How to Manage Users and Groups on Ubuntu Server Print

Every file and process on Ubuntu belongs to a user and a group — get user management right and permissions problems mostly disappear; get it wrong and you end up with the classic all-in-one root server where one compromised app owns everything. Here is the complete, practical guide to managing users and groups on Ubuntu Server.

Creating and removing users

sudo adduser maria          # interactive, creates home dir — use this
sudo deluser maria           # remove user, keep home
sudo deluser --remove-home maria   # remove user and home directory

Prefer adduser over the low-level useradd on Ubuntu — it handles home directory, skeleton files and password in one step. For administrative rights, add the user to the sudo group as covered in our sudo guide.

Working with groups

sudo groupadd developers        # create a group
sudo usermod -aG developers maria  # add user to group (-a = append!)
sudo gpasswd -d maria developers   # remove user from group
groups maria                       # what is maria in?
getent group developers            # who is in developers?

Group changes take effect at the next login — users must log out and back in (or run newgrp developers).

A shared directory for a team

The standard pattern — a directory where every member of a group can create and edit files:

sudo mkdir -p /srv/projects
sudo chown root:developers /srv/projects
sudo chmod 2775 /srv/projects

The leading 2 is the setgid bit: new files inside inherit the developers group automatically, so collaboration just works.

Passwords and account control

sudo passwd maria            # set/reset a password
sudo passwd -l maria         # lock the account
sudo passwd -u maria         # unlock
sudo chage -d 0 maria        # force password change at next login
sudo chage -l maria          # view password ageing info

System users for services

Daemons should run as unprivileged system users with no login shell — this is exactly how Ubuntu packages set up www-data for Nginx:

sudo adduser --system --group --no-create-home --shell /usr/sbin/nologin myservice

Auditing: who can log in, who ran sudo?

awk -F: '$7 !~ /(nologin|false)/ {print $1}' /etc/passwd   # accounts with a shell
lastlog | head          # last login per account
sudo grep sudo /var/log/auth.log | tail   # recent sudo activity

Review this list occasionally — forgotten accounts from ex-employees or old projects are a real attack vector. Combine with SSH key-only authentication so accounts without keys simply cannot get in.

Related Ubuntu guides

• How to Create a Sudo User on Ubuntu 24.04 and Disable Root Login
• How to Secure SSH on Ubuntu: Key Authentication, Custom Port and Best Practices
• How to Set Up Cron Jobs on Ubuntu: Automate Tasks with Crontab
• Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps