Managing User Groups

In Unix-like operating systems, a group is a collection of users with similar permissions.

Groups can have multiple users as members, and users can belong to multiple groups simultaneously.

Like users, each group has a unique name and a unique identifier.

Creating a new group

To create a new group, you can use the groupadd command as follows:

$ sudo groupadd groupname

Where groupname is the name of the group you want to create.

Example

This command will create a new group named developers:

$ sudo groupadd developers

Listing existing groups

In Unix-like operating systems, every group on the system is listed in the /etc/group file, which is a text-database used for managing user accounts and group memberships.

To display this file, you can use the cat command as follows:

$ cat /etc/group

The /etc/group file format

Each line of the /etc/group file defines a group and consists of 4 fields separated by colon characters (:):

group:password:gid:usernames

Where:

• group is the name of the group.
• password is used to implement privileged groups and is usually represented by an x. Note that the actual password is stored in the /etc/gshadow file in its encrypted form.
• gid or group ID is a unique number used to identify the group.
• usernames is a comma-separated list of user account names who belong to this group.

Example

Let's consider the following group:

developers:x:1000:johndoe,alicedoe

Where:

• developers is the name of the group.
• 1000 is the group ID.
• johndoe and alicedoe are the members of that group.

Listing a user's group memberships

To display the list of groups a user is a member of, you can use the groups command as follows:

$ groups username

Where username is the name of the user on the system.

This command will output the list of groups separated by a space character:

username : group ... groupN

Example

This command will display the list of groups the johndoe user is a member of, which are johndoe and developers:

$ groups johndoe
johndoe : johndoe developers

Changing the primary group of a user

To change the primary group of a user account, you can use the usermod command with the -g flag as follows:

$ sudo usermod -g group username

Where group is the name of the new primary group of the specified user identified by username.

Note: Any file from the user's home directory owned by the previous primary group will be owned by this new group.

Adding secondary groups to a user

Secondary groups are useful for granting access to resources that need to be shared among a specific set of users.

To add one or more secondary groups to a user, you can use the usermod command with the -a flag (short for --append) and the -G flag (short for --groups) as follows:

$ sudo usermod -a -G group[,group,...] username

Where:

• group[,group,...] is a list of comma-separated group names or GIDs.
• username is the name of the user you want to add groups to.

Example

This command will add the developers and quality_assurance groups as secondary groups to the johndoe user account:

$ sudo usermod -a -G developers,quality_assurance johndoe

Removing a user from secondary groups

To remove a user from one or more secondary groups, you can use the usermod command with the -G flag as follows:

$ sudo usermod -G group[,group,...] username

Where group[,group,...] is a list of comma-separated group names or GIDs that you want to keep the user in.

If the user is a member of a non-listed group, they will be removed from it.

Example

Let's consider the following johndoe user:

$ groups johndoe
johndoe : johndoe developers quality_assurance

This command will remove the johndoe user from the quality_assurance group but keep them as a member of the developers group:

$ sudo usermod -G developers johndoe

Removing a group

To remove a group from the system, you can use the groupdel command as follows:

$ sudo groupdel group

Note: Before deleting a group, you must make sure that no users are currently assigned to that group as their primary group and no files or directories are owned by that group.

Summary

Here's a summary of what you've learned in this lesson:

• The groupadd command is used to create new groups.
• The /etc/group file is a text-database used for managing user accounts and group memberships.
• The groups command is used to list the groups a user is a member of.
• The usermod -g command is used to change a user's primary group.
• The usermod -a -G command is used to add a user to secondary groups.
• The usermod -G command is used to remove a user from secondary groups.
• The groupdel command is used to remove groups.