1

I'm trying to add Apache and a user called admin to the same group on CentOS. When I run id admin I get groups 1000 (apache) and group 1002 (admin), when I run id apache I get groups 1000 (apache) and 1003 (access).

I see that they're both members of the 1000 group (apache), but when I try to add admin to the 1003 (access) group as well via usermod -G access admin, it deletes admin from the apache group for some reason (so then when I run 'id admin' I get groups 1002 and 1003, but it is not listed as part of 1000 anymore).

Is there like a limitation of the number of groups a user can be a member of? If not, how do I put them in the same group?

My problem is due to permissions issues - in a specific folder, which is owned by 'admin', for instance, when I try to create a new directory or upload a file with the admin user I am able to do so. However, when I try to do that using the apache user I can't.

Edit: Output for getfacl:

getfacl: Removing leading '/' from absolute path names
# file: home/admin/domains/xxx/public_html/xxx/xxx
# owner: apache
# group: apache
user::rwx
user:apache:rwx
group::rwx
mask::rwx
other::r-x
default:user::rwx
default:user:apache:rwx
default:group::rwx
default:mask::rwx
default:other::r-x

14th of April edit:

getfacl: Removing leading '/' from absolute path names
# file: home/admin/domains/public_html/xxx/xxx
# owner: apache
# group: apache
user::rwx
user:admin:rwx
group::rwx
mask::rwx
other::r-x
default:user::rwx
default:user:admin:rwx
default:group::rwx
default:mask::rwx
default:other::r-x

2 Answers 2

3

Mar, as I've always answered to your previous question, you needn't add users to any groups to get access to files in specific folder and its subfolders because POSIX ACLs are quite enough to solve such problems.

Use the command below:

setfacl -Rm d:u:apache:rwX,u:apache:rwX /path/to/your/folder

From now on user apache (and admin) can do anything he wants in this folder and it's subfolders but nobody else.

-Rm Recursively modify ACLs

u:apache:rwX Set ACLs for user apache for existing files and (sub)folders of starting folder

d:u:apache:rwX Set ACLs for user apache for newly created files and (sub)folders

You can remove all additional ACLs at any time using

setfacl -Rb /path/to/your/folder
11
  • What filesystems support ACL's? The man page says it "fiddles" with permission bits on unsupported FS's, and then errors if it doesn't "fit" completely
    – Xen2050
    Mar 30, 2016 at 15:59
  • I've tested and been using it for ext4. Mar 30, 2016 at 16:17
  • @OlegBolden Thank you for the help, however after trying this command, I'm still unable to create folders within that specific folder when I am logged in to DirectAdmin with the user admin...?
    – MAR
    Apr 4, 2016 at 11:46
  • Show me the output for getfacl /your_folder Apr 4, 2016 at 12:12
  • 1
    Remove all ACLs with setfacl -Rb /your/folder command and enter this command for admin access setfacl -Rm d:u:admin:rwX,u:admin:rwX /path/to/your/folder Also, you needn't writing attribute for apache group of this folder. Unset it using chmod g-w /your/folder. Apr 4, 2016 at 13:32
4

When I add admin to the access group it deletes admin from the apache group

usermod -G access admin

You are not using usermod correctly.

If the user is currently a member of a group which is not listed, the user will be removed from the group. This behaviour can be changed via the -a option, which appends the user to the current supplementary group list.

Use the following command:

usermod -G access, apache admin

Or:

usermod -a -G access admin

usermod(8) - Linux man page

-G, --groups GROUP1[,GROUP2,...[,GROUPN]]]
           A list of supplementary groups which the user is also a member
           of. Each group is separated from the next by a comma, with no
           intervening whitespace. The groups are subject to the same
           restrictions as the group given with the -g option.

           If the user is currently a member of a group which is not listed,
           the user will be removed from the group. This behaviour can be
           changed via the -a option, which appends the user to the current
           supplementary group list.

Source usermod(8) - Linux man page

2
  • usermod -a -G access admin did the trick. Thanks!
    – MAR
    Mar 30, 2016 at 11:58
  • This is a general comment. When you modify a user's group you have to list all groups you want them to be a member of, otherwise, the command assumes your changing the user's group. Which is the reason the manual page for the command and the syntax of the command illustrates doing exactly that. I realize the answer indicates all of that, just thought it was worth pointing out, its expected behavior.
    – Ramhound
    Mar 30, 2016 at 12:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .