Managing Users and Groups on Linux: A Practical Guide

Security often starts with something as simple as managing users and groups. On Linux, these controls help organize collaboration and strengthen multi-user environments such as ERP platforms.

User management

sudo useradd testuser creates a user with the lower-level account tool. It does not create a home directory or set a password by default. For an interactive setup that creates a home directory and prompts for user details, use sudo adduser testuser. Set a password with sudo passwd testuser.

To remove an account while keeping its files, use sudo userdel testuser. When the account and its home directory should both be removed, sudo deluser --remove-home testuser is the more complete cleanup command. Confirm the account and data are no longer needed before removing them.

Group management

Groups make it easier to grant shared access without changing permissions for each person individually:

sudo groupadd devgroup
sudo usermod -aG devgroup testuser
sudo gpasswd -d testuser devgroup
sudo groupdel devgroup

The commands create a group, add a user, remove a user, and delete the group. The -a option in usermod -aG appends the group while preserving the user's existing supplementary groups.

Use groups to limit access

To limit SSH access to approved users, configure AllowGroups in /etc/ssh/sshd_config, then add authorized accounts to that group. For a shared team directory, assign the directory to a group and set permissions so only group members can use it:

sudo mkdir /srv/project
sudo chown :devgroup /srv/project
sudo chmod 2770 /srv/project

On a multi-tenant server, a separate group and directory for each tenant can keep files isolated. Services such as PostgreSQL and NGINX should also run under dedicated, limited accounts. These practices support least privilege, clearer ownership, and safer operations as teams and systems grow.

Originally published on Koderstory Devlog.