👤 User & Group Manager

🎯 Preset

Pick a curated starting point. The form fields repopulate when you change presets.

⚙️ Operation

🐧 Target distribution

Linux distros emit useradd / usermod / groupadd. FreeBSD swaps to pw useradd, pw usermod, etc.

👤 User

UID

Primary GID

Comment / GECOS

Home directory

Shell

Use /sbin/nologin or /bin/false for service accounts.

Supplementary groups (comma-separated)

Account expiry (YYYY-MM-DD)

Password expire (days)

Password (optional)

⚠ Passwords passed via command line are visible in process listings. Prefer interactive passwd or a secrets manager.

👥 Group

Group name *

GID

Members (comma-separated)

🔍 Audit /etc/passwd and /etc/group

Paste the contents of /etc/passwd and /etc/group to surface UID 0 imposters, duplicate UIDs/GIDs, orphan primary groups, system users with login shells, and shells not in /etc/shells.

/etc/passwd

/etc/group

📜 Generated commands

{{ allCommandsText || '# Fill in the form on the left to generate commands.' }}

📖 Per-command explanation

{{ c.command }} {{ c.explanation }}

⚠️ Warnings

{{ w }}

🛡️ Audit findings

⚠ {{ auditError }}

✅ No issues detected in the pasted /etc/passwd and /etc/group content.

{{ f.severity.toUpperCase() }} — {{ f.issue }}

→ {{ f.suggestion }}

ℹ️ Context

{{ explanation }}

⚠️

ℹ️ About User & Group Manager

What this tool builds

This tool emits the canonical Linux command lines for managing user and group accounts — useradd, usermod, userdel, groupadd, groupmod, groupdel, chage, and passwd — from a form. Pick the operation, fill in the fields that matter, and copy the generated command (or download a wrapping bash script). Nothing is executed on this server; the tool only constructs the command text you would run on a target host.

The "Audit /etc/passwd and /etc/group" panel parses pasted file content (per passwd(5) and group(5)), and surfaces common misconfigurations: UID 0 accounts other than root, duplicate UIDs or GIDs, system accounts with login shells, users whose primary GID has no matching group, and shells that are not in the standard /etc/shells list.

/etc/passwd field format (quick reference)

One colon-separated line per user, seven fields:

name — login name (must be a valid POSIX identifier).
passwd — historically the encrypted hash; modern systems use x to indicate the real hash is in /etc/shadow.
uid — numeric user ID. 0 = root; 1–999 = system; >= 1000 = human users (Debian / Ubuntu convention).
gid — primary group ID. Must match an entry in /etc/group for tooling to resolve the group name.
gecos — comma-separated comment field (full name, room, work phone, home phone, other).
home — home directory path. Set by useradd -d.
shell — login shell. Service accounts should use /sbin/nologin or /bin/false.

/etc/group field format

Four colon-separated fields:

name — group name.
passwd — group password placeholder. Usually x (in /etc/gshadow) or empty.
gid — numeric group ID.
members — comma-separated list of supplementary members (users whose primary GID is something else but who are also in this group).

Common pitfalls

usermod -G without -a — -G alone replaces the user's supplementary group list, silently revoking sudo / docker / wheel membership. Use -aG to append.
Passwords on the command line — passwords passed as arguments are visible in shell history and /proc/<pid>/cmdline. Pipe to chpasswd via stdin, or run passwd interactively.
UID 0 imposters — any account with UID 0 is the root user as far as the kernel is concerned. Only root should hold that UID.
System account with a shell — service accounts (UID < 1000) should use /sbin/nologin so daemons cannot be hijacked into interactive sessions.
Shell not in /etc/shells — chsh, vsftpd, dovecot, and many other daemons refuse logins for shells that are not in /etc/shells.
userdel -r — removes the home directory and mail spool. There is no undo.
Duplicate UIDs / GIDs — files belong to all accounts sharing the UID. Re-number with usermod -u + find / -uid <old> -exec chown ....

Distro-specific notes

Debian / Ubuntu — the canonical sudo group is sudo; UID range starts at 1000.
RHEL / CentOS / Fedora — the canonical sudo group is wheel; UID range starts at 1000.
Arch Linux — same convention as Debian; UID range starts at 1000.
Alpine — ships adduser from busybox by default, but useradd is available via the shadow package and behaves identically.
FreeBSD — does not use the GNU useradd family. The native tool is pw (see pw(8)): pw useradd alice -m -s /bin/sh. Switch the "Distro" dropdown to FreeBSD to emit the pw-form output.

Source references

passwd(5) — /etc/passwd file format.
group(5) — /etc/group file format.
useradd(8) — create a new user account.
usermod(8) — modify an existing user account.
userdel(8) — delete a user account.
groupadd(8) — create a new group.
chage(1) — change user password expiry information.
shells(5) — list of valid login shells.
FreeBSD pw(8) — FreeBSD's user/group administration tool.

API Usage Example:

POST /api/tools/linux/user-group-manager
Content-Type: application/json

{
    "action": "generate",
    "input": {
        "operation": "create-user",
        "distro": "debian",
        "user": {
            "name": "alice",
            "shell": "/bin/bash",
            "supplementaryGroups": [
                "sudo",
                "docker"
            ],
            "createHome": true,
            "comment": "Alice Dev"
        }
    }
}