Mirror Question: https://unix.stackexchange.com/questions/217300/where-how-is-user-group-information-stored-in-ubuntu. (I'll remove one of them after I got the answer)
Two places possible: /etc/group and /etc/passwd.
If I use command: adduser [username] [groupname], then the user would be added to the group, and the file /etc/group would then be updated.
However, the file /etc/passwd is not updated. if I check which group I belongs to, via groups command, I can only see groups stated in passwd file.. therefore, the user is not added to the group base on this result.
I'm confused.
What's the meaning of storying group info into /etc/passwd, and /etc/group respectively?
Why adduser only update the group file?
How to add group to the passwd file via command?
Why does groups return group info from passwd file, but not group file?
Thanks.
In these traditional text files (there are other ways, e.g. LDAP), your primary group goes to /etc/passwd (it's e.g. used for permissions of files you create), all additional groups go to /etc/group.
see 1.
That's impossible, but you can change a primary group with usermod -g
That's a misinterpretation, groups shows all groups. But a new group is only picked up when you start a new session (new login). You can use the newgrp command, that starts a session with the given group name as your primary group (you must be member of this group) -- as a side effect, it will consult the user database and update your groups list.
Related
Before adding any group by using groupadd command. I want to see the group is exists or not. Thats why i want to know is there any command like id command to see group information in Linux?
I am able to see the group information in /etc/group or giving command
$ getent group groupname
But I am finding such easy command like id to see group exists or not.
How can I see the permissions of an user over a file (or directiory) in Linux, I know that with "ls -l" I can see the permissions of my user over files. Is there any way to do this with other users without logging in?
Actually when you do "ls -l" it return something like that :
-rwxrw-r-- 10 user group 252 Jan 13 08:43:10 text
Each columns stand for :
File permissions
Number of links to the file
Owner name
Owner group
File size
Time of last modification
File/directory name
The file permissions part can be divided in four parts :
First character which describe the type of file ("-" is for a regular file)
Then there is three parts of three characters each :
The first is the permissions for the owner of the file
The second is the permissions for all the members of the owner group of the file
The third is the permissions for everyone else
In the example we have :
- The file is a regular one
rwx The owner is "user" and he has the rights to read ("r"), write ("w") and execute ("x") on the file
rw- The group is "group" and every user on that group can read and write on the file but not execute it
r-- Everyone else can just read the file and cannot write on it or execute it
To list all the group an user is member of use the command "groups user" (replace "user" by the name of the user).
The permissions you see on the files when you do ls -l are the permission settings on the file for every user and group on that *nix system. The file permissions settings are universal, and will not change based on which user is logged in to the system. Of course, file permissions of a file or directory can be changed by a user with the correct privileges (and those changes will be universal across every user and group).
The file permission settings set the permissions controls for three types of entities that may or may not access the file. The three entities are the user, the group, and everybody else. The file permission settings you see when you do ls -l are describing the permissions settings for each respective entity.
I'd read through this guide to get a better understanding of how permissions work in a *nix system.
I am using getent group command to get the groups along with there usernames in linux. But it is not showing any usernames for some groups which i know exist.
i need this info is there any other way around?
Picking up 1st two results :--
root:x:0:
bin:x:1:bin,daemon
as you can see there are no users for group root and 2 users in bin group. I know that the root group contains a user root but its now showing it here.
What you are missing is that each user has a primary group, which is stored in /etc/passwd (usually in field 4), and may have one or more supplementary groups. Only the supplementary group associations are in /etc/group, and as a result, are the only ones that getent group will show. In order to get the entire list of groups for a particular user, you can use id -a <user>, but you'll have to iterate that over the list of users to get your full information dump...
Can you please run:
getent group|diff /etc/group -
and show us the difference in its output,
Since I have run this and I see no difference their both exactly the same
getent will only return the master group name and not the sub groups a user belongs to:
getent group adm
adm:x:4:me,logcheck
To get any instances of adm within getent try:
getent group|grep adm
I'm having two directories: "public" and "private".
I have three users: "chris", "john", "dan". I have two groups: "pub", "priv" and "god".
The group "god" should have full access to "public" and "private".
The group "pub" should be the only group to have permissions over "public"
The group "priv" should be the only group to have permissions over "private".
As root:
useradd chris
useradd john
useradd dan
usermod -g god chris
usermod -g pub john
usermod -g priv dan
chgrp god public private
chgrp pub public
chgrp priv private
su chris
As "chris":
cd public/
touch test = permission denied
The same for the other users ... under "dan" I have no permissions over the "private" directory, althou "dan" is a member of the "priv" group.
Do you have any idea?
Well, I know this is relatively old, but twalberg is correct: there's actually a relatively easy way to accomplish this with POSIX ACL's. They've existed since the late 90's/early 2000's so I don't know why more people don't use them.
How to do it: Do as you've already done, then simply execute this command:
# setfacl -m g:god:rwx public private
and in one command you get what you're wanting. You'll spend forever trying to figure out how to do it using ONLY traditional unix permissions.
Mikic's advice may still be good (depending on what you're trying to accomplish), and it might be more straight forward to reference as few groups as possible in your permissions (or maybe you want it to be apparent that "chris" isn't a regular user, but an administrative one, again it depends on what you want to construct).
I offered something closer to what you're trying to accomplish, because there may be situations where you're trying to give a secondary user/group access to a directory but you don't want to choose between "chris" not getting access to these two directories and "chris" getting access to all those other files and directories "pub" and "priv" might have access to. With ACL's you don't have to make those choices, which is why they were added and are now a core part of most Unix (and BSD and Linux) platforms.
You said that the group "pub" should be the only group to have permissions over "public". But right before that you said that "god" should also have access. So "pub" can't be the only one that has access. Ditto for "priv".
You also say:
I have two groups: "pub", "priv" and "god".
Well, that's three groups. (Reminds me of that famous quote: "There's three kinds of people in this world; those who can count and those who can't." :-P)
Your base concept seems wrong. The way this works is rather simple. Create two groups, "pub" and "priv". Place all users who need access to the directories accordingly. Users who need access to both directories should belong to both groups.
In this case, "chris" should be put in both the "pub" as well as the "priv" group. "john" should be put in the "pub" group. "dan" should be put in the "priv" group.
What you were trying to do is having the directories be owned by two groups. That's not possible. It's users who can be part of multiple groups, not files or directories. You simply got it backwards :-)
There are two problematic things in your approach. The first one is:
chgrp god public private
chgrp pub public
With second command, you discarded the effect of the first one. Directory public now belongs to pub group, not to god anymore.
The second thing is that you probably didn't give write permissions on directory public to group that owns it (the fact that the user executing the command touch belongs to directory's group doesn't matter).
Try this:
chmod 770 public
and do similar with other directories. However, what you're initially trying to achieve is impossible because the directory can belong to one group only. Nikos elaborated it well in his answer - place user in more groups.
You will need to use a file system that supports ACLs. As mentioned in other answers, the pub and priv group ownership is possible with the basic Linux permissions, but to grant access to the god group, since files/directories can only have a single group tag, will require an ACL. Most of the current file systems should support this functionality - see the manual pages for getfacl and setfacl.
I have several users say: A,B,C,D, etc. and 2 group: master, slave.
Each user belongs to only one of these groups (exclusively).
How can I programmatically change this belonging?
For example: user A belongs to group "master"
How to remove it from group "master" and add it to group "slave"?
From the man page of usermod:
-G, --groups group,...
With this option a list of supplementary groups can be specified, which the user should become a member of. Each group is separated from the next one only by a comma, without whitespace. The user is removed from all other groups not specified.
-R, --remove-from-group group,...
With this option a list of groups can be specified, from which the user should be removed. Each group is separated from the next one only by a comma, without whitespace.
If for some reason this isn't pre-installed on your system it is a command from the pwdutils package.