How to Add and Delete Users on a CentOS 7 Server

Managing users effectively on a CentOS 7 server is vital for every developer and system administrator. Whether you’re establishing a collaborative development setting, overseeing team access to live Servers, or enforcing security measures, knowing how to add and remove users proficiently can help mitigate potential troubleshooting issues later. This guide provides a thorough overview of user management on CentOS 7, detailing everything from user creation basics to managing permissions and addressing common pitfalls that can challenge even seasoned administrators.

Grasping User Management in CentOS 7

CentOS 7 manages user accounts through a combination of system files and utilities that oversee user data, authentication, and permissions. The main files utilised are /etc/passwd for user account details, /etc/shadow for password information, and /etc/group for group memberships.

Upon user creation, CentOS automatically assigns a User ID (UID) and Group ID (GID), establishes a home directory, and configures basic shell access. System accounts receive UIDs below 1000, whereas regular users are assigned UIDs starting from 1000.

Adding Users: A Step-by-Step Guide

The simplest method for adding a user is by employing the useradd command. Below are the basic syntax and common adjustments:

# Basic user creation
sudo useradd username

# Create a user with a home directory and bash shell
sudo useradd -m -s /bin/bash username

# Create a user with designated UID and a primary group
sudo useradd -u 1500 -g developers -m -s /bin/bash john

# Create a service user (UID below 1000)
sudo useradd -r -s /bin/false serviceaccount

After creating the user, you’ll need to assign a password:

# Set password interactively
sudo passwd username

# Set password non-interactively (suitable for scripts)
echo "newpassword" | sudo passwd --stdin username

For enhanced control over user creation, additional parameters can be specified:

# Detailed user creation with comprehensive options
sudo useradd \
  -m \
  -d /home/customhome \
  -s /bin/bash \
  -g primarygroup \
  -G wheel,developers \
  -u 1501 \
  -c "Full Name" \
  -e 2024-12-31 \
  username

Here’s what each option signifies:

• -m: Create a home directory
• -d: Define a custom home directory path
• -s: Specify the login shell
• -g: Identify the primary group
• -G: List secondary groups (comma-separated)
• -u: Assign a specific UID
• -c: Include a comment (typically the full name)
• -e: Set an account expiration date

Real-World User Creation Scenarios

Let’s explore some practical examples you may face in real-world environments:

Establishing a Developer Environment

# Form a development team with shared group access
sudo groupadd developers
sudo useradd -m -g developers -G wheel -s /bin/bash alice
sudo useradd -m -g developers -G wheel -s /bin/bash bob
sudo passwd alice
sudo passwd bob

# Configure a shared development directory
sudo mkdir /opt/projects
sudo chown :developers /opt/projects
sudo chmod 2775 /opt/projects

Creating a Service Account

# Establish a service account for a web application
sudo useradd -r -s /bin/false -d /opt/webapp webapp
sudo mkdir -p /opt/webapp
sudo chown webapp:webapp /opt/webapp

Providing Temporary Contractor Access

# Create a user with a 30-day expiration
sudo useradd -m -s /bin/bash -e $(date -d "+30 days" +%Y-%m-%d) contractor1
sudo passwd contractor1

# Add to a designated project group
sudo usermod -a -G project_alpha contractor1

Deleting Users: A Thorough Removal Method

Removing a user must be done thoughtfully to preserve data and ensure proper system cleanup. The userdel command presents various options:

# Basic user deletion (retains home directory)
sudo userdel username

# Remove user and their home directory
sudo userdel -r username

# Force deletion even if the user is logged in
sudo userdel -f username

# Remove user and all associated files
sudo userdel -r -f username

For production systems, a more cautious approach is often desired:

# Step-by-step method for safe user removal

# 1. Confirm if the user is currently logged in
who | grep username
ps -u username

# 2. Terminate user processes if needed
sudo pkill -u username

# 3. Backup user data before removal
sudo tar -czf /backups/username_backup_$(date +%Y%m%d).tar.gz /home/username

# 4. Delete the user but retain their home directory initially
sudo userdel username

# 5. Archive and remove home directory after verification
sudo mv /home/username /home/deleted_username_$(date +%Y%m%d)

Advanced User Management Strategies

Here are some advanced techniques and scenarios utilised by experienced administrators:

Bulk User Operations

# Create multiple users from a predefined list
#!/bin/bash
users=("dev1" "dev2" "dev3" "tester1" "tester2")
for user in "${users[@]}"; do
    sudo useradd -m -g developers -s /bin/bash "$user"
    echo "temppass123" | sudo passwd --stdin "$user"
    sudo chage -d 0 "$user"  # Force password change upon first login
done

Monitoring User Accounts

#!/bin/bash
# Check user accounts and their status

echo "=== User Account Status ==="
echo "Active users with home directories:"
getent passwd | awk -F: '$3 >= 1000 && $7 !~ /login|false/ {print $1, $3, $6}'

echo -e "\n=== Users with sudo access ==="
grep -E '^(wheel|sudo):' /etc/group | cut -d: -f4 | tr ',' '\n'

echo -e "\n=== Recently created users (last 7 days) ==="
find /home -maxdepth 1 -type d -newerct "7 days ago" -ls

Setting Up SSH Key Authentication

# Configure SSH keys for a new user
sudo -u username mkdir /home/username/.ssh
sudo -u username chmod 700 /home/username/.ssh
sudo -u username touch /home/username/.ssh/authorized_keys
sudo -u username chmod 600 /home/username/.ssh/authorized_keys

# Insert public key (replace with the actual key)
echo "ssh-rsa AAAAB3NzaC1yc2E..." | sudo -u username tee -a /home/username/.ssh/authorized_keys

Common Challenges and Their Resolutions

# Verify if the username is already in use
getent passwd username

# Check for available UIDs
awk -F: '$3 >= 1000 && $3 < 2000 {print $3}' /etc/passwd | sort -n

# Ensure the group exists before assignment
getent group groupname

# Correct home directory permissions
sudo chown -R username:username /home/username
sudo chmod 755 /home/username

# Confirm user shell validity
grep username /etc/passwd
chsh -s /bin/bash username

# Identify all files owned by the user prior to removal
sudo find / -user username -type f 2>/dev/null

# Check for running processes
sudo lsof -u username

# Remove user from all groups
sudo gpasswd -d username groupname

# Configure password aging policy
sudo chage -M 90 -m 7 -W 7 username

# Set account lockout following failed attempts
sudo authconfig --enablefaillock --faillockargs="deny=3 unlock_time=600" --update

---
- name: Manage users on CentOS 7
  hosts: centos_servers
  become: yes
  vars:
    developers:
      - { name: "alice", groups: "wheel,developers" }
      - { name: "bob", groups: "developers" }

  tasks:
    - name: Create developer group
      group:
        name: developers
        state: present

    - name: Create developer users
      user:
        name: "{{ item.name }}"
        groups: "{{ item.groups }}"
        shell: /bin/bash
        createhome: yes
        state: present
      loop: "{{ developers }}"