Groups: Sharing Access

Why groups?

Permissions have a slot for the group. Put the people who work on the same thing in one group, give the group access to their files, and you never have to list people one by one.

Creating a group and adding members

sudo groupadd developers
sudo usermod -aG developers alice
id alice
getent group developers

In the terminal

student@vulntech:~$ sudo groupadd developers
[sudo] password for student:
student@vulntech:~$ sudo usermod -aG developers alice
student@vulntech:~$ id alice
uid=1001(alice) gid=1002(alice) groups=1002(alice),1003(developers)
student@vulntech:~$ getent group developers
developers:x:1003:alice

Common mistake: Always write -aG. usermod -G developers alice without -a (append) replaces all of Alice's extra groups with just developers. Forget it on your own account and you can lose sudo!

Removing a member, deleting a group

sudo groupadd developers
sudo usermod -aG developers alice
sudo gpasswd -d alice developers
sudo groupdel developers
getent group developers

In the terminal

student@vulntech:~$ sudo groupadd developers
[sudo] password for student:
student@vulntech:~$ sudo usermod -aG developers alice
student@vulntech:~$ sudo gpasswd -d alice developers
Removing user alice from group developers
student@vulntech:~$ sudo groupdel developers
student@vulntech:~$ getent group developers

Joining a group yourself

Group membership is read when you log in. Add yourself to a group, and your running shell doesn't know yet. id -nG shows your shell's groups, id -nG student what's in the files:

sudo groupadd developers
sudo usermod -aG developers student
id -nG
id -nG student

In the terminal

student@vulntech:~$ sudo groupadd developers
[sudo] password for student:
student@vulntech:~$ sudo usermod -aG developers student
student@vulntech:~$ id -nG
student sudo
student@vulntech:~$ id -nG student
student sudo developers

Log out and in again (or start a new login with su - student) to pick up the new group.

A shared folder

This is how a team gets a folder where everyone can work. The 2 in 2775 is the SGID bit from the last module: new files belong to the developers group automatically.

sudo groupadd developers
sudo mkdir /srv/project
sudo chgrp developers /srv/project
sudo chmod 2775 /srv/project
ls -ld /srv/project

In the terminal

student@vulntech:~$ sudo groupadd developers
[sudo] password for student:
student@vulntech:~$ sudo mkdir /srv/project
student@vulntech:~$ sudo chgrp developers /srv/project
student@vulntech:~$ sudo chmod 2775 /srv/project
student@vulntech:~$ ls -ld /srv/project
drwxrwsr-x 2 root developers 0 Oct 17 06:37 /srv/project

Remember: groupadd creates, usermod -aG adds a member (with -a!), gpasswd -d removes one, groupdel deletes the group.