Creating Users

Creating Users in Ubuntu

User management on Ubuntu is split between a low-level C tool (useradd) and a higher-level Perl wrapper (adduser). Both create users, but they have very different defaults that matter in practice — using the wrong one on a server can leave you with a home directory missing, a shell set incorrectly, or no password prompt.

How Ubuntu stores user accounts

User account data is spread across four files:

/etc/passwd    — Username, UID, GID, home directory, shell
/etc/shadow    — Hashed password + expiry policy (root-only)
/etc/group     — Group memberships
/etc/gshadow   — Group passwords (rarely used)

Each line in /etc/passwd:
username:x:UID:GID:comment:home:shell
irfan:x:1001:1001:Irfan Aslam:/home/irfan:/bin/bash

useradd vs adduser

Creating a standard user

# Interactive method (desktop/manual server setup): use adduser
sudo adduser irfan

adduser prompts you through the entire process

Adding user `irfan' ...
Adding new group `irfan' (1001) ...
Adding new user `irfan' (1001) with group `irfan' ...
Creating home directory `/home/irfan' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for irfan
Enter the new value, or press ENTER for the default
    Full Name []: Irfan Aslam
    Room Number []:
    Work Phone []:
    Home Phone []:
    Other []:
Is the information correct? [Y/n] Y

# Script/automation method: use useradd with explicit flags
sudo useradd     --create-home \          # Create /home/username
    --shell /bin/bash \      # Set the login shell
    --comment "Irfan Aslam"     --user-group \           # Create a matching private group
    irfan

# Set the password separately
sudo passwd irfan

# Add user to additional groups (e.g., sudo group)
sudo usermod -aG sudo irfan

Creating a system service account

Service accounts run background daemons. They should have no login shell, no home directory, and belong to a private group. A locked account with no shell cannot log in even if someone finds the account.

# Create a system account for a service (e.g., a web app)
sudo useradd     --system \               # UID in system range (< 1000), no aging
    --no-create-home \       # No home directory
    --shell /usr/sbin/nologin \  # Cannot be used to log in
    --comment "My App Service"     myapp

# Verify
id myapp
getent passwd myapp

Expected output

uid=998(myapp) gid=998(myapp) groups=998(myapp)
myapp:x:998:998:My App Service:/home/myapp:/usr/sbin/nologin

Setting account defaults

# View the defaults used by useradd for new accounts
useradd --defaults
# or
cat /etc/default/useradd

Default values for new accounts

GROUP=100
HOME=/home
INACTIVE=-1
EXPIRE=
SHELL=/bin/sh
SKEL=/etc/skel
CREATE_MAIL_SPOOL=no

# The /etc/skel directory holds files copied into every new home directory
ls -la /etc/skel/
# Typically: .bashrc .bash_logout .profile

# Add custom files for all new users (e.g., a company .bashrc)
sudo cp my-company.bashrc /etc/skel/.bashrc

# Password aging defaults are in /etc/login.defs
grep "^PASS" /etc/login.defs

Verifying user creation

# Verify the user exists
id irfan
getent passwd irfan

# Verify home directory was created
ls -la /home/irfan

# Check group membership
groups irfan

# Verify the account is unlocked and has a valid password
sudo passwd --status irfan

passwd status output

irfan P 2024-06-01 0 99999 7 -1
#     ^ P = password set, L = locked, NP = no password

Conclusion

Use adduser for interactive creation of human accounts — it handles home directory, password, and prompts in one step. Use useradd with explicit flags in scripts and Ansible playbooks. For service accounts, always use --system --shell /usr/sbin/nologin --no-create-home to prevent the account from being used as a login. Add human users to the sudo group only if they genuinely need administrative access.