---
title: usermod — Change account attributes
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A command for changing a user's group, shell, and home. Especially often used to add supplementary groups.
tags: program, User and Security Management, usermod
---

**💬 "usermod command"**

usermod changes **the attributes of an existing account**. The most common use is adding supplementary groups.

If you use -G alone instead of -aG, all existing supplementary groups are removed, so be careful.

- **Concept**: Changes account attributes such as group, shell, and home directory.
- **-aG**: Adds groups while keeping existing groups.
- **-s**: Changes the login shell.
- **-L/-U**: Locks/unlocks the account.
## Commonly Used Options

| Option | Description |
| --- | --- |
| -aG <group> | Add supplementary groups (keep existing) |
| -s <shell> | Change the login shell |
| -d <home> -m | Change and move home directory |
| -L | Locks the account |

## 3 Essential Command Combinations

- `usermod -aG www-data myapp` — Add to the web server group
- `usermod -aG docker deploy` — Grant permission to run Docker
- `id deploy` — Verify the group change result
**💬 "Please give an example of a procedure to check before accidentally deleting"**

This is a step-by-step summary of situations commonly encountered on live production servers.

### Step 1 · Check Current Groups

Check the current state before making changes.

```
id deploy
```

### Step 2 · Add a Group

Use -aG to add a group while keeping existing groups.

```
usermod -aG www-data deploy
```

### Step 3 · Log In Again and Verify

Group changes take effect from a new session.

```
id deploy
```

## How to Use This in Practice

### 1. Grant a Service Group to a Deployment User

**Situation** — The deployment account needs to read and write to the web root.

```
usermod -aG www-data deploy && id deploy
```

**Result** — www-data is added to the supplementary groups.

**Point** — Using -G alone is prohibited because it removes existing groups.

### 2. Lock an Account

**Situation** — You need to immediately block a former employee's account.

```
usermod -L -s /usr/sbin/nologin olduser
```

**Result** — Logins are blocked and the shell is disabled.

**Point** — To block key authentication as well, clean up authorized_keys.

## Caution

- -G alone overwrites supplementary groups. Always use -aG.
- Group changes do not apply immediately to the current login session.
- Moving the home directory (-m) can take a long time for large data and may leave the location inconsistent if it fails.
## Actual Execution Screen

This is the result after adding a supplementary group and verifying the outcome.

![usermod command execution result: group addition confirmed](https://games.aidebatehub.com/assets/usermod-demo.png)

Live production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/security/usermod.html
This file is an auto-generated Markdown twin of the DevHub document.