Check user and groups in linux

Check if a user is in a group

I have a server running where I use php to run a bash script to verify certain information of a user. For example, I have a webhosting server set up, and in order to be able to add another domain to their account I want to verify if the user is actually a member of the ‘customers’ group. What would be the best way to do this? I have searched google, but all it comes up with is ways to check whether a user or a group exists, so google is not being a big help right now.

16 Answers 16

if id -nG "$USER" | grep -qw "$GROUP"; then echo $USER belongs to $GROUP else echo $USER does not belong to $GROUP fi 

1. id -nG $USER shows the group names a user belongs to.
2. grep -qw $GROUP checks silently if $GROUP as a whole word is present in the input.

grep -qw doesn’t work as expected for group names with — character. systemd-journal for example, matches journal or systemd .

username=ANY_USERNAME if getent group customers | grep -q "\b$\b"; then echo true else echo false fi 

username=ANY_USERNAME if groups $username | grep -q '\bcustomers\b'; then echo true else echo false fi 

This script has a bug in it! If the username is customers but it does not belong to customers group your script will still return true!

We don’t have the same output on our distros. I use archlinux and the same behaviour have been saw on debian likes distro.

Username appears in the groups command output at the output beginning, before a : . This can be avoid by using id -Gn instead. Also, The word boundary \b can be avoid by using -w flag in grep, and the output redirection to /dev/null can be removed by using -q to specify silent check: grep will only return success or failure exit code to the shell this way.

This is flawed. Group/user names can contain — and this character (as far as -b is concerned) does separate words. \bcustomers\b matches non-customers or customers-data .

A slightly more error-proof method to check for group membership using zero char delimited fixed string grep.

if id -nGz "$USER" | grep -qzxF "$GROUP" then echo User \`$USER\' belongs to group \`$GROUP\' else echo User \`$USER\' does not belong to group \`$GROUP\' fi 

if id --name --groups --zero "$USER" | grep --quiet --null-data --line-regexp --fixed-strings "$GROUP" then echo User \`$USER\' belongs to group \`$GROUP\' else echo User \`$USER\' does not belong to group \`$GROUP\' fi 

This one may cause problems if you have two groups with similar names, eg. sales and salessupport . Asking about sales with match both.

@ralphbolton No, the problem you described won’t happen. -x ensures that sales matches only exactly that and not salessupport .

I know this is probably old thread but just in case this also works well:

id -Gn "username"|grep -c "groupname" 

if any number > 0 is returned then user is a member of that group.

You could use groups $username_here | grep -q ‘\busergroup\b’

The exitcode will be 0 if a match was found, 1 if no match was found.

you could use this function as user_in_group userfoo groupbar

Why echo $? ? A shell function returns the exit code from the last executed command automatically. Also, the &>/dev/null can be avoided by using -q in grep.

For all those golf fans out there:

if ingroup video; then echo 'Enjoy the show!' fi 

TL;DR The point is I have taken advantage of the built in globbing in order to find the substring.

Edit: Thanks to @Anthony Geoghegan for the id -Gn tip.

My own answer goes in the opposite direction (portability, verbosity, and readability) but I love the brevity and cleverness of this answer. To avoid worrying about the output of the groups command, you could replace it with the more predictable (and portable) id -Gn . It’s also one character shorter. 🙂

Great answer in terms of real world usage. This check is safe, portable, and efficient, though you might want to use [[ » $(id -Gn — «$2″) » == *» $1 «* ]] to protect against non-usernames in $2 . In terms of golf, it isn’t that great. id -Gnz $2|grep -qxz $1 would be 10 bytes shorter.

And yet there’s space to grow! If you’re using set -u in your shell scripts, this command will fail if you don’t set the (supposedly optional) user parameter. We use POSIX parameter expansion to fix this oversight: [[ » `id -Gn $<2->` » == *» $1 «* ]] .

Using the zero delimiter to split by lines:

id -nGz user | tr '\0' '\n' | grep '^group$' 

This one seems to work with all weird permutations of groups with — in them, groups with similar names etc. To use the GROUP variable like other answers, you can write it like this id -nGz user | tr ‘\0’ ‘\n’ | grep ‘^’$‘$’ and can get rid of the output (to use just the return code, $? ) by using grep -q .

A while ago, I wrote a shell function to check if a user is a member of a group. To maximise portability, I wanted it be POSIX-compatible (while this question is tagged as bash , this function will still work). For performance, I wanted to use builtin shell features as much as possible: the only external command it uses is id , the POSIX-standardised utility for getting data about a user’s identity.

is_in_group() < groupname="$1" # The second argument is optional -- defaults to current user. current_user="$(id -un)" user="$" for group in $(id -Gn "$user") ; do if [ "$group" = "$groupname" ]; then return 0 fi done # If it reaches this point, the user is not in the group. return 1 > 

Example usage to test both positive and negative cases – and ensure it handles a non-existent username gracefully:

g=mail userlist="anthony postfix xxx" for u in $userlist; do if is_in_group "$g" "$u"; then printf "%s is in ‘%s’\n" "$u" "$g" else printf "%s is NOT in ‘%s’\n" "$u" "$g" fi done 

Running the above command prints the following output:

anthony is NOT in ‘mail’ postfix is in ‘mail’ id: ‘xxx’: no such user xxx is NOT in ‘mail’ 

It hasn’t been tested for the case where a group or user has a space or other unusual characters in their name but some research shows that such names are not legal: the POSIX Base Definition for Group Name states that

To be portable across conforming systems, the value is composed of characters from the portable filename character set.

The Portable Filename Character Set is specified as the alphanumeric characters, A-Z, a-z, 0-9 along with the period, underscore, and hyphen-minus characters.

Источник

How to find out what group a given user has?

This appears to be pretty useful as well. It has more verbose output than the ‘groups’ command, so if you need the group id/user id use this!

On Linux/OS X/Unix to display the groups to which you (or the optionally specified user) belong, use:

which is equivalent to groups [user] utility which has been obsoleted on Unix.

On OS X/Unix, the command id -p [user] is suggested for normal interactive.

Explanation on the parameters:

-G , —groups — print all group IDs

-n , —name — print a name instead of a number, for -ugG

-p — Make the output human-readable.

or just study /etc/groups (ok this does probably not work if it uses pam with ldap)

Below is the script which is integrated into ansible and generating dashboard in CSV format.

sh collection.sh #!/bin/bash HOSTNAME=`hostname -s` for i in `cat /etc/passwd| grep -vE "nologin|shutd|hal|sync|root|false"|awk -F':' '' | sed 's/[[:space:]]/,/g'`; do groups $i; done|sed s/\:/\,/g|tr -d ' '|sed -e "s/^/$HOSTNAME,/"> /tmp/"$HOSTNAME"_inventory.txt sudo cat /etc/sudoers| grep -v "^#"|awk ''|grep -v Defaults|sed '/^$/d;s/[[:blank:]]//g'>/tmp/"$HOSTNAME"_sudo.txt paste -d , /tmp/"$HOSTNAME"_inventory.txt /tmp/"$HOSTNAME"_sudo.txt|sed 's/,[[:blank:]]*$//g' >/tmp/"$HOSTNAME"_inventory_users.txt 

My output stored in below text files.

cat /tmp/ANSIBLENODE_sudo.txt cat /tmp/ANSIBLENODE_inventory.txt cat /tmp/ANSIBLENODE_inventory_users.txt 

Источник

How to Know The Groups of a Linux User

This quick tip teaches you how to find the groups a Linux user belongs to in Linux command line.

Groups are the essential part of basic Linux filesystem security by design. If you know about the file permissions in Linux, you already know that groups play a huge role in limiting and allowing access of files to the desired users only.

The idea is to collect users in a group based on their roles. This way, you can easily set permissions for the intended groups of user. For example, users in sudo groups can run commands with superuser privileges while other users cannot.

Now that might make you curious about knowing which groups you belong to and this is exactly what I am going to show you in this quick tutorial.

Check user group in Linux command line

To find out which groups your user account belongs to, simply use this command:

This will show all the groups you belong to.

[email protected]:~$ groups abhishek adm cdrom sudo dip plugdev lpadmin sambashare kvm

As you can see, the user abhishek belongs to groups abhishek, sudo, adm and several other groups.

I am using Ubuntu in this tutorial and Ubuntu creates a group with the same name as the user. This is why you see user abhishek belonging to group abhishek.

Find out groups of other users in Linux

You just learned to see the groups you belong to. What about checking the groups of other users on your system?

You probably already know how to list users in Linux. When you know the username, you can find which group it belongs to by using the groups command in this way:

Obviously, you’ll have to replace the user_name in the above command with the name of the other user.

[email protected]:~$ groups prakash prakash : prakash sudo

You can also check groups of more than one users at a time by

groups user_1 user_2 user_3

The output will display the groups information for each user in separate rows:

[email protected]:~$ groups abhishek prakash abhishek adm cdrom sudo dip plugdev lpadmin sambashare kvm prakash : prakash sudo

Bonus Tip: Get group information along with gid

You can also get group information of a user with id command. The additional benefit of the id command is that it also displays the uid of the user and gid of the groups. Read this article to know more about UID in Linux.

The user name is optional and by default, it will show the information about your user account.

uid=1000(abhishek) gid=1000(abhishek) groups=1000(abhishek),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare),127(kvm)

You can see that getting the group information of a user is a simple task. It could come in handy in many situations and I would let you experience them on your own.

Bonus Tip 2: Get primary group of a user in Linux

Every user has a default or primary group. You can check the primary group of a user with id command in the following fashion:

You can change the primary and secondary group of a user with the usermod command.

I hope this quick little tip helped you to list user groups in Linux. You may also want to read about checking the members of a group in Linux.

If you have questions or suggestions, please feel free to use the comment section.

Источник