18.3 Create, Delete, and Modify Local Groups and Memberships

18.3 Create, Delete, and Modify Local Groups and Memberships

Quick Answer: Create groups with groupadd, modify with groupmod, delete with groupdel. Manage membership with gpasswd, usermod -aG, or gpasswd -a/-d. Primary group vs supplementary groups differ: primary is the GID in /etc/passwd; supplementary lists appear in /etc/group member fields. Verify with getent group, id user, and groups user.

Why groups dominate multiuser tasks

EX200 group tasks appear alone or combined with users and permissions:

• “Create group developers with GID 30000.”
• “Ensure alice and bob are members of developers.”
• “Change the primary group of alice to developers.”
• “Remove temp from contractors without deleting the user.”
• “Delete empty group oldteam.”

Shared directories (SGID project dirs) depend on correct group existence and membership. Get groups right before chasing mode bits.

Group database

/etc/group format

groupname:x:GID:member1,member2
developers:x:30000:alice,bob

Important: A user’s primary group membership is not always listed in the member field. Primary is the GID in /etc/passwd. Tools like id show both.

getent group developers
getent passwd alice
id alice
groups alice

/etc/gshadow

Stores group passwords and group administrator lists. RHCSA tasks more often use gpasswd membership operations than group password logins. Know that gpasswd updates group-related databases safely.

groupadd: create groups

sudo groupadd developers
sudo groupadd -g 30000 developers
sudo groupadd -r sysproj          # system group (system GID range)
getent group developers

# Idempotent-ish exam pattern when unsure
getent group developers || sudo groupadd -g 30000 developers

If a task specifies GID, use -g. Collisions with existing GIDs fail—choose the required ID and fix conflicts only as tasks allow.

groupmod: rename or renumber

sudo groupmod -n newname oldname
sudo groupmod -g 31000 developers
getent group developers

Changing GID does not rewrite all file group ownerships automatically—files keep old numeric GIDs until chgrp/chown. Prefer correct -g at create time.

groupdel: remove groups

sudo groupdel oldteam

You cannot delete a group that is still the primary group of an existing user. Reassign those users’ primary groups first:

id alice   # if primary is oldteam
sudo usermod -g users alice    # or another allowed primary
sudo groupdel oldteam

Supplementary-only membership is cleared when appropriate; still verify no primary dependency remains.

Membership management tools

usermod (from 18.1, group-focused)

# Primary group
sudo usermod -g developers alice

# Append supplementary
sudo usermod -aG developers alice

# Replace all supplementary (danger)
sudo usermod -G developers,contractors alice

gpasswd (group-centric)

sudo gpasswd -a alice developers     # add member
sudo gpasswd -d alice developers     # remove member
sudo gpasswd -A alice developers     # set group administrators (less common on exam)
sudo gpasswd -M alice,bob developers # set member list exactly
gpasswd developers                   # set group password (rare on EX200)

Exam tip: gpasswd -M replaces the member list like usermod -G replaces supplementary groups—read before you wipe members.

Alternative: groupmems (if available)

Some systems include groupmems for membership edits. Stick to gpasswd and usermod for portable RHCSA muscle memory.

# Optional awareness
type groupmems 2>/dev/null

Primary vs supplementary (deep enough for EX200)

id -un
id -gn          # primary group name
id -Gn          # all group names
id alice

A user can access a file mode 640 owned by root:developers if they are in developers (primary or supplementary) and the group has read—subject to DAC and SELinux.

Session caveat

Group membership changes apply to new sessions. An already-open SSH login may still show old id output until the user logs out and back in (or uses a new login). For grading end state, id user as root and getent group are authoritative on disk even if a leftover session is stale.

id alice
sudo -u alice id
getent group developers

Creating users already in groups (review)

sudo groupadd -g 30000 developers
sudo useradd -m -s /bin/bash -g developers -G wheel,contractors alice
id alice

-g primary, -G supplementary at create time avoids a second membership step—still verify.

Shared project directory pattern (group + perms preview)

Though full permission objectives live elsewhere, group tasks often pair with:

sudo groupadd projecta
sudo useradd -m -s /bin/bash -G projecta dev1
sudo useradd -m -s /bin/bash -G projecta dev2
sudo mkdir -p /srv/projecta
sudo chgrp projecta /srv/projecta
sudo chmod 2770 /srv/projecta      # SGID + group rwx common pattern
ls -ld /srv/projecta
id dev1

Membership without directory group ownership fails collaboration; directory group without membership also fails. Deliver both when the scenario needs shared write access.

Listing and auditing membership

getent group developers
grep developers /etc/group
lid -g developers 2>/dev/null || true    # if libuser tools present
# parse members:
getent group developers | awk -F: '{print $4}'

For each required user:

id dev1 | grep -E 'developers|groups'

Exam workflows

Workflow A — Group with fixed GID

sudo groupadd -g 30000 developers
getent group developers

Workflow B — Add three users to a group without destroying other memberships

for u in alice bob carol; do sudo usermod -aG developers "$u"; done
getent group developers
id alice; id bob; id carol

Or:

sudo gpasswd -a alice developers
sudo gpasswd -a bob developers
sudo gpasswd -a carol developers

Workflow C — Change primary group

sudo groupadd -f staff
sudo usermod -g staff alice
id alice
getent passwd alice

Workflow D — Remove membership only

sudo gpasswd -d alice contractors
id alice
getent group contractors

Workflow E — Rename group and verify

sudo groupmod -n developers eng
getent group developers
getent group eng

Workflow F — Delete group safely

# ensure no user has it as primary
getent passwd | awk -F: -v g=$(getent group oldteam | cut -d: -f3) '$4==g{print $1}'
sudo groupdel oldteam

Common traps

1. Expecting primary group to appear in /etc/group member list always—it may not.
2. usermod -G without -a removing wheel and other supplementary groups.
3. gpasswd -M accidentally wiping members by omitting names.
4. groupdel failing because the group is still some user’s primary group.
5. Creating group after useradd -g failed—order groups first.
6. Wrong GID when task mandates a number.
7. Assuming membership works in an old SSH session without re-login when testing interactively.
8. Hand-editing /etc/group and breaking commas/field counts.
9. Deleting a group while shared files still use that GID—files show numeric GIDs afterward.
10. Forgetting to getent group + id before marking the task done.

Relationship to other sections

• 18.1 Users: primary and supplementary assignment at create/modify time.
• 18.2 Passwords: orthogonal; groups do not replace authentication.
• 18.4 Privileged access: wheel is a group membership problem first.
• Permissions / ACLs / SGID dirs: collaboration design rests on GIDs and members.
• NFS / multiuser services: UIDs/GIDs consistency matters across systems (local chapter focuses on one host).

Section checkpoint

You should create groups with groupadd (including -g), rename/renumber with groupmod, remove with groupdel only when safe, add/remove members with gpasswd and usermod -aG, distinguish primary vs supplementary, avoid destructive -G/-M replacements, and verify with getent group and id. That is the EX200 standard for local groups and memberships on RHEL 10.