---
title: useradd — Account creation
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A command for creating service/deployment accounts and specifying home, shell, and group.
tags: program, User and Security Management, useradd
---

**💬 "useradd command"**

useradd **creates accounts**. Service accounts are operated with least privilege by disabling their login shell.

Unlike adduser (interactive), you specify exactly what you need using options.

- **Concept**: Creates a new user account.
- **-r**: Creates a system account and assigns a low UID.
- **-s**: Specifies the login shell (service accounts use /usr/sbin/nologin).
- **-G**: Specifies supplementary groups.
## Commonly Used Options

| Option | Description |
| --- | --- |
| -r | Create a system account |
| -m | Create home directory |
| -s /usr/sbin/nologin | Disable login (service account) |
| -G <group> | Assign supplementary groups |

## 3 Essential Command Combinations

- `useradd -r -s /usr/sbin/nologin -d /opt/app myapp` — Create a non-login service account
- `useradd -m -s /bin/bash deploy` — Create a login account for deployment
- `id myapp` — Check the creation result (UID/GID/groups)
**💬 "Create an example following a troubleshooting flow"**

Here are common situations encountered on real production servers, organized in order.

### Step 1 · Create account

Specify options according to the purpose.

```
useradd -r -s /usr/sbin/nologin -d /opt/app myapp
```

### Step 2 · Assign group

Add it to a supplementary group if necessary.

```
usermod -aG www-data myapp
```

### Step 3 · Verify

Verify the UID/GID and shell.

```
id myapp && getent passwd myapp
```

## How It Is Used in Practice

### 1. Separate Service Accounts

**Situation** — You need a dedicated account so the app doesn’t run as root.

```
useradd -r -s /usr/sbin/nologin -d /opt/app myapp && chown -R myapp:myapp /opt/app
```

**Result** — This creates the foundation for the app to run under a dedicated account.

**Point** — Running services under least-privilege accounts is a basic security practice.

### 2. Deployment Account

**Situation** — CI needs an account that can connect over SSH.

```
useradd -m -s /bin/bash deploy && mkdir -p /home/deploy/.ssh && chown -R deploy:deploy /home/deploy/.ssh
```

**Result** — You now have a deployment account on which key authentication can be set up.

**Point** — Restrict permissions to only the directories that need them.

## Things to Watch Out For

- Running services as root is practically forbidden. Create a dedicated account.
- If the shell is not set to nologin, the service account becomes a login route.
- When deleting an account, also clean up remaining file ownership and cron/service references.
## Actual Execution Screen

This is the result after creating a service account and verifying its UID/GID and shell.

![useradd command execution result: service account creation and verification](https://games.aidebatehub.com/assets/useradd-demo.png)

Real production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/security/useradd.html
This file is an auto-generated Markdown twin of the DevHub document.