Loading...

VONDS ©

Lab 151: usermod User Account Modification

Back to Lab Index

Collect baseline identity evidence for an existing user, apply a set of account changes efficiently with usermod, perform a separate login rename operation, then verify the final state through NSS and filesystem ownership checks.

users security core

Scenario

User Satoshi has moved teams. You must update access and account settings with minimal disruption. Capture baseline evidence first, apply changes efficiently, rename the login, then verify the final state with proof.

Requested changes

Primary group developers, add docker and wheel, set shell to /bin/zsh, move home to /srv/satoshi, set account expiry to 2025-12-31, set UID to 1055, set comment to Satoshi Nakamoto, and rename login satoshi to satoshi-renamed.

Objective

  • Capture baseline account identity and group membership.
  • Apply primary group, supplementary groups, shell, home move, expiry, UID, and comment changes.
  • Rename the login from satoshi to satoshi-renamed.
  • Verify final NSS passwd entry for the renamed account.
  • Confirm the new home path exists and ownership looks sane.

Concepts

  • Baseline evidence first: id captures uid, gid, groups before changes.
  • Primary versus supplementary groups: -g sets primary; -aG appends supplementary groups without overwriting.
  • Home directory move: -d sets new home; -m moves contents.
  • Account identity changes: -u changes UID and can affect file ownership outside the home directory.
  • Account expiry: -e sets login expiration date.
  • Login rename: -l changes the username and is commonly done as a separate, explicit step.
  • Verification: getent passwd proves NSS state; ls -ld validates directory ownership and permissions.

Walkthrough

Step 1 : Capture baseline state for satoshi.
Command 
id satoshi

Start with baseline evidence. If something breaks, this is what you compare against and what you paste into a ticket update. It captures uid, primary gid, and supplementary groups. 

uid=1003(satoshi) gid=1003(satoshi) groups=1003(satoshi)
Step 2 : Apply requested changes in one usermod command.
Operational note

Combining changes reduces steps, but you still validate outcomes and separate the login rename to keep operations explicit and easier to roll back.

Command 
sudo usermod -g developers -aG docker,wheel -s /bin/zsh -d /srv/satoshi -m -e 2025-12-31 -u 1055 -c "Satoshi Nakamoto" satoshi

This updates group membership, login shell, home directory location and moves the home contents, sets the account expiry date, changes the UID, and updates the comment field. The -aG is critical because it appends groups; omitting -a overwrites the supplementary group list.

Step 3 : Rename the login from satoshi to satoshi-renamed.
Command 
sudo usermod -l satoshi-renamed satoshi

This changes the username. Separating it from the bulk modification makes it obvious when the identity shift happened and helps keep verification steps clean.

Step 4 : Verify the final account state via NSS.
Command 
getent passwd satoshi-renamed

This is the authoritative user record view. Confirm UID, primary group mapping, comment, home, and shell. If your environment uses directory services, getent is still the right tool because it reflects NSS resolution. 

satoshi-renamed:x:1055:2001:Satoshi Nakamoto:/srv/satoshi:/bin/zsh
Step 5 : Confirm the new home exists and ownership looks sane.
Command 
ls -ld /srv/satoshi

This confirms the directory exists and validates ownership and permissions. This is a practical check that the home move happened and the primary group aligns with the new team. 

drwx------ 4 satoshi-renamed developers 4096 Feb  8 07:11 /srv/satoshi

Common breakpoints

usermod fails because the user is logged in

Changing UID, home, and login names is risky while a user has active sessions. Ensure the account is not logged in and processes are stopped before applying identity changes.

Groups were overwritten instead of appended

If you used -G without -a you replaced the supplementary group list. Use -aG to append additional groups safely.

UID change causes unexpected file ownership issues

Files outside the home directory may still be owned by the old UID. After a UID change, locate and correct ownership on impacted paths when required by your environment.

Home directory move did not move contents

Ensure you included -m along with -d . Without -m , usermod updates the home path in metadata but does not relocate files.

Cleanup checklist

This lab is intentionally condensed and does not include a teardown step. If you are running in a disposable environment, your cleanup is reverting the identity changes or deleting the test account per your lab reset workflow.

Commands 
getent passwd satoshi-renamed
ls -ld /srv/satoshi
Success signal

The passwd entry shows the renamed login, the expected home, and the updated shell. The home directory exists with sane ownership and permissions.

Reference

  • id <user> : Displays UID, primary group, and supplementary groups.
  • usermod -g <group> <user> : Sets the primary group for a user.
    • -g : Primary group.
  • usermod -aG <g1,g2> <user> : Appends supplementary groups without overwriting existing groups.
    • -a : Append to supplementary groups.
    • -G : Supplementary groups (comma-separated).
  • usermod -s <shell> <user> : Sets the login shell.
    • -s : Login shell.
  • usermod -d <home> -m <user> : Sets home directory path and moves the contents.
    • -d : New home directory path.
    • -m : Move the content to the new home directory.
  • usermod -e <YYYY-MM-DD> <user> : Sets the account expiration date.
    • -e : Account expires on specified date.
  • usermod -u <uid> <user> : Changes the numeric UID for a user.
    • -u : New UID.
  • usermod -c "<comment>" <user> : Sets the account comment (GECOS).
    • -c : Comment field.
  • usermod -l <new> <old> : Renames the login username.
    • -l : New login name.
  • getent passwd <user> : Shows the NSS passwd entry for a user.
  • ls -ld <path> : Shows directory permissions and ownership.
    • -l : Long listing format.
    • -d : List the directory entry itself, not its contents.