How to change user affilations to group in Linux - linux

I have several users say: A,B,C,D, etc. and 2 group: master, slave.
Each user belongs to only one of these groups (exclusively).
How can I programmatically change this belonging?
For example: user A belongs to group "master"
How to remove it from group "master" and add it to group "slave"?

From the man page of usermod:
-G, --groups group,...
With this option a list of supplementary groups can be specified, which the user should become a member of. Each group is separated from the next one only by a comma, without whitespace. The user is removed from all other groups not specified.
-R, --remove-from-group group,...
With this option a list of groups can be specified, from which the user should be removed. Each group is separated from the next one only by a comma, without whitespace.
If for some reason this isn't pre-installed on your system it is a command from the pwdutils package.

Related

ldapsearch for Active Directory search

I have lot of ad groups which start with ad-grp-<something>-something.
I want to run the ldapsearch command to pull the members of the group all I need is the member id, not the full name.
ldapsearch -xLLL -b "DC=myteam,DC=com" -D user#myteam -h my-host.myteam.com
-w Abcd123 "(&(objectClass=group) "(&(memberOf=CN=ad-grp-*,OU=PermissionGroups,OU=Groups,DC=myteam,DC=com))"
With this I get the full name of the member but I am looking to get the member id of that user.
Can you help me?
Or share if there is any other easy way?
You cannot use wildcards on any attributes that have a distinguishedName in the value, like memberOf. So you will have to first search for the groups: (&(objectClass=group)(cn=ad-grp-*))
If you're sure the membership list of each group is less than 1500, then you can use the member attribute from the search. But if some of those groups have more than 1500 members, it gets more complicated to find them all (it only gives you 1500 at a time).
If some of them might be large groups, then you can take the full distinguishedName for each of the groups (from the search results) and construct a new query to find the members of each one. Something like this:
(&(objectCategory=person)(objectClass=user)(|(memberOf=CN=ad-grp-1,OU=PermissionGroups,OU=Groups,DC=myteam,DC=com)(memberOf=CN=ad-grp-2,OU=PermissionGroups,OU=Groups,DC=myteam,DC=com)))
That shows only two groups (ad-grp-1 and ad-grp-2). Add all of them to the query.

Where & How is user group information stored in Ubuntu?

Mirror Question: https://unix.stackexchange.com/questions/217300/where-how-is-user-group-information-stored-in-ubuntu. (I'll remove one of them after I got the answer)
Two places possible: /etc/group and /etc/passwd.
If I use command: adduser [username] [groupname], then the user would be added to the group, and the file /etc/group would then be updated.
However, the file /etc/passwd is not updated. if I check which group I belongs to, via groups command, I can only see groups stated in passwd file.. therefore, the user is not added to the group base on this result.
I'm confused.
What's the meaning of storying group info into /etc/passwd, and /etc/group respectively?
Why adduser only update the group file?
How to add group to the passwd file via command?
Why does groups return group info from passwd file, but not group file?
Thanks.
In these traditional text files (there are other ways, e.g. LDAP), your primary group goes to /etc/passwd (it's e.g. used for permissions of files you create), all additional groups go to /etc/group.
see 1.
That's impossible, but you can change a primary group with usermod -g
That's a misinterpretation, groups shows all groups. But a new group is only picked up when you start a new session (new login). You can use the newgrp command, that starts a session with the given group name as your primary group (you must be member of this group) -- as a side effect, it will consult the user database and update your groups list.

Wondering how I might be able to debug this ACL issue

I'm adding security around some buttons in an app I built long ago. The way I implemented this security feature is that I created a a role in the database's ACL. I do a check in the button's hide-when formula and expose the button if the role is there. That role is assigned to a security group in the Domino Directory. That security group contains a collection of other groups. These 2ndary groups contain people's names. Those names are retrieved from a Postgres database -- I have a LotusScript agent that pulls the names from that database. The problem I'm seeing is that even tho a name is in the 2ndary group, Notes doesn't recognize it. Here's an example. This user are in these groups:
however, he should also be in all of these:
How can I debug where the problem is?
thanks
clem
I think the problem is that for one group in particular, there are 2 copies of the group document. I didn't see that b/c in the main group view it doesn't show up. But when I was in the process of assigning a child group to a parent group, I can see the duplicate listed. I suspect this is the source of the problem. Will confirm.
thanks
clem
Make sure the members of the 2ndary groups contain names in fully qualified format that matches the first entry of their FullName in the person document. EG "John Smith" should be "CN=John Smith/O=LabWare" or something like that.
You can see what groups and roles the system recognizes a user in by double clicking on the security icon on the status bar in the Notes Client (bottom 3rd from the right) after you have opened the database.

Linux command 'getent group' not returning users for some groups?

I am using getent group command to get the groups along with there usernames in linux. But it is not showing any usernames for some groups which i know exist.
i need this info is there any other way around?
Picking up 1st two results :--
root:x:0:
bin:x:1:bin,daemon
as you can see there are no users for group root and 2 users in bin group. I know that the root group contains a user root but its now showing it here.
What you are missing is that each user has a primary group, which is stored in /etc/passwd (usually in field 4), and may have one or more supplementary groups. Only the supplementary group associations are in /etc/group, and as a result, are the only ones that getent group will show. In order to get the entire list of groups for a particular user, you can use id -a <user>, but you'll have to iterate that over the list of users to get your full information dump...
Can you please run:
getent group|diff /etc/group -
and show us the difference in its output,
Since I have run this and I see no difference their both exactly the same
getent will only return the master group name and not the sub groups a user belongs to:
getent group adm
adm:x:4:me,logcheck
To get any instances of adm within getent try:
getent group|grep adm

Linux directory permissions for different groups

I'm having two directories: "public" and "private".
I have three users: "chris", "john", "dan". I have two groups: "pub", "priv" and "god".
The group "god" should have full access to "public" and "private".
The group "pub" should be the only group to have permissions over "public"
The group "priv" should be the only group to have permissions over "private".
As root:
useradd chris
useradd john
useradd dan
usermod -g god chris
usermod -g pub john
usermod -g priv dan
chgrp god public private
chgrp pub public
chgrp priv private
su chris
As "chris":
cd public/
touch test = permission denied
The same for the other users ... under "dan" I have no permissions over the "private" directory, althou "dan" is a member of the "priv" group.
Do you have any idea?
Well, I know this is relatively old, but twalberg is correct: there's actually a relatively easy way to accomplish this with POSIX ACL's. They've existed since the late 90's/early 2000's so I don't know why more people don't use them.
How to do it: Do as you've already done, then simply execute this command:
# setfacl -m g:god:rwx public private
and in one command you get what you're wanting. You'll spend forever trying to figure out how to do it using ONLY traditional unix permissions.
Mikic's advice may still be good (depending on what you're trying to accomplish), and it might be more straight forward to reference as few groups as possible in your permissions (or maybe you want it to be apparent that "chris" isn't a regular user, but an administrative one, again it depends on what you want to construct).
I offered something closer to what you're trying to accomplish, because there may be situations where you're trying to give a secondary user/group access to a directory but you don't want to choose between "chris" not getting access to these two directories and "chris" getting access to all those other files and directories "pub" and "priv" might have access to. With ACL's you don't have to make those choices, which is why they were added and are now a core part of most Unix (and BSD and Linux) platforms.
You said that the group "pub" should be the only group to have permissions over "public". But right before that you said that "god" should also have access. So "pub" can't be the only one that has access. Ditto for "priv".
You also say:
I have two groups: "pub", "priv" and "god".
Well, that's three groups. (Reminds me of that famous quote: "There's three kinds of people in this world; those who can count and those who can't." :-P)
Your base concept seems wrong. The way this works is rather simple. Create two groups, "pub" and "priv". Place all users who need access to the directories accordingly. Users who need access to both directories should belong to both groups.
In this case, "chris" should be put in both the "pub" as well as the "priv" group. "john" should be put in the "pub" group. "dan" should be put in the "priv" group.
What you were trying to do is having the directories be owned by two groups. That's not possible. It's users who can be part of multiple groups, not files or directories. You simply got it backwards :-)
There are two problematic things in your approach. The first one is:
chgrp god public private
chgrp pub public
With second command, you discarded the effect of the first one. Directory public now belongs to pub group, not to god anymore.
The second thing is that you probably didn't give write permissions on directory public to group that owns it (the fact that the user executing the command touch belongs to directory's group doesn't matter).
Try this:
chmod 770 public
and do similar with other directories. However, what you're initially trying to achieve is impossible because the directory can belong to one group only. Nikos elaborated it well in his answer - place user in more groups.
You will need to use a file system that supports ACLs. As mentioned in other answers, the pub and priv group ownership is possible with the basic Linux permissions, but to grant access to the god group, since files/directories can only have a single group tag, will require an ACL. Most of the current file systems should support this functionality - see the manual pages for getfacl and setfacl.

Resources