I have written a script to add chrooted sFTP users.

The useradd command is:

sudo useradd -Ng sftponly -ms /bin/false "$USER"

Did it work?

groups $USER
$USER : sftponly

Yes it did. Great!

Then I take a look at /etc/group and there is no $USER in sftponly. I try logging in and out (shouldn't need to - I am not $USER) and nothing changes. (for $USER == yoko):


Why am I seeing $USER in the correct group when using groups, but not in /etc/group?


You shall not use useradd, but use adduser instead. However, if you insist on using useradd, here is what you should do:

sudo useradd -Ng sftponly -G sftponly -ms /bin/false "$USER"

The -g option only changes the /etc/passwd file, making "sftponly" the primary (login) group ID of the user. The -G option modifies /etc/groups.

  • 1
    Isn't this redundant? I mean, is the user not also treated as member of the login-group set in /etc/passwd, even if he isn't listed in /etc/groups? – soulsource Jul 8 '13 at 19:17
  • 1
    To be frank, good question. I'm not sure, i.e. I'm not sure whether there isn't any program that consults only /etc/group but not /etc/passwd. I think I will ask that on superuser. – January Jul 8 '13 at 19:21
  • Yeah - I understand now why they don't appear in /etc/groups but surely having all the information in one canonical spot makes more sense? – datakid Jul 10 '13 at 6:43

From the useradd manpage:

-g, --gid GROUP
    The group name or number of the user's initial login group.

The user's initial login group is the one at the fourth field in a line of the /etc/passwd file. If you look for "yoko" in /etc/passwd you'll find something like:

yoko:x:<yoko's UID>:1003::<yoko's home>:/bin/false

where 1003 is the GID of sftponly group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.