Explaining the Process

The following steps illustrate what happens if the command useradd juan is issued on a system that has shadow passwords enabled:

• It begins with the username juan.

• There is an x for the password field indicating that the system is using shadow passwords.
• A UID greater than 499 is created. (Under Community Enterprise Linux, UIDs and GIDs below 500 are reserved for system use.)
• A GID greater than 499 is created.
• The optional GECOS information is left blank.
• The home directory for juan is set to /home/juan/.
• The default shell is set to /bin/bash.

• A new line for juan is created in /etc/shadow. The line has the following characteristics:
  • It begins with the username juan.
• Two exclamation points (!!) appear in the password field of the /etc/shadow file, which locks the account.

  If an encrypted password is passed using the -p flag, it is placed in the /etc/shadow file on the new line for the user.

• The password is set to never expire.

• A new line for a group named juan is created in /etc/group. A group with the same name as a user is called a user private group. For more information on user private groups, refer to "Adding a New User".

  The line created in /etc/group has the following characteristics:

  • It begins with the group name juan.
• An x appears in the password field indicating that the system is using shadow group passwords.
• The GID matches the one listed for user juan in /etc/passwd.

• A new line for a group named juan is created in /etc/gshadow. The line has the following characteristics:
  • It begins with the group name juan.
• An exclamation point (!) appears in the password field of the /etc/gshadow file, which locks the group.
• All other fields are blank.

• A directory for user juan is created in the /home/ directory. This directory is owned by user juan and group juan. However, it has read, write, and execute privileges only for the user juan. All other permissions are denied.
• The files within the /etc/skel/ directory (which contain default user settings) are copied into the new /home/juan/ directory.

  At this point, a locked account called juan exists on the system. To activate it, the administrator must next assign a password to the account using the passwd command and, optionally, set password aging guidelines.