groupaddCreate a group
groupadd creates a new group in /etc/group and /etc/gshadow. Groups are how you give a team shared access to files, sockets and sudo rules without making each file world-readable.
groupadd [-g GID] [-r] [-f] GROUPDevelopers need a shared /srv/devteam where everyone in the team can read and write each other's files.
sudoOnly root can edit /etc/group and /etc/gshadow.
groupadd reads GID_MIN and GID_MAX (1000 to 60000) and SYS_GID ranges from /etc/login.defs, locks the group files, picks a free GID (the highest in use plus one, or for -r a free number below 1000) unless you pass -g, and appends name:x:GID: to /etc/group and name:!:: to /etc/gshadow. The member list starts empty; you add people with usermod -aG or gpasswd -a. The kernel never sees group names: files and processes carry numeric GIDs, and names are only looked up through NSS when a tool like ls or id prints them. A user's groups take effect at their next login, because the list is loaded into the process credentials by initgroups() then.
-g GIDUse this numeric GID-rSystem group (GID below 1000), for services-fSucceed quietly if the group already exists (idempotent scripts)-oAllow a duplicate GID (with -g); rarely a good idea-U u1,u2Add these users as members at creation (newer shadow-utils)gpasswd -a USER GRPCompanion: add a member without touching other groupsgpasswd -d USER GRPCompanion: remove a membergroupdel / groupmod -nCompanions: delete or rename a groupCreating a group, adding users, and making the shared directory 777 'because group access didn't work'The users simply hadn't logged in again. 777 lets every account on the box write there.
chgrp the directory, chmod 2775, and have members log in again (or newgrp)Letting groupadd pick GIDs on each server for a shared NFS or volume mountThe same name gets different numbers on different hosts, so files show the wrong group or none.
sudo groupadd -g 2500 analytics on every host (or use LDAP/SSSD)Running groupadd in a provisioning script without -fThe second run fails with 'already exists' and stops the script.
sudo groupadd -f devteamTry these on a Linux machine of your own. Each task has a hint and a solution.
Create a group called ops and show its entry.
Create a system group called metrics and check its GID is below 1000.
Add devops to ops without touching other groups, then list ops members.
Make /srv/ops a directory owned by group ops where new files inherit the group.
groupaddCreate a group
groupadd creates a new group in /etc/group and /etc/gshadow. Groups are how you give a team shared access to files, sockets and sudo rules without making each file world-readable.
groupadd [-g GID] [-r] [-f] GROUPDevelopers need a shared /srv/devteam where everyone in the team can read and write each other's files.
sudoOnly root can edit /etc/group and /etc/gshadow.
groupadd reads GID_MIN and GID_MAX (1000 to 60000) and SYS_GID ranges from /etc/login.defs, locks the group files, picks a free GID (the highest in use plus one, or for -r a free number below 1000) unless you pass -g, and appends name:x:GID: to /etc/group and name:!:: to /etc/gshadow. The member list starts empty; you add people with usermod -aG or gpasswd -a. The kernel never sees group names: files and processes carry numeric GIDs, and names are only looked up through NSS when a tool like ls or id prints them. A user's groups take effect at their next login, because the list is loaded into the process credentials by initgroups() then.
-g GIDUse this numeric GID-rSystem group (GID below 1000), for services-fSucceed quietly if the group already exists (idempotent scripts)-oAllow a duplicate GID (with -g); rarely a good idea-U u1,u2Add these users as members at creation (newer shadow-utils)gpasswd -a USER GRPCompanion: add a member without touching other groupsgpasswd -d USER GRPCompanion: remove a membergroupdel / groupmod -nCompanions: delete or rename a groupCreating a group, adding users, and making the shared directory 777 'because group access didn't work'The users simply hadn't logged in again. 777 lets every account on the box write there.
chgrp the directory, chmod 2775, and have members log in again (or newgrp)Letting groupadd pick GIDs on each server for a shared NFS or volume mountThe same name gets different numbers on different hosts, so files show the wrong group or none.
sudo groupadd -g 2500 analytics on every host (or use LDAP/SSSD)Running groupadd in a provisioning script without -fThe second run fails with 'already exists' and stops the script.
sudo groupadd -f devteamTry these on a Linux machine of your own. Each task has a hint and a solution.
Create a group called ops and show its entry.
Create a system group called metrics and check its GID is below 1000.
Add devops to ops without touching other groups, then list ops members.
Make /srv/ops a directory owned by group ops where new files inherit the group.