Linux with Operating System Concepts

username2
to change the 
user’s username to the 
username2
. Other options include -L to lock this user’s account, 
-m 
directory
to move the user’s home directory to the new directory, and 
-
U to unlock an 
account that was previously locked. The groupmod instruction is the same as groupadd 
except that it also has a 
–n 
newgroup
 
option to change the group name to 
newgroup
, 
similar to useradd’s -l option.
The userdel command, like the GUI, is used to delete user accounts. This can but does 
not have to delete the associated files (the user’s home directory, temporary files, and mail 
file). The command is 
userdel 
username
where 
username
must be an existing user. If 
the user is logged in, you will be given an error and the user will not be deleted, unless you 
force the deletion (see the options below). The user deletion removes the user’s entry in /etc/
passwd, /etc/shadow, /etc/group (if the user has a private group) and /etc/gshadow (if the 
user has a private group). The user’s name is removed from all groups.
The two important options are:
• -f—force deletion even if the user is currently logged in or has running processes. This 
option also deletes the user’s home directory and mail file even if the home directory 
is shared between users. This option is drastic and should probably not be used.
• -r—deletes user files (home directory, mail). Files owned by the user in other loca-
tions are not deleted.
The userdel command exits with a success value. These are as follows:
• 0—success
• 1—cannot update passwd file
• 2—invalid syntax
• 6—user does not exist
• 8—user is currently logged in
• 10—cannot update group file
• 12—cannot remove home directory
In the case of all but 0 above, the command fails and you will have to reissue it after 
resolving the problem.
The userdel will not delete a user if he or she has running processes (even if not logged 
in) unless you use -f. As using -f can be overkill (for instance, by deleting a directory 
shared among users), it is best to manually kill the running processes of the user and then 
delete the user. Alternatively, you could always lock the user out of his or her account and 
wait for the processes to finish on their own. Note that even with -r, any files owned by 

---

364
◾
Linux with Operating System Concepts
this user outside of the user’s home directory will not be deleted. Therefore, you would 
have to manually search for any files owned by this user to either change ownership or 
delete them.
The groupdel instruction is perhaps one of the easiest in Linux. There are no options; 
instead it is simply 
groupdel 
groupname
. The group is deleted from the /etc/group 
and /etc/gshadow files, and the group is removed from any user’s list of groups as stored 
in /etc/passwd. There may however be files owned by this group and so you would have 
to manually search for those files and change their ownership. As with userdel, groupdel 
returns an exit value as follows:
• 0—success
• 2—invalid command
• 6—group does not exist
• 8—group is an existing user’s private group
• 10—cannot update group file
Care should be taken when deleting a user or a group. You should have policies estab-
lished that determine when a user or group can be deleted. Section 9.8 discusses user 
account policies. Before deletion, ensure that the user is not logged in or that the group is 
not a private group. Finally, after performing the deletion, check the system to make sure 
that no remnant files owned by the user or group exist.
Just as we wrote a script to create user accounts, we might similarly want to create a 
script to delete user accounts. Below is an example of such a script. We will assume that 
the user account names are stored in a text file and we will input this file, deleting each 
account. Some questions to answer before writing this script are whether we should force 
deletion in case any of these users are currently logged in, and whether we want to remove 
the users’ home directories and email space. Let us assume that we do not want to force 
deletion in any case and we will delete the user’s directory/email only if there is an entry 
of “yes” in the file after the username. This requires that we input two values from each 
row of the file. We will call the variables 
username
and 
deletion
. In order to decide 
whether to delete the directory/email, we will use the condition 
[ –z $deletion ]
. The 
-z option tests to see if the variable is null (has no value). So, if true, it means that there was 
no “yes” after the username and so we should not delete the directory/email. The else clause 
then will delete the directory/email using -r. Our script is shown below.
#!/bin/bash
while read username deletion; do
if [ –z $deletion ]; then userdel $username
else userdel –r $username
fi
done

---

User Accounts
◾
365
As we did not force deletions, this script fails to delete users who are logged in and/or 
have processes currently running. Thus, if the system administrator were to run this script, 
it may not complete the task fully. We could enhance the script by keeping a record of any 
user who, when we attempted to delete them, we received an error code of 8 (user logged 
in). We can do this by examining the value of 
$?
after we execute the userdel command 
(recall $? stores the exit or return code of a function or command). Alternatively, we might 
want to see if the return code is anything other than a 0 as there are other reasons why a 
user may not be deleted (e.g., could not update the /etc/passwd file because it is currently 
open or otherwise busy, user does not exist). If we receive any error, we will store 
$user-
name
in a file of usernames that still require deletion. We can add this instruction between 
the 
fi
and 
done
statements.
if [ $? –ne 0 ]; then echo “$username” 
>>
/root/not_yet_deleted.txt; fi
Or, we could use -f in our userdel commands to force deletion. However, the above if-
then statement is still useful to keep track of any user not deleted no matter what reason 
caused it.
9.4 PASSWORDS
In this section, we examine user passwords.