sudo usermod -aG groupname usernameadds a user to a group. The-ais not optional.- Without
-a, usermod replaces every secondary group the user had. That is how people accidentally remove their own sudo access. - A group change does not affect a shell that is already open. Log out and back in, or run
newgrp. - Every user has one primary group (which owns files they create) and any number of secondary groups.
- Check the result with
id username, which shows the primary group and every secondary group in one line.
How do I add a user to a group in Linux?
Use sudo usermod -aG groupname username. The -a means append and the -G sets secondary groups. Together they add the user to one more group while leaving the ones they already had alone. Verify with id username.
# Add alice to the www-data group
sudo usermod -aG www-data alice
# Check it worked
id alice
# uid=1001(alice) gid=1001(alice) groups=1001(alice),33(www-data)
# Add to several groups in one command (comma-separated, no spaces)
sudo usermod -aG www-data,docker,sudo alice-aG www-data, docker is parsed as two arguments and will not do what you meant.Leaving out -a removes every other group
sudo usermod -G docker alice sets alice's secondary groups to exactly docker and silently drops the rest, including sudo. If that was your own account and sudo was the group you removed, you have just locked yourself out of administering the machine. Always type -aG, never -G on its own.
# gpasswd only ever adds, so it cannot wipe anything
sudo gpasswd -a alice www-data
# And to remove
sudo gpasswd -d alice www-data
# On Debian and Ubuntu, adduser does the same and reads more clearly
sudo adduser alice www-datagpasswd -a has no destructive form. If you are typing this on a production machine, it is the one to reach for.Why does the group change seem to have no effect?
Because group membership is read once, at login. Your current shell is still carrying the group list it was given when it started. The change is real, it just has not reached the session you are sitting in. This confuses almost everyone the first time.
# What the system now says (updated immediately)
id alice
# What your current shell believes (still the old list)
groups
# Three ways to pick up the change:
# 1. Log out and back in. Always works.
exit
# 2. Start a shell with the new group active
newgrp www-data
# 3. Re-exec your login shell
exec su - $USERid shows the group but groups does not, the change succeeded and you simply need a new session.Services need restarting too
A running daemon keeps the groups it had when it started, exactly like your shell. If you add the web server user to a group so it can read a directory, restart the service (sudo systemctl restart php8.3-fpm) or the new permission will not apply until the next reboot.
What is the difference between a primary and a secondary group?
Every user has exactly one primary group and any number of secondary groups. The primary group is the one assigned to files the user creates. Secondary groups grant access to things but do not affect ownership of new files. That distinction is the source of a lot of confusion on shared web servers.
| Primary group | Secondary groups | |
|---|---|---|
| How many | Exactly one | Any number, including none |
| Owns new files | Yes | No |
| Stored in | /etc/passwd (the GID field) | /etc/group |
| Set with | usermod -g | usermod -aG |
| Typical use | The user's own private group | Access to www-data, docker, sudo |
The flag is the giveaway: lowercase -g is the primary group, uppercase -G is the secondary list.
# Show current primary group
id -gn alice
# Change it (lowercase g, no -a: a user has only one)
sudo usermod -g developers alice
# Files alice creates from now on are owned by developers
sudo -u alice touch /tmp/testfile && ls -l /tmp/testfilechgrp -R for those.On a shared document root, the setgid bit is usually a better answer than changing anyone's primary group: chmod g+s on the directory makes new files inherit the directory's group regardless of who created them. Linux file permissions for web servers covers the pattern.
How do I create a group and see who is in it?
# Create a group
sudo groupadd developers
# Create one with a specific GID (useful when matching IDs across servers)
sudo groupadd -g 2000 developers
# Every group on the system
getent group
# One group, and its members
getent group www-data
# www-data:x:33:alice,deploy
# Every group a user belongs to
groups alice
id alicegetent group rather than reading /etc/group directly: it also returns groups from LDAP or other directory services.getent group can look empty and still be right
The member list in /etc/group only shows secondary members. A user whose primary group is www-data will not appear there, even though they are in it. id username is the reliable check because it reports both.
# Remove a user from one group
sudo gpasswd -d alice www-data
# Delete a group entirely (fails if it is anyone's primary group)
sudo groupdel developers
# Find files owned by a group before you delete it
sudo find / -group developers -ls 2>/dev/null | headWhich groups matter on a web server?
A handful of groups do nearly all the work on a typical web server. Knowing what each one grants tells you which to add someone to, and more importantly which not to.
| Group | Grants | Add someone when |
|---|---|---|
| sudo (or wheel) | Administrative commands via sudo | They genuinely administer the server |
| www-data (or apache, nginx) | Access to files the web server can reach | They deploy or edit site files |
| docker | Effectively full root, via the container runtime | Almost never: treat it as granting root |
| adm | Read access to files in /var/log | They need to read logs without sudo |
| ssh or sshusers | Permission to log in over SSH, where configured | They need shell access at all |
sudo is called wheel on AlmaLinux, Rocky and RHEL. The docker row is not an exaggeration.
The docker group is root access
Anyone in the docker group can start a container that mounts the host filesystem and read or write anything on it, without sudo and without appearing in the sudo logs. Grant it only to people you would give root to anyway.
# Create the account
sudo adduser --disabled-password --gecos '' bob
# Shared team group for the document root
sudo usermod -aG webdev bob
# Web server group so they can read what the site serves
sudo usermod -aG www-data bob
# Log access without handing over sudo
sudo usermod -aG adm bob
# Confirm, then have them log in fresh
id bob--disabled-password means the account can only be used with an SSH key, which is what you want. Password logins should be off entirely.Adding people to groups is one half of access control; the other half is how the files themselves are owned. Understanding Linux users, groups and file permissions covers the whole model together. If you would rather not manage server accounts at all, our managed WordPress hosting handles the operating system layer for you.
Frequently asked questions
What does the -aG flag mean in usermod?
-a means append and -G specifies secondary groups. Together they add the user to the named group while keeping their existing groups. Using -G without -a replaces the user's entire secondary group list, which is how people accidentally remove their own sudo access.
Why is my user still not in the group after running usermod?
Group membership is read at login, so your current shell still has the old list. Run id username to confirm the system has recorded it, then log out and back in, or run newgrp groupname to start a shell with the new group active.
How do I see all the groups a user belongs to?
id username is the most complete answer: it shows the primary group and every secondary group with both names and numeric IDs. groups username gives just the names. Reading /etc/group directly misses primary group membership.
How do I remove a user from a group?
sudo gpasswd -d username groupname removes one membership and leaves the others alone. Avoid doing it with usermod, which requires you to retype the complete list of groups the user should keep and is easy to get wrong.
What is the difference between usermod, gpasswd and adduser for groups?
All three can add a user to a group. usermod -aG is universal but dangerous if you forget the -a. gpasswd -a only ever adds, so it cannot destroy anything. adduser user group is a Debian and Ubuntu convenience that reads most clearly. On production, prefer gpasswd.
About G7Cloud Engineering
Articles written by the engineers who build and run G7Cloud: UK managed hosting and the AI Website Builder. We write about what we operate every day: containers, backups, databases, and the small-business websites that run on them.
More about G7Cloud →
