LearnLinux › LearnLinux › CMDS

👥 groupadd Command

Create New Groups on Linux Systems

What is groupadd?

The groupadd command creates a new group account on the system. It adds an entry to /etc/group and, when shadowed passwords are in use, to /etc/gshadow. Groups are the foundation of Linux access control — files, directories, and devices grant permissions to groups, allowing multiple users to share access without opening things up to everyone.

This page covers groupadd specifically. For modifying existing groups see groupmod, and for removing groups see groupdel — both covered in groupdel & groupmod.

Syntax: groupadd [OPTIONS] GROUPNAME

Files modified: /etc/group    /etc/gshadow

⚠️ Root Required

All groupadd commands require root privileges. Use sudo groupadd ... or run as root. Group changes take effect immediately — users already logged in may need to log out and back in (or run newgrp) to pick up new group memberships.
Example 1 — Create a Basic Group

The simplest form — create a group with the next available GID:

sudo groupadd developers

Verify it was created:

grep developers /etc/group
developers:x:1002:

What happened:

  • A new group developers was created
  • The system assigned the next available GID (1002 in this example)
  • The x field means the password is in /etc/gshadow
  • The trailing : means no members yet — add with usermod -aG
💡 Reading /etc/group: Format is groupname:password:GID:members
Example 2 — Create a Group with a Specific GID

In environments where GIDs must match across systems (NFS, LDAP sync, shared filesystems), specify the GID explicitly:

sudo groupadd -g 5000 datateam
grep datateam /etc/group
datateam:x:5000:

Flags used:

  • -g 5000 — Set a specific GID
⚠️ GID conflicts: If the GID is already in use, groupadd will fail with an error. Check existing GIDs with getent group | sort -t: -k3 -n before assigning a specific one.
Example 3 — Create a System Group

System groups are used by daemons and services, not human users. They get a GID below the normal user range (typically below 1000):

sudo groupadd -r appservice
grep appservice /etc/group
appservice:x:987:

Flags used:

  • -r — Create a system group (GID from system range)

The system GID range is defined in /etc/login.defs via SYS_GID_MIN and SYS_GID_MAX (typically 201–999 on RHEL, 100–999 on Debian/Ubuntu).

💡 Convention: When creating a service account with useradd -r appuser, also create a matching system group with groupadd -r appuser to keep uid/gid aligned.
Example 4 — Create a Group with a Specific GID, Force if Needed

The -f (force) flag exits successfully even if the group already exists, and forces creation even if the GID is already in use (by choosing the next available GID instead):

# Safe to run in scripts — won't fail if group exists sudo groupadd -f webteam # Force creation with a specific GID; if GID taken, picks next available sudo groupadd -f -g 2500 webteam

Flags used:

  • -f — Force/idempotent behavior; exit 0 if group already exists
  • -g 2500 — Preferred GID (ignored if taken when used with -f)
💡 Scripting: Use -f in provisioning scripts to make group creation idempotent — the script won't fail on re-runs when the group already exists.
Example 5 — Create a Group with a Password

Groups can have passwords, allowing users not in the group to temporarily join via newgrp. This is rare in modern practice but exists in the protocol:

# Create the group sudo groupadd contractors # Set a group password (stored in /etc/gshadow) sudo gpasswd contractors
Changing the password for group contractors New Password: Re-enter new password:

How group passwords work:

  • A user not in the group can run newgrp contractors and supply the password to temporarily switch their primary group
  • Group passwords are stored in /etc/gshadow
  • Group administrators (set via gpasswd -A) can add/remove members without needing root
📝 Modern practice: Group passwords are rarely used today. Most environments manage group membership centrally via LDAP/AD or directly with usermod -aG by admins.
Example 6 — Create Group and Add Users in One Workflow

groupadd only creates the group — it does not add members. Here is the full workflow from creation to populated group:

# Step 1: Create the group sudo groupadd -g 3100 dbadmins # Step 2: Add existing users to the group sudo usermod -aG dbadmins alice sudo usermod -aG dbadmins bob sudo usermod -aG dbadmins craig # Step 3: Verify membership grep dbadmins /etc/group getent group dbadmins
dbadmins:x:3100:alice,bob,craig

Key flags:

  • usermod -aG groupname username — Add user to supplementary group
  • The -a (append) flag is critical — without it, -G replaces ALL supplementary groups, removing the user from everything else
💡 Alternative — gpasswd: sudo gpasswd -a alice dbadmins also adds a user to a group and is slightly more explicit about intent.
Example 7 — Check GID Range Before Creating

Good practice before assigning a specific GID — see what is already in use:

# List all groups sorted by GID getent group | sort -t: -k3 -n # Show only GIDs in a specific range getent group | awk -F: '$3 >= 3000 && $3 <= 4000 {print $1, $3}' | sort -k2 -n # Check if a specific GID is taken getent group | awk -F: '$3 == 3100' # Check system GID range limits grep -E "^SYS_GID|^GID" /etc/login.defs
GID_MIN 1000 GID_MAX 60000 SYS_GID_MIN 201 SYS_GID_MAX 999
💡 getent vs grep: Use getent group instead of cat /etc/group — it pulls from all configured sources including LDAP and NIS, giving you a complete picture of all groups on the system.
Example 8 — Bulk Group Creation from a List

Creating multiple groups efficiently — useful for provisioning new servers or setting up a standardized environment:

# Create several groups in a loop for grp in webteam dbteam netteam secteam; do sudo groupadd "$grp" echo "Created group: $grp (GID: $(getent group $grp | cut -d: -f3))" done
Created group: webteam (GID: 1003) Created group: dbteam (GID: 1004) Created group: netteam (GID: 1005) Created group: secteam (GID: 1006)
# From a file — one group name per line while IFS= read -r grp; do sudo groupadd -f "$grp" && echo "OK: $grp" done < groups.txt
💡 Ansible: For production provisioning at scale, the Ansible group module handles this idempotently: - name: Create group   group: name=webteam gid=3000 state=present

⚙️ groupadd Options Reference

OptionLong FormDescription
-g GID--gid GIDSpecify the numeric GID for the new group
-r--systemCreate a system group (GID from system range)
-f--forceExit successfully if group exists; pick next GID if specified GID taken
-K key=val--key key=valOverride /etc/login.defs defaults (e.g., GID_MIN, GID_MAX)
-o--non-uniqueAllow creating a group with a non-unique GID
-p HASH--password HASHSet encrypted group password (use gpasswd instead)
-R dir--root dirApply changes in a chroot directory

🚀 Quick Reference Card

TaskCommand
Create basic groupsudo groupadd groupname
Create with specific GIDsudo groupadd -g 5000 groupname
Create system groupsudo groupadd -r groupname
Create (safe for scripts)sudo groupadd -f groupname
Verify group createdgetent group groupname
List all groups by GIDgetent group | sort -t: -k3 -n
Add user to groupsudo usermod -aG groupname username
Add user to group (alt)sudo gpasswd -a username groupname
Verify group membersgetent group groupname
See a user's groupsgroups username or id username
Check GID rangegrep GID /etc/login.defs
Modify group (rename/GID)sudo groupmod ...
Delete a groupsudo groupdel groupname

🔗 Related Commands — User & Group Management

groupmod

Modify an existing group (rename, change GID)

groupdel

Delete a group from the system

gpasswd

Administer /etc/group — add/remove members, set password

usermod -aG

Add a user to a supplementary group

useradd

Create new user accounts

newgrp

Switch primary group for current session

getent group

Query group database (local + LDAP/NIS)

id / groups

Show a user's UID, GID, and group memberships