# Linux users

System users on the VPS with a private home, optional sudo, forced password change and deletion with confirmation.

Source: https://ardumaker.com/en/docs/usuarios-linux/

- Category: Servers and infrastructure
- Status: Available
- Requirements: A running company VPS; To list and view: access to the VPS; To create, edit or delete: being a company admin
- MCP tools (Read only): `listar_usuarios_vps`, `ver_usuario_vps`
- MCP tools (Write or modify): `crear_usuario_vps`, `editar_usuario_vps`
- MCP tools (Destructive): `eliminar_usuario_vps`

## What can you do with it?

- List the users that can log in to the VPS and which ones have `sudo`.
- Create a user with a password, a private home and, if requested, `sudo`.
- Force a password change on first login (on by default).
- Change the password or grant and remove `sudo`.
- Delete a user, with or without their home folder.

## When should you use it?

- Giving someone SSH or terminal access without sharing `root`.
- A dedicated user to run an application.
- Removing access for someone who left the team.

## How does it work in ArduMaker?

### Creation

1. The name is validated: it starts with a lowercase letter or `_`, followed by lowercase letters, digits, `_` or `-`, up to 32 characters. The password is required.
2. If the user does not exist, it is created with `useradd -m -s /bin/bash`, the password is set and, with `force_password_change`, it is marked as expired (`chage -d 0`). A user that already existed is not touched.
3. Its home `/home/<usuario>` is left with 700 permissions and any missing startup files from `/etc/skel`.
4. With `sudo=true` it is added to the `sudo` group.

### Listing

Only “human” users appear: UID 1000 or higher, with a login shell and an enabled password, plus `root`. System users (`www-data`, `postgres`…) are not listed.

### Deletion

- `root` can never be deleted.
- An agent must send `confirmacion` with the exact username: the guard forces it to read what is about to be destroyed.
- By default the home folder is deleted too (`remove_home=true`); with `false` it is kept.
- Processes running as that user keep going until they end: deleting the account does not kill them.
- The deleted username is written to the VPS activity log.

## What actually changes?

- `/etc/passwd`, `/etc/shadow` and the system groups (`sudo`).
- `/home/<usuario>` with 700 permissions, owned by the user.
- The user list ArduMaker keeps for the VPS is updated on create and on list.
- An entry in the VPS activity log for each operation.

## Logging in with the user

Creating the user does not open SSH. To log in from outside you need a port forward to port 22, ideally with an expiry (see [Firewall and ports](https://ardumaker.com/en/docs/firewall-y-puertos)):

```bash
ssh -p <host_port> usuario@<dnsip>
```

With `force_password_change=true`, on first login the system asks for the current password and a new one.

## Diagram

**Creating a user**

```text
Request (username, password, sudo)
  ↓
Validation (valid name, company admin)
  ↓
VPS agent (useradd → chpasswd → chage → usermod)
  ↓
Result (user with a 700 home and optional sudo)
```

## Expected result

- `listar_usuarios_vps` returns `users` and `sudo_users` (always including `root`).
- `ver_usuario_vps` returns the user's line in `/etc/passwd`.
- `crear_usuario_vps` on a user that already exists returns that user with `ya_existia: true` instead of failing.

```bash
id usuario
sudo -l -U usuario
```

## Errors and troubleshooting

| Answer | Cause | What to do |
| --- | --- | --- |
| 400 `Invalid username` | Uppercase, spaces or disallowed characters | Use the valid format |
| 404 `User '<usuario>' not found` | That user does not exist | List first |
| 403 when deleting `root` | `root` is protected | — |
| 428 without `confirmacion` | An agent did not send the exact name | Resend the same call with `confirmacion` equal to the username |
| 403 | Creating, editing or deleting requires a company admin | Ask an admin |

> **PELIGRO:** Deleting a user is irreversible: there is no trash, and by default their home folder goes with it.

Creating is safe to repeat (it returns the existing one with `ya_existia`), but in that case the password is not changed. A `userdel` or `deluser` through `ejecutar_comando_vps` is always rejected, with no way to confirm it: the intended path is `eliminar_usuario_vps`.

## MCP access

Yes, in the `/mcp` and `/mcp/vps` profiles.

| Tool | Type | Notes |
| --- | --- | --- |
| `listar_usuarios_vps`, `ver_usuario_vps` | Read | — |
| `crear_usuario_vps` | Write | Admin; idempotent by name |
| `editar_usuario_vps` | Write | Admin; `password` and/or `sudo` |
| `eliminar_usuario_vps` | Destructive, irreversible | Admin; `confirmacion` = exact name |

Reference at [/mcp/docs](https://ardumaker.com/en/mcp/docs) and examples at [/mcp/vps](https://ardumaker.com/en/mcp/vps).

## Related features

- [VPS servers](https://ardumaker.com/en/docs/vps/)
- [Web terminal](https://ardumaker.com/en/docs/terminal-web/)
- [Firewall and ports](https://ardumaker.com/en/docs/firewall-y-puertos/)
- [Agent audit](https://ardumaker.com/en/docs/auditoria-de-agentes/)