useradd — Account creation

💬 "useradd command"

useradd creates accounts. Service accounts are operated with least privilege by disabling their login shell.

Unlike adduser (interactive), you specify exactly what you need using options.

• Concept: Creates a new user account.
• -r: Creates a system account and assigns a low UID.
• -s: Specifies the login shell (service accounts use /usr/sbin/nologin).
• -G: Specifies supplementary groups.

Commonly Used Options

3 Essential Command Combinations

• useradd -r -s /usr/sbin/nologin -d /opt/app myapp — Create a non-login service account
• useradd -m -s /bin/bash deploy — Create a login account for deployment
• id myapp — Check the creation result (UID/GID/groups)

💬 "Create an example following a troubleshooting flow"

Here are common situations encountered on real production servers, organized in order.

Step 1 · Create account

Specify options according to the purpose.

useradd -r -s /usr/sbin/nologin -d /opt/app myapp

Step 2 · Assign group

Add it to a supplementary group if necessary.

usermod -aG www-data myapp

Step 3 · Verify

Verify the UID/GID and shell.

id myapp && getent passwd myapp

How It Is Used in Practice

1. Separate Service Accounts

Situation — You need a dedicated account so the app doesn’t run as root.

useradd -r -s /usr/sbin/nologin -d /opt/app myapp && chown -R myapp:myapp /opt/app

Result — This creates the foundation for the app to run under a dedicated account.

Point — Running services under least-privilege accounts is a basic security practice.

2. Deployment Account

Situation — CI needs an account that can connect over SSH.

useradd -m -s /bin/bash deploy && mkdir -p /home/deploy/.ssh && chown -R deploy:deploy /home/deploy/.ssh

Result — You now have a deployment account on which key authentication can be set up.

Point — Restrict permissions to only the directories that need them.

Things to Watch Out For

• Running services as root is practically forbidden. Create a dedicated account.
• If the shell is not set to nologin, the service account becomes a login route.
• When deleting an account, also clean up remaining file ownership and cron/service references.

Actual Execution Screen

This is the result after creating a service account and verifying its UID/GID and shell.

!useradd command execution result: service account creation and verification

Real production server

Source (HTML): https://games.aidebatehub.com/programs/linux/security/useradd.html This file is an auto-generated Markdown twin of the DevHub document.