Linux Group Management Basics: groupadd, groupmod, and Access Control

2026-05-31 Reading time: About 12 min Difficulty: Intermediate

What You'll Learn

• Core syntax and usage of groupadd, groupmod, and groupdel
• How to add and remove group members safely with usermod -aG and gpasswd
• How to read /etc/group and design access control with groups

What Is groupadd?

groupadd creates a new group on the system. It is the group-management equivalent of useradd for user accounts.

# Basic usage
sudo groupadd developers

# Specify a GID explicitly
sudo groupadd -g 1500 developers

# Create a system group (GID below 1000)
sudo groupadd -r sysgroup

After creation, the group appears in /etc/group. Verify with:

grep developers /etc/group
# → developers:x:1500:

How to Modify a Group with groupmod

groupmod changes a group's name or GID.

# Rename a group
sudo groupmod -n newdevelopers developers

# Change the GID
sudo groupmod -g 1600 developers

find / -gid OLD_GID -exec chgrp NEW_GID {} \;

How to Delete a Group with groupdel

groupdel removes a group from /etc/group.

sudo groupdel developers

If any user has developers as their primary group, the deletion fails. Change that user's primary group first:

# Find users whose primary GID matches developers
awk -F: '$4 == "1500" {print $1}' /etc/passwd

# Change the primary group, then delete
sudo usermod -g othergroup username
sudo groupdel developers

How to Add or Remove Group Members

Adding Members

# usermod -aG (recommended — works with multiple groups)
sudo usermod -aG developers alice

# gpasswd -a (useful when managing groups directly)
sudo gpasswd -a alice developers

The -a flag (append) in usermod -aG is critical. Without it, the command replaces all of the user's supplementary groups:

# Dangerous: strips alice from ALL other groups and sets only 'developers'
sudo usermod -G developers alice   # no -a flag

This mistake silently removes the user from every other group they belong to.

Removing Members

sudo gpasswd -d alice developers

Add to Multiple Groups at Once

sudo usermod -aG developers,ops alice

How to Check Group Memberships

Group changes don't apply to active sessions — a re-login is required.

# Current user's groups
groups

# Another user's groups
groups alice
id alice

# Check /etc/group directly
grep developers /etc/group
# → developers:x:1500:alice,bob

To activate a new group without re-logging in, use newgrp:

newgrp developers

Understanding /etc/group Format

Each line in /etc/group follows this format:

groupname:password:GID:member-list

Example:

developers:x:1500:alice,bob,carol

• groupname: developers
• password: x — shadow passwords are stored in /etc/gshadow; this field is rarely used
• GID: 1500
• member-list: comma-separated usernames. Users who have this as their primary group do not appear in this list.

# List all groups
cat /etc/group

# Sort by GID numerically
sort -t: -k3 -n /etc/group

Designing Access Control with Groups

Groups are the primary mechanism for controlling shared resource access. Here are two practical patterns.

Pattern 1: Shared Directory Access

# Set up /srv/project for the developers group
sudo groupadd developers
sudo mkdir -p /srv/project
sudo chown root:developers /srv/project
sudo chmod 2775 /srv/project   # setgid bit

# Add alice to the group
sudo usermod -aG developers alice

The 2 in chmod 2775 is the setgid bit. New files created inside the directory automatically inherit the developers group, preventing ownership fragmentation when multiple users work together.

Pattern 2: Granting sudo Privileges

On Ubuntu/Debian, add the user to the sudo group:

sudo usermod -aG sudo alice

On CentOS/RHEL/Fedora, use the wheel group:

sudo usermod -aG wheel alice

<section class="article-conclusion" id="article-conclusion">