groupadd tips — authorized group-provisioning literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may provision groups on the host (lab VM / syllabus box you own or were given access to).
2. Prefer documenting the GID plan first — never create production groups without change control and ticket notes.
3. Record short factual notes; quote short Evidence (group name, GID, members plan — redact personal names).
4. Optional: attach users → useradd-tips (-G) or usermod under syllabus rules.
5. Optional: verify membership → groups-tips / id-tips.
6. Redact group names that encode org units or hostnames if policy requires.
7. Stop at literacy — no exploit / unauthorized group-creation cookbooks.
8. Prefer lab-prefixed names (lab-readers, stu-editors) for disposable drills.

Allowed framing

• Classroom labs creating disposable lab groups on authorized hosts.
• Binding short factual notes as Evidence (GID plan, member list size — not full PII).
• Documenting expected vs observed group ranges for authorized inventory notes.
• Comparing groupadd ↔ useradd / groups / id peer tip pages under one binder.
• Adjusting lab-only groups when the syllabus explicitly authorizes a membership drill.

Scope we will not cover

• No crack/pirate/keygen via groupadd.
• No intentional privilege-escalation PoCs that add foreign users to wheel/sudo without authorization.
• No credential-theft via group metadata against hosts you do not own.
• No bypass cookbooks that plant hidden admin groups without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved lab host you control or may administer.
2. Plan a disposable GID and group name; document it before running groupadd.
3. Create the lab group; quote success (name + GID) as Evidence.
4. Optional: add a lab user via useradd-tips; verify with groups-tips.
5. Stop at literacy — no attack or unauthorized group-creation cookbooks.

Practical notes for authorized labs

• -g sets a specific GID — useful for binder reproducibility across lab clones.
• -r system groups belong in daemon drills; document the system GID range your distro uses.
• /etc/group and /etc/gshadow are sensitive — prefer quoting one lab line, not full dumps.
• Pair with id-tips after membership changes to confirm effective groups.
• Avoid colliding with reserved names (root, sudo, adm) unless the syllabus explicitly drills them on disposable hosts.
• When a wrapper like addgroup exists, quote which binary you actually invoked.

FAQ-aligned refusals (quick)

• Foreign host sudo-group planting → refuse.
• Hidden GID privilege paths → refuse.
• Sharing real org group rosters from production → redact or refuse.

For legal, authorized and educational use only.

FAQ

Sources