groupdel tips — authorized group-delete literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run groupdel on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any delete — never remove production groups without change control.
3. Record short factual notes; quote short Evidence (group name, GID — never gshadow secrets).
4. Optional: create path → groupadd-tips.
5. Optional: modify path → groupmod-tips.
6. Optional: account delete → userdel-tips.
7. Prefer disposable lab groups; refuse deleting a user's primary group when the tool blocks it — quote that Evidence.
8. Stop at literacy — no attack or unauthorized privilege-group wipe cookbooks.

Allowed framing

• Classroom labs reviewing groupdel on authorized disposable groups.
• Binding short factual notes as Evidence (name/GID + resulting getent absence — no secrets).
• Documenting expected vs observed group absence for authorized inventory notes.
• Comparing groupdel ↔ groupadd / groupmod / userdel peer tip pages under one binder.
• Testing primary-group refusal messages when the syllabus authorizes that drill.

Scope we will not cover

• No crack/pirate/keygen via groupdel.
• No intentional unauthorized privilege-group wipes against foreign hosts.
• No secret-theft or gshadow dumping against hosts you do not own.
• No cookbooks that delete system/shared groups without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with shadow-utils installed.
2. Create a throwaway group via groupadd-tips before any groupdel drill.
3. With authorization, delete the lab group; quote getent group absence as Evidence.
4. Optional: membership check with groups-tips; account cleanup with userdel-tips.
5. Stop at literacy — no attack or unauthorized group-delete cookbooks.

Practical notes for authorized labs

• groupdel typically refuses when the group is still a primary group — quote the refusal as Evidence when relevant.
• Prefer deleting disposable lab groups; never experiment on shared production GIDs.
• Pair with getent-tips for before/after NSS Evidence.
• Files that retain the old GID may linger — inventory notes should mention ownership follow-up when the syllabus covers it.
• Never commit /etc/group or gshadow dumps to git — even for labs.
• Label lab-only deletes clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host group deletes → refuse.
• Unauthorized system-group wipe cookbooks → refuse.
• Attack/privilege-escalation framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources