topic Re: Is it dangerous to remove some groups? in Operating System - Linux

Is it dangerous to remove some groups?

Nils_9 — Wed, 21 Sep 2005 13:03:25 GMT

Hi there,

when you create a new user on Linux, penguin for example, a group with the same name is created, and the UID is the same as the GID (505 for example).
What happens if this group is deleted? What becomes impossible to do when this group is deleted? Is it dangerous? I ask the question for all the cases, but also in the case of a Samba fileserver.

Re: Is it dangerous to remove some groups?

Ivan Ferreira — Wed, 21 Sep 2005 14:04:58 GMT

You won't be able to delete user's primay group. If you want to delete the group, you need to change the user's primary group with usermod -g.

If you delete the group, you need to modify also the group membership permissions of all files that the group owns, you can use the find command to find out what files are owned by the group, and change the group owner. (find / -group groupname -exec chgrp newgrp {} \; )

You can delete a group, but you need to be sure that the group does not own any files.

Also, that group membership scheme (groupname same as username) is part of a security best practice known as User Private Group. Take a look to UPG.

Re: Is it dangerous to remove some groups?

HGN — Wed, 21 Sep 2005 15:10:36 GMT

Hi

The users primary group should not be deleted. You can either assign the user to a different group and then delete the group.

Rgds

HGN

Re: Is it dangerous to remove some groups?

Rick Garland — Wed, 21 Sep 2005 15:19:46 GMT

When you add users via the Linux way it adds a corresponding group with the user account name. I have had no problems in reassigning the user to another group and then removing the new group that was created.

If you need to add some 500 users, you could get some 500 new groups as well.

Re: Is it dangerous to remove some groups?

Gopi Sekar — Thu, 22 Sep 2005 01:04:08 GMT

You should not delete the primary group of the user, then GID set for files in his home directory will turn in to numeric.

Having GID same as UID is something I believe RedHat's choice of maintaining users. I would suggest to have single group id (eg: users) and when users are created assign this group as their primary group. Necessary options to do this is available as part of useradd command.

Regards,
Gopi

Re: Is it dangerous to remove some groups?

Nils_9 — Thu, 22 Sep 2005 13:56:34 GMT

Thanks a lot for your help.
Has someone an example of a problem caused by the fact that the users of a Linux system (whatever the distro) haven't a group of the same name and same ID?

Re: Is it dangerous to remove some groups?

Ivan Ferreira — Thu, 22 Sep 2005 14:06:34 GMT

When you have more than one user in the same group, (that's what happen if you don't use a private group), then by default, all users in the same group can see the files created by other users, that may be not good.

Example:

UID: user1
GID: users

UID: user2
GID: users

umask 027

user1:

touch my_private_file
ls -la my_private_file

-rw-r----- user1 users my_private_file

See? If you don't modify the umask setting to something like 077, the my_private_file by default can be read by user2.

Re: Is it dangerous to remove some groups?

Andrew Merritt_2 — Fri, 23 Sep 2005 06:58:42 GMT

I don't think it would cause any problems.

Removing the group entry will just remove the name of the group. The passwd entry will still have the numeric group id for that user. The files owned by that group will just be displayed with the numeric value.

If you change the group id in the passwd file for the user, any previously existing files will keep their group id.

The User Private Groups scheme that RedHat implement is just one way of implementing things (it doesn't involve any fundamental changes to the underlying Linux). It means by default that you don't have group access permissions to read another user's file. Normally (e.g. on HP-UX) users are put in the same group so can share access to files, but with UPG they'd both need to be members of a separate group to do this.

Andrew

Re: Is it dangerous to remove some groups?

Nils_9 — Sun, 25 Sep 2005 12:06:00 GMT

Thanks a lot Ivan & Andrew, so I'll do a umask 077 to the homes directories. Does umask stay after a reboot? Just if needed..

Re: Is it dangerous to remove some groups?

Ivan Ferreira — Mon, 26 Sep 2005 07:49:05 GMT

No, the umask command should be configured in the /etc/profile file.