1

I recently experienced strange problems when creating user accounts on freshly installed Kubuntu 20.04 PCs.

The user account created during installation of the OS works as expected. It is member of various groups:

myself@pc10:~$ groups myself
myself : myself adm cdrom sudo dip plugdev lpadmin lxd sambashare

However each additional user (that is created later using the KDE system settings) isn't member of the same groups (except sudo for administrative accounts):

myself@pc10:~$ groups test
test : test

myself@pc10:~$ groups administrator
administrator : administrator sudo

One of the obvious side effects is, that additional users can not change any printer settings without providing a root password (which does not exist). I guess there will be more side effects I didn't notice yet.

My questions:

  1. Is my assumption correct that all users should share the same group memberships after creation?
  2. If yes, what are the possible reasons for missing groups?
  3. Is there a clean fix? Or at least a workaround? (if possible without manually fixing each user account individually)

2 Answers 2

3
+50

However each additional user (that is created later using the KDE system settings) isn't member of the same groups

This is normal and the default for all Ubuntu flavors. By default regular users do not have permissions to make changes to hardware/configuration files and are given write access only to their own home directories. This is by design.

Is my assumption correct that all users should share the same group memberships after creation?

Not according to the principle of least privilege.

Is there a clean fix? Or at least a workaround? (if possible without manually fixing each user account individually)

If you want a user to have permission to make changes to printer configuration you can add them to the lpadmin group with sudo usermod -aG lpadmin USERNAME.

To add multiple users to a group in a single command (from an answer to this question):

for user in USERNAME1 USERNAME2 USERNAME3; do sudo usermod -aG lpadmin "$user"; done

Or to add multiple users to multiple groups:

for user in USERNAME1 USERNAME2 USERNAME3; do sudo usermod -aG GROUP1,GROUP2,GROUP3,GROUP4 "$user"; done

If you want additional group memberships to be the default for new users, edit /etc/adduser.conf and uncomment the line #ADD_EXTRA_GROUPS=1 and also uncomment and change the line starting with #EXTRA_GROUPS= to EXTRA_GROUPS="lpadmin". You can list multiple groups separated by spaces between the quotes.

5
  • Well, I am stunned. I guess on a server system this behavior makes sense. But on a desktop system this seems very, very unintuitive. Considering there is no GUI in the KDE system that allows selecting the privileges (aka groups) a new user should have, this feels like a bug, not like a feature. Anyway, it is how it is. Apr 12, 2021 at 9:02
  • So I will go with modifying adduser.conf. Thanks for that advice. I think all user should be in "cdrom plugdev lpadmin". Still there are several groups I am not sure about. E.g. "audio video floppy bluetooth". I guess floppy is outdated. But what do people need audio, video and blueetooth groups for? After all, default users are not part of these groups as well. Apr 12, 2021 at 9:07
  • @Silicomancer Granting privileges is an administrative task, the admin has to decide which user belong to which groups, that's why the system can't make the decision for you. The KDE User Manager looks a bit poor or incomplete due to the fact that it doesn't give you the abilitity to manage groups. File a bug report or feature request.
    – mook765
    Apr 12, 2021 at 11:59
  • @mook765 Well, adding a user is an administrative task as well. So is removing privileges. I don't see a reason why a new user shouldn't have a set of common privileges by default. Any advice regarding my second comment? Apr 12, 2021 at 12:25
  • 1
    @Silicomancer generally speaking, you should not add users to a group unless you know there is a need for it. Try doing different things with a regular user account and see exactly what doesn't work with the defaults. You can find some explanations of the different groups at wiki.ubuntu.com/Security/Privileges. It seems many group's permissions are not particularly well documented. Apr 12, 2021 at 18:40
1

These days, a new group is created for every new user. The group has the same name as the user and only that one user as member. The first user account is special; it is added to more groups because that one is considered to be the primary user of the machine, so that user gets permissions to use all kinds of hardware or virtual machines etc.; but that is not done (by default) for additional users created after that first one.

Back many years ago there was only one group called users that contained all normal user accounts, so group permissions actually made sense.

I guess (I don't know for sure) that it was considered more secure to keep those user accounts more separate from each other, so those single-user groups were created.

But nothing prevents you from adding all the additional users (those that correspond to a real human, not pseudo user accounts) to a common user group; just create one and add the users to that one.

Since group ID 1000 is probably already taken by the first user, you need to decide if you want to rename that group or if you create a new one with a numeric ID that you can keep constant across several machines.

It is perfectly safe to edit /etc/group manually.

Please notice that the group ID for each entry of /etc/password is that user's primary group; a user can be a member of any number of groups, but any file or directory that user creates will have group membership of that primary group, so if you want those users to be able to simply share files based on group permissions, you might want to give them the same primary group (using the newgrp command is very uncommon, so don't rely on that).

Finally, if those people are using multiple machines, you might want to consider using centralized user management like NIS, but that's a more advanced topic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.