Groups¶

A group is a list of users that a permission can be granted to. On Linux the group that matters most is sudo, but several others hand out power quietly.

Groups that grant power¶

Group	Grants	Who belongs
`sudo` (Mint, Debian)	Run any command as root with your own password	README administrators only
`adm`	Read every log in `/var/log`	Administrators; harmless for others but not needed
`disk`	Raw read and write on block devices, which bypasses every file permission	Nobody
`shadow`	Read `/etc/shadow`, the password hashes	Nobody (CIS 7.2.4)
`docker`, `lxd`	Start containers that mount the host's disk, which is root	Nobody unless the README's service needs it
`root` (GID 0)	Group ownership of most of `/etc`; write access follows	Nobody but root

for g in sudo adm disk shadow docker lxd root; do echo "$g: $(getent group $g | cut -d: -f4)"; done

Read the whole file¶

cat /etc/group

Each line is name:x:GID:members. The README may name groups the organization uses; those stay and their membership matches the README. A group that isn't in the README and has no system purpose is worth removing, especially one with a name meant to look official.

Add and remove¶

sudo gpasswd -a alice sudo        # add alice to sudo
sudo gpasswd -d bob sudo          # remove bob from sudo
sudo groupadd projectx            # create a group the README asks for
sudo groupdel oldgroup            # delete a group

usermod -aG group user also adds; the -a matters, because usermod -G without it replaces every group the user is in.

A user's primary group is in /etc/passwd field 4. It's normally a group with the user's own name; a user whose primary group is root or sudo is unusual and worth fixing: sudo usermod -g alice alice.

Verify¶

getent group sudo
groups alice

Example¶

README: alice and carol are administrators. getent group sudo shows alice, dave, carol. getent group shadow shows dave. getent group docker shows bob. Remove dave from both groups and then check whether dave should exist at all. bob in docker is root by another road; unless the README says bob runs containers, take him out.

Try it¶

Add a test user to sudo, shadow, and disk, then find all three with getent. Remove them.
For each group in the table, write one line on what a member could do.

Build it¶

Extend accounts.sh to print the members of every group in the table.

Next¶

Remove and Create Accounts