Linux CLI 20 🐧 chgrp, chown and passwd commands - KandZ

These three commands manage ownership and passwords — who owns files, what group they belong to, and how user passwords are set up.

Overview

Command	Purpose	Best For
`chgrp`	Change group ownership	Assigning files to teams/groups
`chown`	Change owner (and group)	Transferring file ownership
`passwd`	Manage user passwords	Setting, locking, expiring passwords

The `chgrp` Command

CHange GRouP — changes the group ownership of files and directories.

sudo groupadd testers
sudo chgrp testers 1.txt
sudo chgrp testers data2.txt data3.txt
sudo chgrp -R testers d2
sudo chgrp --reference=a 1.txt

Command	Description
`sudo groupadd testers`	Create a new group called `testers`
`sudo chgrp testers 1.txt`	Change `1.txt`‘s group to `testers`
`sudo chgrp testers data2.txt data3.txt`	Change group for multiple files
`sudo chgrp -R testers d2`	Change group recursively for `d2`
`sudo chgrp --reference=a 1.txt`	Use `a`‘s group for `1.txt`

Why sudo? Only the owner can change a file’s group — and only to a group they belong to. sudo (root) can change any file’s group.

Creating a Group

$ sudo groupadd testers
$ getent group testers
testers:x:1001:
# GID 1001, no members yet

Alternative (some distros):

$ sudo addgroup testers

Add users to the group:

$ sudo usermod -aG testers alice
$ sudo usermod -aG testers bob

$ getent group testers
testers:x:1001:alice,bob

Changing Group on a Single File

$ ls -l 1.txt
-rw-r--r--  1 kronos users  1024 Jan 15 10:30 1.txt
#              │      │
#              │      └── group is "users"
#              └── owner is "kronos"

$ sudo chgrp testers 1.txt
$ ls -l 1.txt
-rw-r--r--  1 kronos testers  1024 Jan 15 10:30 1.txt
#                     │
#                     └── group is now "testers"

Multiple Files at Once

$ sudo chgrp testers data2.txt data3.txt
$ ls -l data*.txt
-rw-r--r--  1 kronos testers  1024 Jan 15 10:30 data2.txt
-rw-r--r--  1 kronos testers  2048 Jan 15 10:30 data3.txt

Recursive (`-R`)

$ ls -lR d2
d2:
-rw-r--r--  1 kronos users  1024 d2/file1.txt
-rw-r--r--  1 kronos users  2048 d2/file2.txt

$ sudo chgrp -R testers d2
$ ls -lR d2
d2:
-rw-r--r--  1 kronos testers  1024 d2/file1.txt
-rw-r--r--  1 kronos testers  2048 d2/file2.txt

Use case: Share a whole project directory with a team.

Using a Reference File (`--reference`)

Copy the group from another file:

$ ls -l a 1.txt
-rw-r--r--  1 kronos testers   500 a
-rw-r--r--  1 kronos users    1024 1.txt

$ sudo chgrp --reference=a 1.txt
$ ls -l a 1.txt
-rw-r--r--  1 kronos testers   500 a
-rw-r--r--  1 kronos testers  1024 1.txt
#                     │
#                     └── same group as "a"

Use case: Match permissions to an existing file quickly.

Common `chgrp` Options

Option	Description
`-R`	Recursive
`-v`	Verbose
`-c`	Report only when changes are made
`-f`	Suppress error messages
`--reference=file`	Use `file`‘s group

The `chown` Command

CHange OWNer — changes the owner (and optionally group) of files and directories.

sudo chown root 1.txt
sudo chown -c root a
sudo chown -R root d3
sudo chown root:root log.txt

Command	Description
`sudo chown root 1.txt`	Change `1.txt`‘s owner to `root`
`sudo chown -c root a`	Change owner and report the change
`sudo chown -R root d3`	Change owner recursively
`sudo chown root:root log.txt`	Change both owner and group

Changing Owner Only

$ ls -l 1.txt
-rw-r--r--  1 kronos users  1024 Jan 15 10:30 1.txt

$ sudo chown root 1.txt
$ ls -l 1.txt
-rw-r--r--  1 root users  1024 Jan 15 10:30 1.txt
#              │
#              └── owner is now "root"

Changing Owner with Feedback (`-c`)

$ sudo chown -c root a
changed ownership of 'a' from kronos to root
$ ls -l a
-rw-r--r--  1 root users  500 Jan 15 10:30 a

Use case: Verify what actually changed.

Recursive Change (`-R`)

$ ls -lR d3
d3:
-rw-r--r--  1 kronos users  file1.txt
-rw-r--r--  1 kronos users  file2.txt

$ sudo chown -R root d3
$ ls -lR d3
d3:
-rw-r--r--  1 root users  file1.txt
-rw-r--r--  1 root users  file2.txt

Changing Both Owner and Group

Use the user:group syntax:

$ sudo chown root:root log.txt
$ ls -l log.txt
-rw-r--r--  1 root root  1024 Jan 15 10:30 log.txt
#              │    │
#              │    └── group is now "root"
#              └── owner is now "root"

Alternatives:

sudo chown root: log.txt         # Owner root, group = root's default
sudo chown :root log.txt         # Only group changes
sudo chown root:developers log.txt

Common `chown` Options

Option	Description
`-R`	Recursive
`-v`	Verbose
`-c`	Report only changes
`-f`	Suppress errors
`-h`	Change symlinks instead of targets
`--reference=file`	Use `file`‘s owner and group

`chown` vs `chgrp`

Aspect	`chown`	`chgrp`
Changes	Owner (and optionally group)	Group only
Syntax	`chown user file`	`chgrp group file`
Both at once	`chown user:group file`	Only group
Requires sudo?	Usually	Usually

When to use which:

chgrp — when you only need to change the group
chown — when you need to change the owner (or both)

The `passwd` Command

Manages user passwords — setting, locking, expiring, and viewing.

cat /etc/passwd
passwd -S kronos

Command	Description
`passwd`	Change your own password
`sudo passwd user`	Change another user’s password
`passwd -S user`	Show password status
`passwd -l user`	Lock the password
`passwd -u user`	Unlock the password
`passwd -d user`	Delete the password (no password needed)
`passwd -e user`	Expire the password (force change)
`passwd -n 5 user`	Minimum days between changes

Viewing Users — `/etc/passwd`

$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
kronos:x:1000:1000:Kronos:/home/kronos:/bin/bash
alice:x:1001:1001:Alice:/home/alice:/bin/bash

Format:

username:x:UID:GID:comment:home:shell

Field	Description
`username`	Login name
`x`	Password placeholder (real hash is in `/etc/shadow`)
`UID`	User ID
`GID`	Primary group ID
`comment`	Full name / description
`home`	Home directory
`shell`	Login shell

Password Status (`-S`)

$ passwd -S kronos
kronos P 01/15/2024 0 99999 7 -1
       │ │          │  │     │  │
       │ │          │  │     │  └── Inactive (-1 = never)
       │ │          │  │     └───── Warning days
       │ │          │  └─────────── Max days
       │ │          └────────────── Min days
       │ └───────────────────────── Last change date
       └─────────────────────────── Status (P=password, L=locked, NP=no password)

Status codes:

Code	Meaning
`P`	Password is set
`L`	Password is locked
`NP`	No password set

Lock a Password (`-l`)

Prevents login by prepending ! to the password hash.

$ sudo passwd -l alice
passwd: password expiry information changed.

$ passwd -S alice
alice L 01/15/2024 0 99999 7 -1
#    │
#    └── L = locked!

$ su - alice
Password:
su: Authentication failure
# ✅ Cannot log in

Use case: Temporarily disable an account without deleting it.

Unlock a Password (`-u`)

Reverses the lock.

$ sudo passwd -u alice
passwd: password expiry information changed.

$ passwd -S alice
alice P 01/15/2024 0 99999 7 -1
#    │
#    └── P = password restored

Delete a Password (`-d`)

Removes the password entirely — the user can log in without a password.

$ sudo passwd -d alice
passwd: password expiry information changed.

$ passwd -S alice
alice NP 01/15/2024 0 99999 7 -1
#    │
#    └── NP = no password!

$ su - alice
# No password prompt!

⚠️ Warning: Extremely insecure — only use for testing or special accounts.

Expire a Password (`-e`)

Forces the user to change their password at next login.

$ sudo passwd -e alice
passwd: password expiry information changed.

# Next time alice logs in:
$ su - alice
Password:
You are required to change your password immediately.
Current password:
New password:
Retype new password:
passwd: password updated successfully

Use case: Enforce password rotation after a security incident.

Password Aging (`-n`, `-x`, `-w`)

Control when passwords expire.

Option	Description
`-n DAYS`	Minimum days between changes
`-x DAYS`	Maximum days before change required
`-w DAYS`	Warning days before expiry
`-i DAYS`	Days after expiry before account is disabled

Example — require change every 90 days:

$ sudo passwd -x 90 alice
$ sudo passwd -n 5 alice   # Can't change for 5 days after
$ sudo passwd -w 7 alice   # Warn 7 days before expiry
$ sudo passwd -i 14 alice  # Disable 14 days after expiry

Verify:

$ passwd -S alice
alice P 01/15/2024 5 90 7 14
#                  │ │  │ │
#                  │ │  │ └── Inactive: 14 days after expiry
#                  │ │  └──── Warning: 7 days before
#                  │ └─────── Max: 90 days
#                  └───────── Min: 5 days

Complete Example Session

# ============================================
# PART 1: CHGRP
# ============================================

# Create a group
$ sudo groupadd testers

# Add users to group
$ sudo usermod -aG testers alice
$ sudo usermod -aG testers bob

# Change group on a file
$ sudo chgrp testers 1.txt
$ ls -l 1.txt
-rw-r--r--  1 kronos testers  1024 Jan 15 10:30 1.txt

# Change group on multiple files
$ sudo chgrp testers data2.txt data3.txt

# Recursive change
$ sudo chgrp -R testers d2

# Use reference file
$ sudo chgrp --reference=a 1.txt
$ ls -l a 1.txt
-rw-r--r--  1 kronos testers  500  a
-rw-r--r--  1 kronos testers  1024 1.txt

# ============================================
# PART 2: CHOWN
# ============================================

# Change owner
$ sudo chown root 1.txt
$ ls -l 1.txt
-rw-r--r--  1 root testers  1024 Jan 15 10:30 1.txt

# Change owner with feedback
$ sudo chown -c root a
changed ownership of 'a' from kronos to root

# Recursive change
$ sudo chown -R root d3

# Change both owner and group
$ sudo chown root:root log.txt
$ ls -l log.txt
-rw-r--r--  1 root root  1024 Jan 15 10:30 log.txt

# ============================================
# PART 3: PASSWD
# ============================================

# Change your own password
$ passwd
Changing password for kronos.
Current password:
New password:
Retype new password:
passwd: password updated successfully

# Change another user's password
$ sudo passwd alice
New password:
Retype new password:
passwd: password updated successfully

# Check password status
$ passwd -S kronos
kronos P 01/15/2024 0 99999 7 -1

# Lock a user's account
$ sudo passwd -l alice
$ passwd -S alice
alice L 01/15/2024 0 99999 7 -1

# Try to log in — fails
$ su - alice
Password:
su: Authentication failure

# Unlock
$ sudo passwd -u alice
$ passwd -S alice
alice P 01/15/2024 0 99999 7 -1

# Force password change
$ sudo passwd -e alice
# Next login forces password change

# ============================================
# PART 4: PRACTICAL SCENARIOS
# ============================================

# Scenario 1: Setup a team project
$ sudo groupadd dev-team
$ sudo usermod -aG dev-team alice
$ sudo usermod -aG dev-team bob
$ sudo mkdir /projects/app
$ sudo chgrp dev-team /projects/app
$ sudo chmod 775 /projects/app
# Now alice and bob can both work in the project

# Scenario 2: Give root ownership of system file
$ sudo chown root:root /etc/myservice.conf
$ sudo chmod 644 /etc/myservice.conf
# Standard for system files

# Scenario 3: Lock a user's account temporarily
$ sudo passwd -l alice
# ...work...
$ sudo passwd -u alice

# Scenario 4: Force password rotation
$ sudo passwd -e bob
# Bob must change password on next login

# Scenario 5: Check who has accounts
$ cut -d: -f1,3 /etc/passwd
root:0
daemon:1
bin:2
...
kronos:1000
alice:1001

# ============================================
# PART 5: TROUBLESHOOTING
# ============================================

# User can't change to a directory
$ ls -ld shared/
drwxr-x---  2 alice dev-team  4096 shared/
# Bob can't access — is he in dev-team?
$ groups bob
bob : bob users
# No! Add him:
$ sudo usermod -aG dev-team bob
# Bob must log out and back in
$ groups bob
bob : bob users dev-team
# ✅ Now he can access

# ============================================
# PART 6: SUMMARY OF COMMANDS
# ============================================

$ cat /etc/passwd       # List all users
$ passwd -S kronos      # Check password status
$ sudo passwd -l user   # Lock account
$ sudo passwd -u user   # Unlock account
$ sudo passwd -d user   # Delete password
$ sudo passwd -e user   # Expire password
$ sudo passwd -n 5 user # Min days between changes
$ sudo chgrp group file # Change group
$ sudo chown user file  # Change owner
$ sudo chown user:group file  # Change both

Quick Reference

`chgrp` Options

Option	Description
`-R`	Recursive
`-v`	Verbose
`-c`	Report changes only
`-f`	Suppress errors
`--reference=file`	Use file’s group

`chown` Options

Option	Description
`-R`	Recursive
`-v`	Verbose
`-c`	Report changes only
`-f`	Suppress errors
`-h`	Affect symlinks, not targets
`--reference=file`	Use file’s owner/group

`passwd` Options

Option	Description
`-S user`	Show password status
`-l user`	Lock password
`-u user`	Unlock password
`-d user`	Delete password
`-e user`	Expire (force change)
`-n DAYS`	Min days between changes
`-x DAYS`	Max days before change
`-w DAYS`	Warning days before expiry
`-i DAYS`	Days before account disabled

`/etc/passwd` Format

username:x:UID:GID:comment:home:shell

Best Practices

✅ Do This:

# Create groups for teams
sudo groupadd developers

# Add users to group
sudo usermod -aG developers alice

# Change group on shared files
sudo chgrp developers /shared/project

# Use recursive for directories
sudo chgrp -R developers /shared/project
sudo chown -R alice:developers /shared/project

# Check password status
passwd -S alice

# Lock unused accounts
sudo passwd -l olduser

# Force password change on suspicious accounts
sudo passwd -e suspicious_user

# Set password aging for security
sudo passwd -x 90 -n 5 -w 7 alice

❌ Don’t Do This:

# Don't change owner without sudo
chown root file.txt      # ❌ Permission denied
sudo chown root file.txt # ✅

# Don't use -d to delete passwords
sudo passwd -d alice     # ❌ Insecure — no password needed
sudo passwd -l alice     # ✅ Lock instead

# Don't forget to check ownership after changes
sudo chown root file
ls -l file               # ✅ Verify

# Don't mix chown and chgrp unnecessarily
sudo chown alice file; sudo chgrp developers file  # ⚠️ Two commands
sudo chown alice:developers file                   # ✅ One command

# Don't leave accounts without passwords
# This is a major security risk

Common Pitfalls

Pitfall	Problem	Solution
Forgot `sudo`	Permission denied	Add sudo
Wrong group syntax	`chgrp user` instead of group	Use group name
`chown user:group` missing colon	Treated as one arg	Use `user:group`
Locked user can’t log in	Expected — that’s the point	Use `-u` to unlock
Password expired unexpectedly	Set by admin	Change when prompted
Recursive on symlinks	Changed target	Use `-h` for symlinks

Real-World Examples

1. Team Project Setup

sudo groupadd webdev
sudo usermod -aG webdev alice
sudo usermod -aG webdev bob

sudo mkdir /var/www/project
sudo chown -R root:webdev /var/www/project
sudo chmod -R 775 /var/www/project

# Now alice and bob can both work on the project
# Their files will have group "webdev"

2. Web Server Files

# Owned by www-data
sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html
sudo chmod 644 /var/www/html/*.html

3. User Account Management

# Create user
sudo useradd -m -s /bin/bash alice
sudo passwd alice

# Set password policy
sudo passwd -x 90 -n 5 -w 7 -i 14 alice

# Lock account (employee leaving)
sudo passwd -l alice

# Delete user (permanently)
sudo userdel -r alice

4. Audit User Accounts

# List all users
cut -d: -f1 /etc/passwd

# Users with UID >= 1000 (regular users)
awk -F: '$3 >= 1000 {print $1, $3}' /etc/passwd

# Check locked accounts
sudo passwd -S -a | grep " L "

5. Fix Permissions After Copy

# Files copied from another user
sudo chown -R alice:alice /home/alice/backup

6. Transfer Ownership

# Employee leaves, transfer their files
sudo chown -R newuser:newgroup /home/olduser/projects

Visual: Ownership Model

┌─────────────────────────────────────────────┐
│              File: report.pdf                │
│                                              │
│  Owner: alice      Group: developers         │
│                                              │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐   │
│  │  alice   │  │developers│  │  others  │   │
│  │   rwx    │  │   r-x    │  │   r--    │   │
│  └──────────┘  └──────────┘  └──────────┘   │
│                                              │
│  chown alice       → changes owner           │
│  chgrp developers  → changes group           │
│  chown alice:devs  → changes both            │
└─────────────────────────────────────────────┘

Summary

Command	Purpose	Example
`chgrp`	Change group	`sudo chgrp testers file`
`chown`	Change owner	`sudo chown root file`
`chown user:group`	Change both	`sudo chown alice:devs file`
`passwd`	Change password	`passwd`
`passwd -S`	Check status	`passwd -S alice`
`passwd -l`	Lock account	`sudo passwd -l alice`
`passwd -u`	Unlock account	`sudo passwd -u alice`
`passwd -e`	Expire password	`sudo passwd -e alice`

Key takeaways:

chgrp changes group ownership — use for team sharing
chown changes owner — and optionally group with user:group
chown -R and chgrp -R apply recursively to directories
/etc/passwd lists all users — fields are username:UID:GID:comment:home:shell
passwd -S shows password status: P (set), L (locked), NP (none)
passwd -l and -u lock/unlock accounts
passwd -e forces password change at next login
Password aging (-n, -x, -w, -i) enforces rotation policies
Most of these commands need sudo (root privileges)

Remember: These three commands are about who and how:

chgrp — “which team does this belong to?”
chown — “who owns this?”
passwd — “how does this user log in?”

Use groups for collaboration (chgrp + chmod 775), chown for transfers when people leave, and passwd -l to lock accounts without deleting them. And always verify your changes with ls -l or passwd -S — a quick look can prevent a big headache!

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

Overview

The chgrp Command

Creating a Group

Changing Group on a Single File

Multiple Files at Once

Recursive (-R)

Using a Reference File (--reference)

Common chgrp Options

The chown Command

Changing Owner Only

Changing Owner with Feedback (-c)

Recursive Change (-R)