Local users and groups done right: useradd, system accounts, password aging and the usermod -aG trap

Goal

Create and manage local Linux accounts correctly: an interactive user, a service account, password aging, group membership changes, and locking versus expiring an account — with the verification step for each.

Prerequisites

Root. useradd/usermod/chage come from the shadow suite (shadow-utils on RHEL/Fedora, passwd on Debian/Ubuntu), installed by default on those distributions; minimal images such as Alpine ship BusyBox adduser instead.

Steps

1. Create an interactive user with a home directory and an explicit shell: useradd -m -s /bin/bash alice. -m/--create-home is required on distributions where it is not the default (Debian's useradd does not create home directories unless configured to); without -s, the default shell comes from /etc/default/useradd, which may not be what is intended.
2. Set the initial password non-interactively where needed: echo 'alice:TempPass123' | chpasswd (the password lands in shell history unless read from a file or variable), then force a change at first login with chage -d 0 alice.
3. Create a system/service account with no login shell and no home directory content to maintain: useradd --system --shell /usr/sbin/nologin --no-create-home svc-app. --system picks a UID from the system range instead of the normal user range, keeping it out of user-facing UID listings. nologin (or /bin/false) as the shell prints a message and exits instead of granting a shell.
4. Add a user to a supplementary group without erasing their existing group memberships: usermod -aG docker alice. -a/--append is required together with -G; running usermod -G docker alice alone replaces the user's entire supplementary group list with just docker, silently dropping every other group they were in — a change that is easy to make by copying an incomplete command from memory. New group memberships apply only to new logins; running sessions keep their old groups. Membership in docker is effectively root access.
5. Set password aging limits: chage -M 90 -E 2027-01-01 alice sets a 90-day maximum password age (-M/--maxdays) and an account expiry date (-E/--expiredate); chage -l alice lists the current aging settings for verification.
6. Lock an account without destroying its password (reversible): usermod -L alice (or passwd -l alice); unlock with usermod -U alice. Locking disables password authentication by prefixing the hash with !, but on typical setups (OpenSSH with UsePAM yes) key-based SSH login still works — lock and expiry are different controls.
7. Expire an account outright (also blocks SSH keys once the expiry date passes, unlike locking): chage -E 0 alice expires it immediately, or a future date via -E.

Expected result

getent passwd alice and id alice show the intended UID, shell and group memberships; chage -l alice reflects the configured aging; a locked account's entry in getent shadow (root only) shows a ! or !! prefix on the hash.

Limits and test basis

Verified against useradd(8) (--system, --create-home), usermod(8) (--append), chage(1) (--expiredate, --maxdays), getent(1) and nologin(8). Undo: userdel alice removes the account (-r also removes its home directory and mail spool); removing a group membership added by mistake is gpasswd -d alice docker.