Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am following instructions written by someone else to harden an OS X box. One requirement is to made sure certain system-defined groups have no users in them. For this example I will use _ard, but there are quite a few.

Out of the box, the group _ard has one user in it, also named _ard. So I thought I would use dseditgroup to remove that user from the group:

dseditgroup -o edit -u myadminname -p -d _ard -t user _ard

I'm prompted for my password, and everything seems to work fine. No error message is returned, but user _ard is still in group _ard.

dseditgroup -o checkmember -m _ard _ard
yes _ard is a member of _ard

I have tried many permutations, including using sudo, specifying -n . and spelling out the full paths to the local groups and users.

As a reality check, I put in gibberish names for the group and for the user. In both cases I got back an error message. So the system is recognizing the group and the user, is not returning an error, but is not performing the operation.

Finally I turned to dscl to try to accomplish the same thing, also without success. All the permutations I tried based on searches all over the Interwebs, including many permutations of

sudo dscl localhost -delete /Local/Default/Groups/thegroupname GroupMembership theusername

gave the same result - no error, no result.

So - am I killing myself to follow badly-written instructions and it's not possible to remove that user from that group, or am I missing something else?

Any help is greatly appreciated.

Edit to add: Should have mentioned that the GUI will not allow me to remove the users either.

share|improve this question
    
It may be helpful if you link the instructions you are trying to follow. Also, what version of OS X are you on,and what version are the instructions written for? (there is a surprising amount of change to some of apples proprietary commands between versions) –  demure May 15 '13 at 17:21
    
Unfortunately, I can't. Internal company documents, need-to-know and whatnot. I can say that it is under the heading "List of groups containing no users:" –  Jerry Seeger May 15 '13 at 17:23
    
@demure I'm on Mountain Lion, and it's entirely possible the instructions have not been updated for that OS. The instructions don't say how to remove the users, just that the groups should be empty, so I've been combing the Web for different methods. –  Jerry Seeger May 15 '13 at 17:25
1  
If sudo dscl . -read /Groups/_ard doesn't contain a line starting with 'GroupMembers: ' (like mine), I would be fairly confident saying that '_ard' is just needed to make the '_ard' group exist. –  demure May 15 '13 at 17:42
    
@demure - that would also explain why many of the dscl-based solutions I tried returned <dscl_cmd> DS Error: -14134 (eDSAttributeNotFound). I think you're right, and the requirement is just badly written. –  Jerry Seeger May 15 '13 at 17:46

1 Answer 1

up vote 0 down vote accepted

The _ard group is the primary group for the _ard user. In the GUI (on 10.6, at least), you might notice that the _ard user is italicized (when looking at the members of the _ard group).

You cannot have a username without a primary group; but, you can change the primary group if you really want to. Use the GUI to select the _ard user, and set the primary group to something more amenable to you.

Having said that, I'm sure the document creator had the best intentions in mind; but, I don't see how depopulating the _ard group is helpful at all. (And, ditto for many of the other local _* groups)

share|improve this answer
    
Thanks to both you and @demure. I'm going to march into my audit confident that the real requirement is that no other user is in those groups, and I'll fight anyone who says otherwise. I'm giving you the magic checkmark, but hopefully demure can take some pride in a job well done also. Thanks to both of you. –  Jerry Seeger May 16 '13 at 6:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.