Linux – /etc/passwd shows user in a group, but /etc/group does not

groupslinuxpasswd

I want to verify that the user account filesender_1 is a member of the group valid_senders.

When I look at /etc/group, filesender_1 is not there:

valid_senders:x:12345:production_1

I read this as "production_1 is the only member of the group valid_senders, whose group id is 12345."

However:

When I look at /etc/passwd, the group id for valid_senders is listed for filesender_1 …

filesender_1:x:1515:12345:filesender_1:/local/home/filesender_1:/bin/sh

… so I know valid_senders is the primary group for filesender_1.

Is this a surprising discrepancy, or is it normal for /etc/group to list only members where the group is secondary?

Best Answer

Yes, this discrepancy is normal. I've seen it so many times I stopped looking at the /etc/passwd and /etc/group files and instead started looking at group memberships the way they should be looked at: getent group <groupname> and groups <username>.

Related Solutions

Linux – Temporary changes to /etc/passwd or /etc/group – how-to

to temporarily lock a user's account you can do passwd -l username which simply adds a '!' to the beginning of the password hash in /etc/shadow, preserving the user's password, and preventing them from being able to log in with any password.

Linux – How does LDAP handle supplementary/secondary user groups

LDAP is just a directory of information. How that information gets stored and retrieved is up to the application. In this case, posix users and groups are modeled after the /etc/passwd and /etc/group files. Each user entry lists the gid for its primary group. Each group lists all of its members(usually less the ones listing it as their primary group).

Samba and the various nss plugins to store user and group info in LDAP all do a search to find the groups a user is a member of at log in. The memberUid attribute should be indexed to make group membership searches fast. For a given user account, the search filter is something like:

(&(objectclass=posixGroup)(memberUid=$user))

If you wanted to see the users in a particular group, you could search with:

(&(objectclass=posixGroup)(cn=$group))

This assumes that all of your groups are of the posixGroup objectClass.

Best Answer

Related Solutions

Linux – Temporary changes to /etc/passwd or /etc/group – how-to

Linux – How does LDAP handle supplementary/secondary user groups

Related Topic