To add a new user to the system, type the following at a shell prompt as root:

useradd [options] username

…where options are command-line options as described in Table 4.2, “Common useradd command-line options”.

By default, the useradd command creates a locked user account. To unlock the account, run the following command as root to assign a password:

passwd username

Optionally, you can set a password aging policy. See the Password Security section in the Red Hat Enterprise Linux 7 Security Guide.

The following steps illustrate what happens if the command useradd juan is issued on a system that has shadow passwords enabled:

At this point, a locked account called juan exists on the system. To activate it, the administrator must next assign a password to the account using the passwd command and, optionally, set password aging guidelines (see the Password Security section in the Red Hat Enterprise Linux 7 Security Guide for details).

To add a new group to the system, type the following at a shell prompt as root:

groupadd [options] group_name

…where options are command-line options as described in Table 4.3, “Common groupadd command-line options”.

Use the usermod utility to add an already existing user to an already existing group.

Various options of usermod have different impact on user's primary group and on his or her supplementary groups.

To override user's primary group, run the following command as root:

~]# usermod -g group_name user_name

To override user's supplementary groups, run the following command as root:

~]# usermod -G group_name1,group_name2,... user_name

Note that in this case all previous supplementary groups of the user are replaced by the new group or several new groups.

To add one or more groups to user's supplementary groups, run one of the following commands as root:

~]# usermod -aG group_name1,group_name2,... user_name

~]# usermod --append -G group_name1,group_name2,... user_name

Note that in this case the new group is added to user's current supplementary groups.

System administrators usually like to create a group for each major project and assign people to the group when they need to access that project's files. With this traditional scheme, file management is difficult; when someone creates a file, it is associated with the primary group to which they belong. When a single person works on multiple projects, it becomes difficult to associate the right files with the right group. However, with the UPG scheme, groups are automatically assigned to files created within a directory with the setgid bit set. The setgid bit makes managing group projects that share a common directory very simple because any files a user creates within the directory are owned by the group that owns the directory.

For example, a group of people need to work on files in the /opt/myproject/ directory. Some people are trusted to modify the contents of this directory, but not everyone.

When a process creates a file, the file has certain default permissions, for example, -rw-rw-r--. These initial permissions are partially defined by the file mode creation mask, also called file permission mask or umask. Every process has its own umask, for example, bash has umask 0022 by default. Process umask can be changed.

A umask consists of bits corresponding to standard file permissions. For example, for umask 0137, the digits mean that:

Umasks can be represented in binary, octal, or symbolic notation. For example, the octal representation 0137 equals symbolic representation u=rw-,g=r--,o=---. Symbolic notation specification is the reverse of the octal notation specification: it shows the allowed permissions, not the prohibited permissions.

Umask prohibits permissions from being set for a file:

The following figure shows how umask 0137 affects creating a new file.

[john@server tmp]$ umask 0000
[john@server tmp]$ touch file
[john@server tmp]$ mkdir directory
[john@server tmp]$ ls -lh .
total 0
drwxrwxrwx. 2 john john 40 Nov  2 13:17 directory
-rw-rw-rw-. 1 john john  0 Nov  2 13:17 file

~]$ umask
0022

~]$ umask -S
u=rwx,g=rx,o=rx

~]$ umask octal_mask

~]$ umask 0337

~]$ umask 337

~]$ umask -S symbolic_mask

~]$ umask -S u=r,g=r,o=

~]$ grep -i -B 1 umask /etc/bashrc

~]$ grep -i -B 1 umask /etc/bashrc
    # By default, we want umask to get set. This sets it for non-login shell.
--
    if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
       umask 002
    else
       umask 022

    if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
       umask 002
    else
       umask 227

john@server ~]$ echo 'umask 227' >> /home/john/.bashrc

# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK 077