I'm wondering if you could change defaults groups for new users without having to specify all of them manually. I'm trying to harden my ArchLinux and there's a group (provided by Grsecurity) that is denying one to use any socket and therefore preventing him to use any backdoor.

I've seen some threads saying to use EXTRA_GROUPS and ADD_EXTRA_GROUP in /etc/default/useradd, and some other saying it's not possible because they are hard-coded in useradd binary. (I think it's really OS dependent)

(The goal is that if somehow someone used arbitrary remote code execution to create a new user he'd not be able to do anything with it because by default he will be in the said group. I know that if he has permission to create a user he has permission to change his groups but i guess it still adds one extra layer of security)

Thanks by advance

  • As a security countermeasure, it's completely worthless: to create a user, you have to be root in the first place. That doesn't make the question bad, it's just useless for this specific purpose. – Gilles Feb 17 '16 at 23:28
  • Oh okay, I thought that you could theoretically with some kind of exploit create a user even though you are not root. Is there a way to do what i wanted though ? It catched my curiosity – Archelio Feb 18 '16 at 9:58
  • (To be precise i thought the said exploit wouldn't get root access and could still get a new user to be created) – Archelio Feb 18 '16 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.