What are the best tools to manage Linux users and groups?

Well, everyone knows and uses CLI commands such as 'adduser'... But there is a web UI tool: Webmin. Webmin is a 'web-based' system configuration tool that provides a user-friendly interface for managing various aspects of a Linux system, including user and group management (if it has been granted to do that).

For managing Linux users and groups, I personally find tools like `usermod`, `useradd`, `groupadd`, and the `visudo` command for sudo privileges to be incredibly efficient. Additionally, using the `etc/passwd` and `etc/group` files directly can also offer more granular control.

Never use local users/groups. In 50+ server env you will loose track of keeping up with password security, group management, access rights, env setup, security breach ... Puppet/Ansible will help to push some (NIS like) rules but may not work as you expect on a long run. You need to foresee managing identity lifecycle (people, roles and policies change), not only pushing static user and group config. Use central IDM/IAM/PAM to manage it and have a local admin account only for a console access in case of network connectivity loss.

Barest minimum in an enterprise environment is LDAP authentication. Basic in an enterprise environment: Kerberos authentication. If you want to get fancy, FreeIPA is very nice.

These are valuable tools for your systems teams to know and understand very well, particularly for purposes of validating automated behavior for same, but in a production environment, these should not be managed manually or directly, in favor of standardized solutions that might manage user account lifecycle across an environment (i.e. LDAP that might add/remove users as you onboard/offboard team members from your environment's suite of applications)

usermod: This command-line tool lets you modify existing user accounts, including changing group memberships and other attributes.

It is not always the best practice to edit the configuration file for beginners to add/manage users and groups. Even mentioned in the last line of the article is not enough I think. If you would like to test this method, it is always good to have to backup the files and record its file permission as well.

Don't touch the files themselves, use the right tools to manage this files for you. As mentioned, usermod, ansible, puppet or something else.

It is unwise to manage users and groups with a run of the mill text editor, existing tools make consistency checks about what is in the corresponding files and about the files themselves, one should be aware about which files are involved in case troubleshooting of some kind is needed, but one should refrain from editing the files directly except in very specific circumstances (I do edit files in my personal laptop for example).

In some environments, editing configuration files is the only way to go. If a company is using single sign on (SSO) connected to a Windows server, manually editing configuration files, like /etc/passwd and /etc/group may be the only way to go. In these environments, you may need to setup user and group IDs that match ones entered in that user's Active Directory entry. In this kind of setup using source control so that any change can be reversed, as needed, is a very good idea.

I don't like graphical interfaces because it puts an additional degree of separation between administrator and the task at hand. Ironically I think they are best suited for the very experienced person (they can revert to simpler tools if required) or for the complete newcomer (they need all the support they can get, specially for the simple tasks they would be performing). A major problem with using graphical tools is that they aren't scriptable and their use is difficult and cumbersome to document.

A centralized way to manage users like AD, LDAP, or a hosted SSO provider is an increasingly valuable way to manage users, and their organization, across your suite of applications. This can span application-level authentication/authorization to infrastructure access for your entire organization and would be another well-understood and documented way to manage access that might be a more manual process even if using automation like config management that standardize access and user management.

Web-based tools have similar advantages and disadvantages to any other graphic tool, with the added complexity and security issues arising from using one more application (web server) over a network, they certainly can be justified, indeed the only alternative, when centralising control for a big enterprise, but documentation and repeatability become an issue, there are text based automation tools that perform the same tasks with the advantage that changes to users and groups are clearly spelled out and can be documented.

I have always found Webmin as a handy admin tool which helps in user and group management among many other tasks. The installation is pretty straightforward and usage is super easy. It’s a web based tool which has intuitive interface, helps to execute tasks easily and it comes as centralized solution for tasks such as user management, package management, firewall configuration, and more. Security-conscious administrators will appreciate Webmin's built-in security features, including SSL encryption for secure communication. Webmin offers logging and auditing capabilities, maintaining logs of user actions and configuration changes. If you have never tried it then try it now and if you need support in setting up then feel free to buzz me.

Puppet is a very useful tool to grant that desired definitions for users and groups remain applied in nodes, and we can also have intentional changes reports.

Using a configuration management tool like Ansible to manage users has the benefit of creating users in a repeatable, templated way to ensure users created by a role (for example, broken out by user class, with discrete permissions and settings) are truly identical, and eminently auditable behavior as part of your automation pipeline.

Automation reduces the risk of human error and ensures that each user and group adheres to the defined security protocols, helping to fortify your overall cybersecurity posture.

Although manual actions are easier sometimes and quicker, using best practises around security and audit you should always consider doing things using automation tools like ansible and puppet. Using a script or a code definition for your actions you know exactly what is performed and in which systems. Given that your infrastructure works with security principles automation should be executed only from authorised members.As such you will have a working setup that is not susceptible to attacks and human errors.

I would start with Ansible here for sure, because you define each system how it should look like, as well with the Users and groups as well with sudoers (I love sudo!) And yes you should start as well when you have to manage only one or two systems, the good thing is you can scale it up from 1 to thousands...

Join the machine to an LDAP domain. This is actually one of the few useful functions of AD. Alternatively one can brew their own solution based on openldap and some gui.