\section{Groups}

\begin{frame}
   {Groups}

   \begin{itemize}
      \item Allowing users to share a work area (directories,
      files etc.)
      \item Setting up file permissions to allow access to
      group members, but not the entire world
      \item Permitting certain specified users to access
      resources they would not be allowed to otherwise
   \end{itemize}

\end{frame}

\cprotect\note{

   \textbf{Linux} systems form collections of users called
   \textbf{groups}, whose members share some common
   purpose.  To further that end, they share certain files
   and directories and maintain some common privileges;
   this separates them from others on the system,
   sometimes collectively called the \textbf{world}.
   Using groups aids collaborative projects enormously.

   Users belong to one or more \textbf{groups}

   Groups are defined in \filelink{/etc/group}, which has
   the same role for groups as \filelink{/etc/passwd} has
   for users. Each line of the file looks like:
   \begin{configlst}[\texttt{/etc/group}]
....
groupname:password:GID:user1,user2,...
....     
   \end{configlst}

   \begin{itemize}
      \item \texttt{groupname} is the name of the group.
      \item \texttt{password} is the password place-holder. Group
      passwords may be set, but only if
      \filelink{/etc/gshadow} exists.
      \item \texttt{GID} is the group identifier. Values between
      0 and 99 are for system groups. Values between 100 and
      \verb?GID_MIN? (as defined in
      \filelink{/etc/login.defs} and usually the same as
      \verb?UID_MIN?) are considered special. Values over
      \verb?GID_MIN? are for \textbf{UPG} (User Private
      Groups).
      \item \texttt{user1,user2},... is a comma-separated list of
      users who are members of the group. The user need not
      be listed here if this group is the user's principal
      group.
   \end{itemize}

}

\section{Group Management}
\begin{frame}
   {Group Management}

   Group accounts may be managed and maintained with:
   \begin{itemize}
      \item \textbf{groupadd}: Add a new group
      \item \textbf{groupmod}: Modify a group and add new
      users
      \item \textbf{groupdel}: Remove a group
      \item \textbf{usermod}: Manage a  user's group memberships
   \end{itemize}

\end{frame}

\cprotect\note{

   These group manipulation utilities modify
   \filelink{/etc/group} and (if it exists)
   \filelink{/etc/gshadow}, and may only be executed by
   root.

   \textbf{Examples:}
   \begin{cmd}
$ sudo groupadd -r -g 215 staff
$ sudo groupmod -g 101 blah
$ sudo groupdel newgroup
$ sudo usermod -G student,group1,group2 student
   \end{cmd}

   Note: Be very careful with the \textbf{usermod -G}
   command; the group list that follows is the complete
   list of groups, not just the changes.  Any supplemental
   groups left out will be gone!  Non-destructive use
   should utilize the \texttt{-a}  option which will
   preserve pre-existing group memberships when adding new
   ones.

}

\section{User Private Groups}
\begin{frame}
   {User Private Groups}

   \begin{itemize}
      \item \textbf{Linux} uses User Private Groups (UPG)
      \item By default users have the primary group id equal
      to their user id,  and their group name the same as
      their username
      \item The \textbf{umask} is set
      to \verb?002? for all users created with UPG (\textbf{umask}
      will be discussed in detail later.)
      \item User files are created with permissions
      \verb?664? and directories \verb?775?
   \end{itemize}

\end{frame}

\cprotect\note{

   \textbf{Linux} uses \textbf{User Private Groups} (UPG).

   The idea behind UPGs is that each user will have his or
   her own group. However, UPGs are \textbf{not
      guaranteed} to be private; additional members may be
   added to someone's private group in
   \filelink{/etc/group}.

   By default, users whose accounts are created with
   \textbf{useradd} have: primary GID = UID and the group
   name is also identical to the user name.

   As specified in \filelink{/etc/profile}, the
   \textbf{umask} is set to \texttt{002} for all users
   created with UPG.  Under this scheme user files are
   thus created with permissions \texttt{664}
   (\texttt{rw-rw-r----}) and directories with \texttt{775}
   (\texttt{rwxrwxr-x}).  (We will discuss \textbf{umask} later.)

}

\section{Group Membership}
\begin{frame}
   {Group Membership}

   A \textbf{Linux} user:
   \begin{itemize}
      \item Has one primary group
      \begin{itemize}
         \item Primary group is the one listed in
         \filelink{/etc/passwd}
         \item Also will be listed in
         \filelink{/etc/group}
      \end{itemize}
      \item May belong to between 0 and 15 secondary groups
      \item Can identify the groups he or she belongs to by
      executing either of
      \begin{cmd}
$ groups [user1 user2 ...]
$ id -Gn [user1 user2 ...]
      \end{cmd}
      \item With no arguments, either command reports on the
      current user.
   \end{itemize}

\end{frame}

\cprotect\note{

   The primary group is the GID that is used whenever the
   user creates files or directories. Membership in
   other, secondary, groups grants the user those
   additional permissions.

   Users can identify which groups they are a member of
   with either the \textbf{groups} or \textbf{id -Gn}
   commands.

   Default groups can differ by distribution and installation specifics.

   On \textbf{CentOS}:
   \begin{cmd}
[student@CentOS ~] groups
   \end{cmd}
   \begin{response}
student
   \end{response}
   On \textbf{Ubuntu}:
   \begin{cmd}
student@ubuntu ~$ groups
   \end{cmd}
   \begin{response}
student adm cdrom sudo dip plugdev lpadmin sambashare libvirt
   \end{response}

}




