Scope: Debian-based and RHEL-based Linux distributions
Topics: Primary and supplementary groups, group creation and deletion, membership management, /etc/group and /etc/gshadow, group modification, and verification.

Part 1: Debian-Based Systems#

Examples: Debian, Ubuntu

1. Create a Group#

Run as root:

addgroup <GROUP_NAME>

The GID is allocated automatically from the regular GID range.

2. Create a System Group#

Create a system group for a service or application:

addgroup --system <GROUP_NAME>

Options:

• --system: Allocates the GID from the system GID range instead of the regular range.

3. Add a User to a Group#

Add the user to the group as a supplementary group:

usermod -aG <GROUP_NAME> <USERNAME>

Options:

• -a: Appends the user to the group list without removing existing supplementary groups.
• -G: Specifies one or more supplementary groups.

Alternatively, use the Debian helper:

adduser <USERNAME> <GROUP_NAME>

Verify the membership:

id <USERNAME>
groups <USERNAME>

Confirm that <GROUP_NAME> appears in the output. If the user is logged in, start a new login session before testing access.

4. Remove a User from a Group#

Remove the user from a supplementary group:

deluser <USERNAME> <GROUP_NAME>

Alternatively:

gpasswd -d <USERNAME> <GROUP_NAME>

Start a new login session so the change takes effect in the user’s environment.

5. Modify a Group#

Rename an existing group:

groupmod -n <NEW_GROUP_NAME> <GROUP_NAME>

Change the GID of an existing group:

groupmod -g <NEW_GID> <GROUP_NAME>

Options:

• -n: Sets a new group name.
• -g: Sets a new GID.

Changing a GID does not update file ownership automatically. Run chgrp on affected files afterwards.

6. Verify Group Membership#

Inspect the account database:

id <USERNAME>
groups <USERNAME>
getent group <GROUP_NAME>

Expected output:

uid=1001(alice) gid=1001(alice) groups=1001(alice),27(sudo),1005(devops)
devops:x:1005:alice,bob

getent reads the configured name service, so it reflects LDAP or other directory-backed groups as well.

7. Delete a Group#

Delete the group:

delgroup <GROUP_NAME>

The command fails if the group is still the primary group of any user. Change those users first:

usermod -g <OTHER_GROUP> <USERNAME>
delgroup <GROUP_NAME>

Part 2: RHEL-Based Systems#

Examples: RHEL, Rocky Linux, AlmaLinux

1. Create a Group#

Run as root:

groupadd <GROUP_NAME>

The command completes silently on success. To assign a specific GID:

groupadd -g <GID> <GROUP_NAME>

Options:

• -g <GID>: Sets the GID explicitly.

2. Create a System Group#

Create a system group for a service or application:

groupadd -r <GROUP_NAME>

Options:

• -r: Allocates the GID from the system GID range.

3. Add a User to a Group#

Add the user to the group as a supplementary group:

usermod -aG <GROUP_NAME> <USERNAME>

Options:

• -a: Appends the user to the group list without removing existing supplementary groups.
• -G: Specifies one or more supplementary groups.

Verify the membership:

id <USERNAME>
groups <USERNAME>

Confirm that <GROUP_NAME> appears in the output. Start a new login session before testing access.

4. Remove a User from a Group#

Remove the user from a supplementary group:

gpasswd -d <USERNAME> <GROUP_NAME>

RHEL-based systems do not provide the Debian deluser helper by default.

5. Modify a Group#

Rename an existing group:

groupmod -n <NEW_GROUP_NAME> <GROUP_NAME>

Change the GID of an existing group:

groupmod -g <NEW_GID> <GROUP_NAME>

Options:

• -n: Sets a new group name.
• -g: Sets a new GID.

Run chgrp on affected files after a GID change.

6. Verify Group Membership#

Inspect the account database:

id <USERNAME>
groups <USERNAME>
getent group <GROUP_NAME>

Confirm that wheel and <GROUP_NAME> appear in the output.

7. Delete a Group#

Delete the group:

groupdel <GROUP_NAME>

The command fails if the group is still the primary group of any user. Change those users first:

usermod -g <OTHER_GROUP> <USERNAME>
groupdel <GROUP_NAME>

Part 3: Important Notes#

Primary vs. Supplementary Groups#

The id output lists the primary group as gid= and all groups in groups=, with the primary group first.

To use a different group for a single session without changing the account, run:

newgrp <GROUP_NAME>

New files created in that session are owned by the selected group.

/etc/group Format#

One line per group:

devops:x:1005:alice,bob

Do not edit this file directly. Use groupadd, groupdel, groupmod, and gpasswd, which keep the file consistent and handle locking.

/etc/gshadow Format#

One line per group:

devops:!::alice

Group passwords allow users to switch into a group with newgrp without being members. This mechanism is rarely used and weakens access control. Keep the field locked and manage membership explicitly.

Naming Rules and Reserved System Groups#

Naming rules:

• Use lowercase letters, digits, hyphens, and underscores.
• Keep names at or below 32 characters.
• Start with a lowercase letter or underscore.
• Do not reuse names of existing accounts or of vendor-reserved groups.

Reserved or well-known system groups:

sudo and wheel serve the same purpose: their members receive administrative privileges through the sudoers configuration. Debian-based systems grant this through the sudo group, RHEL-based systems through the wheel group. Both are ordinary groups whose power comes from the sudoers rule that references them. Confirm the sudoers rule before relying on membership, and verify actual GIDs with getent group <GROUP_NAME> instead of assuming them.

Command Reference#

Security Guidelines#

• Replace placeholders such as <GROUP_NAME> and <USERNAME> with actual names. Do not include the angle brackets in commands.
• Always use usermod -aG. The variant usermod -G replaces all existing supplementary groups.
• Never edit /etc/group or /etc/gshadow with a text editor. Use the group-management commands instead.
• Keep group passwords disabled. Grant access through explicit membership only.
• Do not add service accounts to sudo, wheel, adm, or disk.
• Assign a dedicated group per project or application and grant file access to that group instead of sharing accounts.
• Remove group membership promptly when a user changes role, and start a new login session to enforce the change.
• Delete groups that no longer serve a purpose. Review membership with getent group during audits.
• When logged in as root, the commands above do not require the sudo prefix.