Ubuntu – Is There A Security Risk With Users That Are Also Groups

Securityusers

I know a little about users and groups; in the past I might have had a group like 'DBAS' or 'ADMINS' and I'd add individual users to each group…

But I was surprised to learn I could add users to other users – as if they were groups.

For example if my /etc/group contained the following:

user1:x:12501:
user2:x:12502:user1
admin:x:123:user2,jim,bob

Since user2 is a member of the admin group, and user1 is a member of user2 – is user1 effectively an admin? If the admin group is in the sudoers file, can user1 use it as well?

I've tried to simulate this and I haven't been able to do so as user1…but I'm not sure it's impossible.

EDIT: SORRY – updated error in question.

Best Answer

In your example you:

  • Have the user user1 as a part of the group user2.
  • Have the user user2 as a part of the group admin.

The user user1 is distinct from the group user1.

Since (the user) user2 is a member of the admin group, and (the user) user1 is a member of (the group) user2 - is user1 effectively an admin?

  • No, the user user2 is a member of the admin group. Not the group user1.

If the admin group is in the sudoers file, can (the user) user2 use it as well?

  • Yes, just as the other users which are members of the group, jim and bob.

If the admin group is in the sudoers file, can user1 use it as well?

  • No, since the admin group only consists of users. It has the user user2 in it. Even though the user user1 is part of the group user2. They are different things, but share the same name in this and many distros setup. Groups on one side, users on the other. If the names match, they are still entierly different things.

To sum it up: Separate the user from the group. The names may be the same, but they refer to different entities. In GNU/Linux you do not have groups inside groups, a group can only contain users (which is different from say Windows).

Related Question