Users and groups: create a Linux account

On Linux, every file and every process belongs to a user and to a group. This identity model decides who can read, change or run what on the system. Before touching permissions or sudo, you need to understand who you are in the eyes of the system: that is what this guide is about.

What you will learn

• Identify who you are with whoami and id
• Understand UIDs and GIDs (numeric identifiers)
• Know the special role of root (UID 0)
• Read the /etc/passwd and /etc/group files
• Tell apart the primary group and secondary groups
• Create a user with useradd, set their password and give them sudo access

Who am I?

Two commands answer this question: whoami gives your name, and id gives your full identity:

whoami

Output

bob

id

Output

uid=1000(bob) gid=1000(bob) groups=1000(bob),27(sudo),100(users)

The id command gives every piece of identity information in one line. Read it field by field:

Field	Meaning
uid=1000(bob)	Numeric identifier of the user (UID)
gid=1000(bob)	Primary group (GID)
groups=...	List of every group the user belongs to

Swipe to see more

What are UIDs and GIDs?

The system does not handle names but numbers. The names you see are only a translation, done through the account files:

• UID (User ID): unique identifier of each user
• GID (Group ID): unique identifier of each group

The UID value alone tells you what kind of account you are looking at. Three ranges are enough to read any account list:

UID	Meaning
0	root, the superuser, no restriction
1–999	System accounts (services: www-data, sshd, and so on)
1000+	Human accounts created by the administrator

Swipe to see more

Check your UID

id -u

If the result is 0, you are root. Otherwise, you are a regular user.

What is the root superuser?

root (UID 0) can do anything on the system: read every file, stop services, change accounts. That is why you never work as root permanently.

In practice, you use a regular account and go through sudo when a task needs privileges (see the Use sudo guide).

To check whether you are root, look at the last sign of the prompt:

Character	Meaning
$	Regular user
#	root

Swipe to see more

How do you read /etc/passwd?

The /etc/passwd file lists every account on the system, one per line:

head -3 /etc/passwd

Output

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bob:x:1000:1000:Bob Martin:/home/bob:/bin/bash

Each line holds 7 fields separated by :, always in the same order:

Field	Example	Meaning
1	bob	User name (login)
2	x	Password (stored in /etc/shadow)
3	1000	UID
4	1000	GID of the primary group
5	Bob Martin	Description (full name)
6	/home/bob	Home directory
7	/bin/bash	Login shell

Swipe to see more

The x in the password field

The x means that the hashed password is stored in /etc/shadow, a file only root can read. It is a security measure.

To show only your own line, anchor the search on your login with grep:

grep "^$(whoami):" /etc/passwd

How do you read /etc/group?

The /etc/group file lists every group, with its members:

head -5 /etc/group

Output

root:x:0:
daemon:x:1:
sudo:x:27:bob
users:x:100:bob,alice
bob:x:1000:

Each line holds 4 fields, the last of which lists the secondary members:

Field	Example	Meaning
1	sudo	Group name
2	x	Group password (rarely used)
3	27	GID
4	bob	Secondary members (comma-separated)

Swipe to see more

Primary group or secondary groups?

Every user belongs to two kinds of groups, which do not play the same role:

• One primary group: set in /etc/passwd (GID field). When you create a file, it belongs to this group by default.
• Zero or more secondary groups: set in /etc/group. They grant extra rights.

To see your groups, type groups:

groups

Output

bob sudo users

The first one is your primary group, the following ones are the secondary groups.

Why secondary groups?

They grant access without changing the primary group. For example, being a member of the sudo group allows you to use the sudo command, without your files belonging to the sudo group.

How do you list users and groups?

Three commands cover the everyday questions: which human accounts exist, which groups you belong to, and who is member of a given group:

# List the human users (UID >= 1000, except nobody)
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd

# List the groups you belong to
id -Gn

# See the members of a given group
getent group sudo

How do you create a user?

Reading the system is fine; creating an account on it is the first real administration move. The useradd command exists on every distribution, so it is the one to know.

sudo useradd -m -s /bin/bash marie

The -m option creates the home directory (/home/marie) and copies the startup files into it. The -s option sets the login shell. Check right away, it is the reflex to build after every action:

id marie
ls -ld /home/marie

uid=1001(marie) gid=1001(marie) groups=1001(marie)
drwxr-x--- 2 marie marie 4096 Jul 12 16:14 /home/marie

The primary group is called marie, not users: modern distributions create a private group named after the account, which keeps files separated by default.

Without -m, no home directory

This is the classic trap. sudo useradd paul does create the account, but no /home/paul directory. At first login, the user ends up in a broken environment, without any shell configuration file.

On Debian and Ubuntu, the adduser command is an interactive assistant that chains the creation, the home directory and the password. On RHEL, adduser is only a link to useradd and asks no question: in a script meant for both families, always use useradd.

Set the password

A freshly created account has no usable password: logging in with a password is impossible until you set one.

sudo passwd marie

What you type is invisible on screen, which is normal. Then check the state of the password:

sudo passwd -S marie

marie P 2026-07-12 0 99999 7 -1

The second field is the only thing to look at: P means the password is usable. L would mean locked, and NP that there is no password at all. Run before passwd, the same command actually shows L: a new account stays locked until a password is set (measured on Debian 13 and AlmaLinux 10).

Give sudo access

A regular account cannot administer anything. To grant it sudo, add it to the administrators group, whose name changes with the distribution.

Debian / Ubuntu

sudo usermod -aG sudo marie

RHEL / Rocky / Alma

sudo usermod -aG wheel marie

The -a (append) option is essential: without it, -G replaces the whole list of secondary groups instead of adding to it, and the user loses all their other memberships at once.

The sudo group does not exist on RHEL, and the wheel group is not used by default on Debian: it is not a matter of style, it is a real divergence between the two families. Check the result:

id marie

uid=1001(marie) gid=1001(marie) groups=1001(marie),27(sudo)

The group does show up in the list. Careful, though: group membership only takes effect at the next login. If marie is already logged in, she must log out and back in for sudo to work.

The rest of an account's life cycle (changing it, deleting it without leaving orphan files, really disabling it on someone's last day) is covered in Administer users and groups. To restrict what an account can do with sudo, see Configure sudoers.

Troubleshooting

Identity problems rarely show up as an error message: a command simply runs under the wrong account, or a new group seems to be ignored. The table sorts them by what you observe, and the most frequent cause, a group added during an open session, appears twice.

Symptom	Likely cause	Fix
id shows an unexpected UID	You are logged in with another account	Check with whoami
groups does not show an expected group	Secondary group added recently	Log out and back in to refresh
/etc/passwd looks empty or incomplete	Read permission removed (rare)	ls -l /etc/passwd: the file must be readable by everyone (644)
A script ignores the secondary group	The process started before being added to the group	Rerun the script after logging in again

Swipe to see more

Key points

• Every user has a UID and every group a GID.
• root (UID 0) has every right: do not work as root day to day.
• /etc/passwd holds the accounts, /etc/group holds the groups.
• The primary group decides the default group of the files you create.
• Secondary groups grant extra rights.
• whoami, id and groups let you check your identity.
• useradd -m creates an account with its home directory: without -m, there is none.
• Administrator access goes through the sudo group on Debian and Ubuntu, but through wheel on RHEL and Rocky.
• usermod -aG: the -a is essential, otherwise you replace every secondary group instead of adding one.

Knowledge check

Check that the essentials of this guide stuck. The questions cover only what has just been explained here.

Knowledge check

Check what you have learned with this interactive quiz

6 questions

6 min

70% to pass

How it works

• The timer starts when you click Start
• Multiple choice, true/false and short answer questions
• You can move between questions
• Detailed results are shown at the end

Start the quiz

Starts the quiz and the timer

×

See in the glossary →