New Kubuntu 20.04 user accounts without group memberships

Question

I recently experienced strange problems when creating user accounts on freshly installed Kubuntu 20.04 PCs.

The user account created during installation of the OS works as expected. It is member of various groups:

myself@pc10:~$ groups myself
myself : myself adm cdrom sudo dip plugdev lpadmin lxd sambashare

However each additional user (that is created later using the KDE system settings) isn't member of the same groups (except sudo for administrative accounts):

myself@pc10:~$ groups test
test : test

myself@pc10:~$ groups administrator
administrator : administrator sudo

One of the obvious side effects is, that additional users can not change any printer settings without providing a root password (which does not exist). I guess there will be more side effects I didn't notice yet.

My questions:

1. Is my assumption correct that all users should share the same group memberships after creation?
2. If yes, what are the possible reasons for missing groups?
3. Is there a clean fix? Or at least a workaround? (if possible without manually fixing each user account individually)

Answer 1

However each additional user (that is created later using the KDE system settings) isn't member of the same groups

This is normal and the default for all Ubuntu flavors. By default regular users do not have permissions to make changes to hardware/configuration files and are given write access only to their own home directories. This is by design.

Is my assumption correct that all users should share the same group memberships after creation?

Not according to the principle of least privilege.

Is there a clean fix? Or at least a workaround? (if possible without manually fixing each user account individually)

If you want a user to have permission to make changes to printer configuration you can add them to the lpadmin group with sudo usermod -aG lpadmin USERNAME.

To add multiple users to a group in a single command (from an answer to this question):

for user in USERNAME1 USERNAME2 USERNAME3; do sudo usermod -aG lpadmin "$user"; done

Or to add multiple users to multiple groups:

for user in USERNAME1 USERNAME2 USERNAME3; do sudo usermod -aG GROUP1,GROUP2,GROUP3,GROUP4 "$user"; done

If you want additional group memberships to be the default for new users, edit /etc/adduser.conf and uncomment the line #ADD_EXTRA_GROUPS=1 and also uncomment and change the line starting with #EXTRA_GROUPS= to EXTRA_GROUPS="lpadmin". You can list multiple groups separated by spaces between the quotes.

Answer 2

These days, a new group is created for every new user. The group has the same name as the user and only that one user as member. The first user account is special; it is added to more groups because that one is considered to be the primary user of the machine, so that user gets permissions to use all kinds of hardware or virtual machines etc.; but that is not done (by default) for additional users created after that first one.

Back many years ago there was only one group called users that contained all normal user accounts, so group permissions actually made sense.

I guess (I don't know for sure) that it was considered more secure to keep those user accounts more separate from each other, so those single-user groups were created.

But nothing prevents you from adding all the additional users (those that correspond to a real human, not pseudo user accounts) to a common user group; just create one and add the users to that one.

Since group ID 1000 is probably already taken by the first user, you need to decide if you want to rename that group or if you create a new one with a numeric ID that you can keep constant across several machines.

It is perfectly safe to edit /etc/group manually.

Please notice that the group ID for each entry of /etc/password is that user's primary group; a user can be a member of any number of groups, but any file or directory that user creates will have group membership of that primary group, so if you want those users to be able to simply share files based on group permissions, you might want to give them the same primary group (using the newgrp command is very uncommon, so don't rely on that).

Finally, if those people are using multiple machines, you might want to consider using centralized user management like NIS, but that's a more advanced topic.