LFCS 32 🐧 Groups — Creating and Managing - KandZ

A group is a named collection of users. It exists so that permissions can be granted to many users at once. Instead of chowning a file to a dozen users, an administrator chowns it to a group and adds the users to that group. Linux uses groups in two ways: as a primary group attached to the user account, and as supplementary groups that extend the user’s access. The LFCS exam tests group management alongside user management, and the commands — groupadd, groupmod, groupdel, gpasswd, newgrp — appear in scenarios that require both creating groups and controlling membership.

Key point: Every user has exactly one primary group, stored in /etc/passwd, and zero or more supplementary groups, stored in /etc/group. The primary group determines the group ownership of new files the user creates. The supplementary groups grant access to shared resources. Understanding this distinction is what makes group management predictable.

Why groups matter

The permission-granting problem. File permissions are three sets of read, write, and execute bits: one for the owner, one for the group, one for everyone else. Without groups, granting access to a subset of users requires either making them all owners or granting access to everyone. Groups provide the middle path: a named set of users who share a permission.

The primary-group problem. When a user creates a file, the file’s group is the user’s primary group. This is why every user has one. On modern distributions, the default is a user private group (UPG) with the same name as the user, so files default to being owned by the user and the user’s own group. On older systems, the default primary group was users, which meant every file was owned by the shared users group.

The supplementary-group problem. A user often needs access to resources owned by other groups. A developer needs write access to a shared project directory owned by the project group. A system administrator needs access to the sudo group to run privileged commands. Supplementary groups provide this without changing the primary group.

The multi-user problem. A shared resource, such as a project directory or a database socket, needs to be accessible to the users who work on it and no one else. A group is the mechanism. The resource is chowned to the group, the group is given the appropriate permissions, and the users are added to the group.

The lifecycle problem. Groups are created, renamed, given members, and eventually deleted. The commands for each operation are different, and the files they modify are different. Understanding what each command changes is what makes the effects predictable.

The exam problem. The LFCS exam is performance-based. A typical task might ask you to create a group with a specific GID, add a user to it, set a group password, or change a file’s group ownership. Knowing the commands and their flags is what makes the difference between passing and failing.

a. Creating groups with groupadd

The groupadd command creates a new group. It adds an entry to /etc/group and, on most distributions, an entry to /etc/gshadow.

The basic creation

The simplest form creates a group with the next available GID.

sudo groupadd developers

The group appears in /etc/group with the next GID above the regular range. The group has no members initially.

The specific GID

The -g flag sets a specific GID. The GID must be unique unless -o is used to allow duplicates.

sudo groupadd -g 1500 developers

GIDs below 1000 are traditionally reserved for system groups. GIDs in the regular range start at 1000 on most distributions.

The system group

The -r flag creates a system group. System groups have GIDs below the regular range and are used for services and daemons.

sudo groupadd -r docker

The system group is created with a GID in the system range, typically below 1000.

The non-unique GID

The -o flag allows a non-unique GID. This is used when a group must have a GID that already exists, which is sometimes necessary for compatibility with an NFS-mounted system or a shared resource.

sudo groupadd -o -g 1500 legacy-group

Two groups with the same GID have the same permissions. This is rarely desirable but occasionally necessary.

The group file entry

The groupadd command adds a line to /etc/group.

developers:x:1500:

The fields are: name, password placeholder (x), GID, and member list. The member list is empty for a new group.

The gshadow file

On most distributions, groupadd also adds an entry to /etc/gshadow. The gshadow file stores the group password hash and the group administrators.

developers:!::

The fields are: name, password hash (! means no password), administrators, and members. The gshadow file is only readable by root, which is why the password hash is not stored in /etc/group.

b. Modifying groups with groupmod and gpasswd

The groupmod command changes a group’s name or GID. The gpasswd command manages membership and group passwords.

The name change

The -n flag changes the group name.

sudo groupmod -n devs developers

The GID and members remain the same. Only the name changes. Files owned by the group still reference the old name until the name is updated in the filesystem, which happens automatically because the group is identified by GID, not by name.

The GID change

The -g flag changes the GID.

sudo groupmod -g 1600 developers

The change updates /etc/group and /etc/gshadow. Files owned by the old GID must be updated manually with find and chgrp.

sudo find / -gid 1500 -exec chgrp 1600 {} \;

Adding members with gpasswd

The -a flag adds a user to a group.

sudo gpasswd -a alice developers

The user is added to the group’s member list in /etc/group and /etc/gshadow. The user must log out and back in for the membership to take effect in their session, unless newgrp is used.

Removing members with gpasswd

The -d flag removes a user from a group.

sudo gpasswd -d alice developers

Setting the member list

The -M flag sets the entire member list, replacing the existing one.

sudo gpasswd -M alice,bob,carol developers

Group administrators

The -A flag sets the group administrators, who can add and remove members without being root.

sudo gpasswd -A alice developers

The administrator is stored in /etc/gshadow and can use gpasswd -a and gpasswd -d on the group.

The group password

The gpasswd command with just a group name sets a group password. A user who is not a member can join the group with newgrp by providing the password.

sudo gpasswd developers

Group passwords are rarely used in practice. They are a legacy feature that predates modern access control mechanisms. The newgrp command with a password is the only way to use them.

The primary group with usermod

The usermod -g command changes a user’s primary group. The group must exist.

sudo usermod -g developers alice

This changes the group in /etc/passwd, not the group’s member list. The user’s primary group is now developers, and new files they create will be owned by that group.

The supplementary groups with usermod

The usermod -aG command appends a group to the user’s supplementary list.

sudo usermod -aG developers alice

The -a flag is essential. Without it, -G replaces the entire supplementary list.

c. Deleting groups and switching context

The groupdel command removes a group. The newgrp command changes the current session’s primary group.

Deleting a group

The groupdel command removes the group from /etc/group and /etc/gshadow.

sudo groupdel developers

The group must not be the primary group of any user. If it is, groupdel refuses with an error. The user’s primary group must be changed first.

sudo usermod -g users alice
sudo groupdel developers

Files owned by the deleted group are not affected. They retain the GID, which now has no name. The ls -l output shows the numeric GID instead of a name.

The newgrp command

The newgrp command changes the primary group of the current shell session. It starts a new shell with the new primary group.

newgrp developers

The user must be a member of the group, or the group must have a password that the user knows. The new shell has the new primary group, and files created in it are owned by that group.

The id command

The id command shows the user’s UID, primary GID, and supplementary groups.

id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),1500(developers),999(docker)

The output shows the primary group first, followed by the supplementary groups. The numeric IDs appear in parentheses alongside the names.

The groups command

The groups command shows the groups a user belongs to.

groups alice
# alice : alice developers docker

The first group is the primary group. The rest are supplementary.

The newgrp caveat

The newgrp command starts a new shell. The current shell’s environment is preserved, but the new shell is a child process. Exiting the new shell returns to the original shell with the original primary group.

newgrp developers
# The prompt changes.
# Files created here are owned by developers.
exit
# Back to the original primary group.

The membership refresh

A user’s group membership is read at login. Adding a user to a group with gpasswd -a or usermod -aG does not change the user’s current session. The user must log out and back in, or use newgrp, for the new membership to take effect.

Complete Example Session

# ============================================
# PART 1: CREATE A GROUP
# ============================================

sudo groupadd developers

# The group is created with the next available GID.

grep developers /etc/group
# developers:x:1500:

# ============================================
# PART 2: CREATE WITH A SPECIFIC GID
# ============================================

sudo groupadd -g 1600 designers

grep designers /etc/group
# designers:x:1600:

# ============================================
# PART 3: ADD A MEMBER
# ============================================

sudo gpasswd -a alice developers

grep developers /etc/group
# developers:x:1500:alice

# ============================================
# PART 4: REMOVE A MEMBER
# ============================================

sudo gpasswd -d alice developers

# ============================================
# PART 5: SET MEMBERS
# ============================================

sudo gpasswd -M alice,bob developers

grep developers /etc/group
# developers:x:1500:alice,bob

# ============================================
# PART 6: CHANGE THE GROUP NAME
# ============================================

sudo groupmod -n devs developers

grep devs /etc/group
# devs:x:1500:alice,bob

# ============================================
# PART 7: CHANGE THE GID
# ============================================

sudo groupmod -g 1700 devs

grep devs /etc/group
# devs:x:1700:alice,bob

# Update files owned by the old GID.
sudo find / -gid 1500 -exec chgrp 1700 {} \; 2>/dev/null

# ============================================
# PART 8: SET A GROUP ADMINISTRATOR
# ============================================

sudo gpasswd -A alice devs

# Alice can now add and remove members from devs.

# ============================================
# PART 9: DELETE A GROUP
# ============================================

sudo groupdel designers

# ============================================
# PART 10: VERIFY AND SWITCH
# ============================================

id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),1700(devs)

groups alice
# alice : alice devs

# Switch the primary group for this shell.
newgrp devs
# Files created now are owned by the devs group.
touch /tmp/test-file
ls -l /tmp/test-file
# -rw-r--r-- 1 alice devs ... /tmp/test-file
exit

The ten parts showed creating a group, setting a specific GID, adding and removing members, setting the member list, renaming the group, changing the GID, setting an administrator, deleting a group, and verifying and switching the primary group.

Quick Reference

groupadd Options

Option	Purpose
`-g GID`	Set specific GID
`-r`	Create system group
`-o`	Allow non-unique GID

groupmod Options

Option	Purpose
`-n NAME`	Change group name
`-g GID`	Change GID

gpasswd Options

Option	Purpose
`-a USER`	Add user to group
`-d USER`	Remove user from group
`-M USERS`	Set member list
`-A USERS`	Set administrators
(no flag)	Set group password

groupdel and newgrp

Command	Purpose
`groupdel NAME`	Delete a group
`newgrp NAME`	Switch primary group for the session

Verification Commands

Command	Output
`id USER`	UID, primary GID, supplementary groups
`groups USER`	All groups
`grep GROUP /etc/group`	Group entry

Important Files

File	Contents
`/etc/group`	Group definitions
`/etc/gshadow`	Group passwords and administrators
`/etc/passwd`	User accounts with primary GID

Best Practices

✅ Do This:

# Create a group with a specific GID.
sudo groupadd -g 1500 developers  # ✅

# Use gpasswd -a to add members.
sudo gpasswd -a alice developers  # ✅

# Use usermod -aG to append a group to a user.
sudo usermod -aG developers alice  # ✅

# Update files after changing a GID.
sudo find / -gid 1500 -exec chgrp 1700 {} \;  # ✅

# Verify with id and groups.
id alice && groups alice  # ✅

# Use newgrp to test membership without logging out.
newgrp developers  # ✅

❌ Don’t Do This:

# Don't delete a group that is a user's primary group.
sudo groupdel developers  # ❌ Fails if a user has it as primary

# Don't use -g on usermod to add a supplementary group.
sudo usermod -g developers alice  # ❌ Changes the primary group

# Don't forget -a when appending groups.
sudo usermod -G developers alice  # ❌ Replaces all supplementary groups

# Don't expect membership changes to apply immediately.
sudo gpasswd -a alice developers  # ❌ Needs re-login or newgrp

# Don't use group passwords unless required.
sudo gpasswd developers  # ❌ Legacy feature, rarely needed

Common Pitfalls

Pitfall	Why It Happens	Fix
Cannot delete group	It is a primary group	Change the user’s primary group first
Members not updated	Session caches group membership	Log out and back in, or use `newgrp`
Files show numeric GID	Group was deleted	Recreate the group with the same GID
GID change not reflected	Files not updated	Run `find` and `chgrp`
Wrong primary group	`usermod -g` used instead of `-aG`	Use `-aG` for supplementary groups
Group not found	Group does not exist	Create with `groupadd`

Real-World Examples

1. Create a Group

sudo groupadd developers

2. Create with Specific GID

sudo groupadd -g 1500 developers

3. Add a Member

sudo gpasswd -a alice developers

4. Remove a Member

sudo gpasswd -d alice developers

5. Set Members

sudo gpasswd -M alice,bob developers

6. Rename a Group

sudo groupmod -n devs developers

7. Change GID

sudo groupmod -g 1700 devs

8. Update Files After GID Change

sudo find / -gid 1500 -exec chgrp 1700 {} \;

9. Delete a Group

sudo groupdel developers

10. Switch Primary Group

newgrp developers

Visual

Primary vs Supplementary Groups

┌────────────────────────────────────────────────────────────┐
│  PRIMARY vs SUPPLEMENTARY GROUPS                           │
│                                                            │
│  Alice's account:                                          │
│  ┌──────────────────────────────────────────────────┐     │
│  │  /etc/passwd                                      │     │
│  │    alice:x:1001:1001:...:/home/alice:/bin/bash    │     │
│  │                 ▲                                 │     │
│  │                 └─ primary GID = 1001              │     │
│  │                                                    │     │
│  │  /etc/group                                       │     │
│  │    alice:x:1001:          ← primary group (UPG)   │     │
│  │    developers:x:1500:alice                        │     │
│  │    docker:x:999:alice                             │     │
│  │                  ▲                                │     │
│  │                  └─ supplementary groups           │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  When Alice creates a file, its group is alice (1001).     │
│  She can access files owned by developers or docker         │
│  because she is a member of those groups.                  │
│                                                            │
└────────────────────────────────────────────────────────────┘

The Group File Format

┌────────────────────────────────────────────────────────────┐
│  /etc/group FORMAT                                         │
│                                                            │
│  developers:x:1500:alice,bob                               │
│  ─────┬─────│  │    ────┬───                               │
│       │     │  │        │                                  │
│       │     │  │        └─ member list                     │
│       │     │  └─ GID                                      │
│       │     └─ password placeholder                        │
│       └─ group name                                        │
│                                                            │
│  /etc/gshadow FORMAT                                       │
│                                                            │
│  developers:!::alice,bob                                   │
│  ─────┬─────│ │  ────┬───                                 │
│       │     │ │      │                                     │
│       │     │ │      └─ members                            │
│       │     │ └─ administrators                            │
│       │     └─ password hash (! = no password)             │
│       └─ group name                                        │
│                                                            │
│  The member list in both files should match.               │
└────────────────────────────────────────────────────────────┘

Adding a Group to a User

┌────────────────────────────────────────────────────────────┐
│  usermod -aG vs usermod -G                                 │
│                                                            │
│  sudo usermod -G developers alice                          │
│  ┌──────────────────────────────────────────────────┐     │
│  │  REPLACES Alice's supplementary groups.           │     │
│  │  Before: [sudo, docker]                           │     │
│  │  After:  [developers]                             │     │
│  │  She is removed from sudo and docker.             │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  sudo usermod -aG developers alice                         │
│  ┌──────────────────────────────────────────────────┐     │
│  │  APPENDS developers to the existing groups.       │     │
│  │  Before: [sudo, docker]                           │     │
│  │  After:  [sudo, docker, developers]               │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The -a flag is essential. Without it, -G is destructive.  │
└────────────────────────────────────────────────────────────┘

newgrp and Session Membership

┌────────────────────────────────────────────────────────────┐
│  newgrp: SWITCHING THE PRIMARY GROUP                       │
│                                                            │
│  Login shell: primary group = alice (1001)                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  $ touch file1                                    │     │
│  │  $ ls -l file1                                    │     │
│  │  -rw-r--r-- 1 alice alice ... file1               │     │
│  └──────────────────────────────────────────────────┘     │
│                        │                                   │
│                        │  newgrp developers               │
│                        v                                   │
│  New shell: primary group = developers (1500)              │
│  ┌──────────────────────────────────────────────────┐     │
│  │  $ touch file2                                    │     │
│  │  $ ls -l file2                                    │     │
│  │  -rw-r--r-- 1 alice developers ... file2          │     │
│  └──────────────────────────────────────────────────┘     │
│                        │                                   │
│                        │  exit                            │
│                        v                                   │
│  Back to original shell: primary group = alice (1001)      │
│                                                            │
│  newgrp affects only the current shell session.            │
└────────────────────────────────────────────────────────────┘

Summary

Item	Value
`groupadd`	Create a new group
`groupmod`	Rename or change GID
`groupdel`	Delete a group
`gpasswd`	Manage members and passwords
`newgrp`	Switch the session’s primary group
`/etc/group`	Group definitions
`/etc/gshadow`	Group passwords and administrators
Primary group	Stored in `/etc/passwd`, one per user
Supplementary groups	Stored in `/etc/group`, many per user
`id`	Show UID, primary GID, supplementary groups

Key takeaways:

A user has exactly one primary group and many supplementary groups. The primary group is stored in /etc/passwd and determines the group ownership of new files. The supplementary groups are stored in /etc/group and grant access to shared resources.
groupadd creates the group; gpasswd -a adds members. The group is created empty, and members are added separately. The usermod -aG command also adds a group to a user, and the -a flag is essential.
The -a flag in usermod -aG prevents destructive replacement. Without it, -G replaces the entire supplementary group list. This is one of the most common mistakes in user and group management.
A group cannot be deleted if it is a user’s primary group. The user’s primary group must be changed first with usermod -g, then the group can be deleted.
Changing a GID requires updating file ownership. The groupmod -g command changes the group’s GID, but files owned by the old GID must be updated with find and chgrp.
Group membership changes require a re-login or newgrp. The session caches the group membership at login. Adding a user to a group does not affect their current session until they log out and back in, or run newgrp.
newgrp changes the primary group for the current shell. It starts a new shell with the new primary group, and files created in that shell are owned by the new group. Exiting the shell returns to the original primary group.
Verify with id and groups. The id command shows the UID, primary GID, and supplementary groups. The groups command shows all groups. Both are quick ways to confirm that a change took effect.

Remember: Groups are the mechanism that lets permissions be granted to many users at once. Every user has one primary group, stored in /etc/passwd, and any number of supplementary groups, stored in /etc/group. The groupadd command creates a group, groupmod renames or changes its GID, and groupdel removes it. The gpasswd command manages members and group administrators. The usermod -aG command appends a group to a user, and the -a flag is essential to avoid replacing the entire supplementary list. Membership changes take effect on the next login, or immediately with newgrp. The result is a system where access to shared resources is controlled by group membership, and where the principle of least privilege can be applied to files and directories through careful group design.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!