the recommended ones for at least the following tasks:

  • Create a new user
  • Add a user to a group
  • Remove a user from a group
  • Change a user's primary group
  • Change a user's login shell or home directory
  • Delete a user

I'm looking for standard tools which I can expect to be available on pretty much any Linux system (of any distribution).

share|improve this question
also groupmod. I'm not going to make this an answer.... but the most standard way is probably to use your text editor... remember the files affected are just delimited text. –  xenoterracide Aug 19 '10 at 1:53
Interestingly, prior to asking this question, I had never once seen so much as a mention of directly editing the files. (Somehow I had the impression that /etc/passwd was just one part of a complex system) –  David Z Aug 19 '10 at 7:41
add comment

9 Answers

up vote 8 down vote accepted

Sadly, none of those operations were ever standardized.

Some operating systems offer this functionality as part of the OS, like Linux, but even if your Linux system includes them, over time and across Linux distributions the tools and their names changed so you can not really depend on a standard set of tools to do those tasks.

You need to have a per-operating system set of tools.

share|improve this answer
I've never had the names change... but I have had the switches change. I recall once finding out that a linux didn't have gpasswd -a. –  xenoterracide Aug 19 '10 at 1:52
If memory serves-- RedHat once used 'adduser' instead of 'useradd', and it behaved differently (I think useradd was more Debianish). They later made 'adduser' a symlink to 'useradd'. See some old references at redhat.com/docs/manuals/linux/RHL-5.2-Manual/install-guide/… –  Stefan Lasiewski Aug 19 '10 at 3:17
add comment

On Debian (and derived) systems, adduser and deluser are higher-level wrappers around useradd and related functionality. The cover user creation, group membership addition and subtraction, and user deletion. The corresponding commands from making/deleting groups are, sensibly enough, addgroup and delgroup. usermod appears to cover the remaining use case you name.

share|improve this answer
add comment

You mention Linux in the last part of your question, but since the title is generic I'll answer for FreeBSD.

FreeBSD has similar commands as Linux but they are commands passed to the pw utility:

pw useradd [user|uid] ...
pw usermod [user|uid] ...

and so on. However, one can parse the command into two parts: user and mod; a noun and a verb. Moreover, one can also use group and del:

pw groupdel [group|gid] ...

to, for example, delete a group. So here's what I think is really cool: the order doesn't matter, nor does the spacing! What this means, is that you can remember what to call by thinking about what you want to do (in English anyway):

pw del user [user|uid] ...
pw mod group [group|gid] ...
pw show user [user|uid] ...
pw next user [user|uid] ...

and more! The pw utility also lets you lock and unlock accounts:

pw lock [user|uid] ...
pw unlock [user|uid] ...

Options and any parameters that you pass are all standardized (although don't always apply to call commands) so memorization is minimized. All in all a nice way to do things.

Note: the ellipses in the above examples represent options and parameters passed to pw not additional users or groups.

share|improve this answer
It was a Linux question but the information is appreciated anyway. It would be great if Linux had something like this. –  David Z Aug 19 '10 at 3:19
Noun and verb, you mean. –  Warren Young Aug 19 '10 at 13:19
D'oh! Fixed it. –  gvkv Aug 19 '10 at 13:44
add comment

Just for completeness, in the low-level end of the spectrum I'd mention vipw(8) and vigr(8), just above "vi /etc/passwd" and "cat > /etc/passwd" but right below "useradd". Oh, and they exist in most Unix variants.

share|improve this answer
add comment

All of these tools are ultimately built to edit text files for you. If you want to know how to manage users and groups over systems, you should get familiar with these underlying text files. Lucky for you, there's just two of them, /etc/passwd and /etc/group. There are also complementary /etc/shadow and /etc/gshadow files for shadowing passwd and group respectively.

share|improve this answer
...and /etc/shadow, since most systems will croak if i is inconsistent with /etc/passwd –  codehead Aug 19 '10 at 11:03
add comment

In many situations, knowing how to edit "/etc/passwd" is still useful.

share|improve this answer
Knowing how to read /etc/passwd is useful, but modifying it directly is a bad practice. On some *ixes I've used (modern SysV, OS X...) these files aren't the primary place the user and group data is stored. They're either shadow copies for compatibility, or they are primary sources but there is a database or index that needs to be updated whenever they change. On those systems, if you don't update the files through the official tools, the changes won't immediately take effect, if ever they do. –  Warren Young Aug 19 '10 at 13:21
Just don't munge /etc/passwd –  Stefan Lasiewski Aug 19 '10 at 17:02
add comment

If you are using a backend other than the default local machine backend - OpenLDAP being the most common - then cpu (change password utility) might be the command you are looking for. It can be run on machines other than the LDAP master if configured correctly, and it's syntax is mostly just the same as useradd etc with a prefix of cpu. So to add myself I could do

$ sudo cpu useradd hamish

See the cpu man page for more details.

share|improve this answer
Interesting, but an answer that only applies on a machine which gets its user info from LDAP is of very limited use to me. –  David Z Aug 20 '10 at 1:06
add comment

If your question was limited to

any Linux system (of any distribution)

but all of the systems have network access to a single server. You could use something like NIS or YP. So this answer is limited to admins within a single organization.

You still have the issue where almost every distribution has slightly different ways to configure YP, but configuration only happens once. Also, this type of network is not trivial.

Within a single site/network you will gain a lot doing this. In combination with automount, my favorite is being able to SSH to any *nix machine and have all my home files and tools available to me.

To the point, the distribution you choose for the master is the system you use for managing users. You then will have a single set of tools/documentation to manage users and groups.

It is even possible to use something like LDAP and samba tools on the master. Using samba also allows me to have my home files available to me on windows machines.

share|improve this answer
Thanks, but I'm looking for an answer that applies just as well to non-networked systems. –  David Z Aug 20 '10 at 1:07
add comment

The closest thing to a standard you'll get is vi /etc/passwd, vi /etc/shadow, and vi /etc/groups. (Heretics may substitute emacs.) Everything since then that I've found will only work on some systems.

Seriously, find out what tools your OS has, and use them. Just don't expect them to work the same on all systems. It would be nice if they were standardized, but they aren't.

share|improve this answer
Using a text editor to edit configuration files that tools can, and should edit for you is not a standard. You should never use a text editor to change a configuration file, when the operating system, or application provides a utility to do this for you. This is especially true for /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. This is what the tools are for. Humans are prone to error, whereas tools have been tested and are (hopefully) bug-free. –  Aaron Toponce Aug 19 '10 at 23:04
Never call an editor on /etc/passwd and friends directly. Use vipw and vigr, which: lock the file against concurrent edition; run your favorite editor ($VISUAL); don't change the file if you make a syntax error; on some systems (e.g. FreeBSD) also regenerate other files that must be kept in sync. –  Gilles Aug 20 '10 at 13:34
add comment

Your Answer


