4

I'm setting up a RH Linux box for teaching. In the past I’ve had two groups, faculty and students. Every student account was assigned to the primary group students, the instructor faculty.

I was reading Nemeth et al. Unix and Linux System Admin (4th ed) and they recommend that each account's primary group should be the same as the user id.

Which is preferable?

  • Set up students accounts with their primary group the same as their user id (i.g., uid == gid) and then add them to a students group?

  • Or should I just add all of the students initially to the students group as I've done in the past?

Are these semantically the same?

Especially in terms of security. I plan to make some sample code/files group readable to all students but obviously want to avoid students peeking easily into each others directories.

5

If you want to make it so students can't access each other's files, you have two options:

  1. Use per-user GID's (UID == GID) and set the default umask to 0750.
  2. Set the default umask to 0700.

The first option is quicker to implement, and much less likely to break things. Keep in mind though that there is no practical way without use of something like SELinux to prevent people from intentionally allowing others to access their files.

4

Many distros will automatically create a primary group along with a new user account. By default, it uses the next available ID, and this usually means that the UID of a new user will be equal to its GID, unless you have previously created a group with an automatic GID assigned to it, or a UID without its own primary group.

Saying UID==GID is thus a misnomer, as on many multi-user machines, the UID might not match the GID of a user.

Usually, all user accounts are also members of a common group, typically users(100), so on systems where each account has its own primary group, you may switch from a paradigm to another on the fly, e.g. by chown -R :users . the files in a folder.

2

It is mainly a matter of personal preference.

I had the same question a few years ago an did some research into the matter.
As far as I have been able to determine there is no real major benefit to either method. Most major Linux distro's these days seem to default to the UID=GID method. Some other Unix systems still prefer the other methodology. It doesn't really seem to matter as long as you use the UMASK appropriately. (750 is standard for GID=UID, 700 is preferred if multiple users share GID.)

There may be some software that assumes one or the other but for each case of software that prefers GID=UID you can find another piece of software that wants it the other way around. And you can always get things to work by some creative use of chown and chgrp.

In some organizations it may be there is a preference for the shared GID, because of the way the shared network resources are setup. (NFS permissions or the way they map Unix permissions on SMB ACL's.)

So I would go with the flow: Use whatever is prescribed in your organization (if there is such a rule) or whatever is default on your distro of choice (to minimize problems with applications that assume a certain system based on the distro used).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.