useradd tips — authorized account-provisioning literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may provision accounts on the host (lab VM / syllabus box you own or were given access to).
2. Prefer dry review of defaults (-D) first — never create production users without change control and ticket notes.
3. Record short factual notes; quote short Evidence (login name, UID/GID plan, home, shell — redact personal names).
4. Optional: group membership → groupadd-tips.
5. Optional: password set → passwd-tips or batch → newusers-tips.
6. Optional: aging policy → chage-tips.
7. Redact usernames, UIDs, and hostnames if policy requires.
8. Stop at literacy — no exploit / unauthorized account-creation cookbooks.

Allowed framing

• Classroom labs creating disposable lab users on authorized hosts.
• Binding short factual notes as Evidence (UID plan, shell, home layout).
• Documenting expected vs observed defaults (useradd -D) for authorized inventory notes.
• Comparing useradd ↔ groupadd / passwd / newusers / chage peer tip pages under one binder.
• Adjusting lab-only defaults when the syllabus explicitly authorizes a provisioning drill.

Scope we will not cover

• No crack/pirate/keygen via useradd.
• No intentional privilege-escalation PoCs that create root-equivalent accounts on foreign hosts.
• No credential-theft via provisioning metadata against hosts you do not own.
• No bypass cookbooks that plant backdoor users without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved lab host you control or may administer.
2. Run a short read-only useradd -D sample; quote defaults (GROUP, HOME, SHELL, INACTIVE, EXPIRE).
3. Optionally create one disposable lab user with a documented UID/GID plan; bind notes as Evidence.
4. Optional: set password via passwd-tips; set aging via chage-tips.
5. Stop at literacy — no attack or unauthorized account-creation cookbooks.

Practical notes for authorized labs

• -D is the binder-friendly default review; write modes need clear authorization.
• Prefer -r system accounts only when the syllabus asks for daemon-style drills — document the UID range.
• Home directories and skeleton files (SKEL) are part of Evidence — note path, do not dump private files.
• Pair with id-tips to verify the new identity after creation.
• Label lab users clearly (lab-, stu- prefixes) so they are not mistaken for production accounts.
• When comparing distributions, note that some use adduser wrappers — quote which tool you actually ran.

FAQ-aligned refusals (quick)

• Foreign host account planting → refuse.
• Backdoor / persistence via hidden UIDs → refuse.
• Sharing real employee usernames from production → redact or refuse.

For legal, authorized and educational use only.

FAQ

Sources