3 of 4

Users, Groups and sudoLesson 3 of 4

Groups and shared access

Create groups, add users correctly, understand primary versus supplementary membership, and build a shared project directory.

  • groupadd
  • groupmod
  • groupdel
  • usermod
  • gpasswd
  • id
  • groups
  • getent
  • newgrp

40 min5 exercises

After this lesson you can

  • Create, rename and delete groups with a chosen GID.
  • Add and remove members without removing the groups they already have.
  • Build a directory that a team can share, using group ownership and the setgid bit.

The idea

Groups let you give the same permission to several people at once. Permissions on a file are checked against three things: the owner, the group and everybody else. Putting users in a group and giving the group access is how teams share a directory.

Each user has:

  • one primary group, stored in /etc/passwd and used as the group of newly created files,
  • any number of supplementary groups, listed in /etc/group.

id shows both. The most common mistake is usermod -G without -a, which replaces the supplementary list and silently removes the user from every other group, including wheel.

TaskCommand
Create a groupgroupadd [-g GID] name
Rename / change GIDgroupmod -n new old, groupmod -g GID name
Delete a groupgroupdel name (fails if it is anyone’s primary group)
Add a memberusermod -aG group user or gpasswd -a user group
Remove a membergpasswd -d user group
Set the primary groupusermod -g group user
Show membershipid user, groups user, getent group name

Group changes apply at the next login. A running shell keeps its old group list until the user logs in again (or runs newgrp group for a one-off shell).

Try it

sudo groupadd -g 3000 devs
sudo usermod -aG devs,wheel dana
getent group devs
id dana
devs:x:3000:dana
uid=1002(dana) gid=1002(dana) groups=1002(dana),10(wheel),3000(devs)
sudo usermod -G devs dana
id dana
uid=1002(dana) gid=1002(dana) groups=1002(dana),3000(devs)

wheel is gone: without -a the supplementary list was replaced by devs. Put it back with sudo usermod -aG wheel dana.

A shared directory

For files to stay shareable you need two things: group ownership and the setgid bit on the directory. With setgid (2 in the mode, s in the group execute position), new files inherit the directory’s group instead of the creator’s primary group.

sudo mkdir -p /srv/projects
sudo chown root:devs /srv/projects
sudo chmod 2770 /srv/projects
ls -ld /srv/projects
drwxrws---. 2 root devs 6 Nov  3 11:05 /srv/projects
sudo -u dana bash -c 'echo hello > /srv/projects/plan.txt; chmod g+w /srv/projects/plan.txt'
sudo -u erin bash -c 'echo more >> /srv/projects/plan.txt'
ls -l /srv/projects
-rw-rw-r--. 1 dana devs 11 Nov  3 11:06 plan.txt

Going further

getent group reads every source (files, LDAP, IdM), while grep /etc/group sees only local files. gpasswd -M a,b,c group sets the exact member list. groupmod -g changes a GID, but files keep the old number, so fix them with find / -gid OLD -exec chgrp NEW {} +. Groups with a password (gpasswd group) exist but are rarely used.

Practice

0 of 5 done

Do these on your own system. They get harder. Check each result, then tick it off.

  1. Warm-up

    Create a group and look it up

    Create a group devs with GID 3000, then show its line from the group database using getent.

    Check your result

    getent group devs prints devs:x:3000:.

    Hint

    groupadd -g 3000 devs.

    Solution
    sudo groupadd -g 3000 devs
getent group devs
  2. Practice

    Add a user without losing other groups

    Make dana a member of devs and wheel. She must keep any groups she already had. Show her groups before and after.

    Check your result

    id dana lists devs and wheel as supplementary groups together with her primary group.

    Hint

    usermod -aG: the -a (append) is essential. Without it the supplementary list is replaced.

    Solution
    id dana
sudo usermod -aG devs,wheel dana
id dana
  3. Practice

    Change the primary group

    Make devs the primary group of erin. Create a file as erin and show that it is owned by group devs.

    Check your result

    id erin shows gid=3000(devs). A file created by erin lists erin devs as owner and group.

    Hint

    usermod -g devs erin changes the primary group. Create the file with sudo -u erin touch /tmp/erin-file.

    Solution
    sudo usermod -g devs erin
id erin
sudo -u erin touch /tmp/erin-file
ls -l /tmp/erin-file
  4. Practice

    A directory the team shares

    Create /srv/projects owned by root:devs. Members of devs must be able to create and edit files; everybody else must have no access; new files must automatically belong to group devs. Test with dana creating a file and erin editing it.

    Check your result

    ls -ld /srv/projects shows drwxrws---, root devs. A file created by dana is group devs and can be changed by erin.

    Hint

    chgrp, chmod 2770. The 2 is the setgid bit: new files inherit the directory's group.

    Solution
    sudo mkdir -p /srv/projects
sudo chown root:devs /srv/projects
sudo chmod 2770 /srv/projects
ls -ld /srv/projects
sudo -u dana bash -c 'echo hello > /srv/projects/plan.txt; chmod g+w /srv/projects/plan.txt'
sudo -u erin bash -c 'echo more >> /srv/projects/plan.txt'
ls -l /srv/projects
  5. Challenge

    Remove a member and a group cleanly

    Remove erin from devs without touching any other group she has (change her primary group back to a private group erin first). Then delete the group devs once nobody has it as primary, and show what happens to the files that were owned by it.

    Check your result

    id erin no longer lists devs. After groupdel devs, ls -l /srv/projects/plan.txt shows the numeric GID 3000 instead of a name.

    Hint

    groupdel refuses to delete a group that is anyone's primary group. gpasswd -d user group removes one member.

    Solution
    sudo groupadd erin
sudo usermod -g erin erin
sudo gpasswd -d dana devs
sudo groupdel devs
ls -l /srv/projects/plan.txt