3

I don't understand why newgrp prompts me for password when I want to change my group. I don't even know what password it is asking for but certainly not mine (user clime).

$ id
uid=500(clime) gid=501(www) groups=501(www),500(clime) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
$ newgrp clime
Password: <--- huh?!

My system is centos 6.3.

3
  • what do you mean by "change my group"? Are you trying to log in to a group or are you trying to add your account to another group? – h3rrmiller Feb 27 '13 at 17:30
  • i am trying to log into group clime there – clime Feb 27 '13 at 18:27
  • This question does not seem to be a duplicate of the one it's supposed to be a duplicate of. I have seen this problem occur when people just try to add users to a group by adding them in /etc/group. The users have to be added to a group with the usermod command. – Jack May 19 '17 at 20:45
3

newgrp is a vestigial command from the days when the kernel would only keep track of one group at a time, so if you were a member in more than one, you had to use this command to switch groups. If you are not listed as being a member of the group, the group may be assigned a password that you can enter to switch to it. That is what you are being prompted for.

4
  • but i am a member of the group, see groups in my id output. – clime Feb 27 '13 at 18:26
  • It is still used for those systems that have limited numbers of groups too! – mdpc Feb 27 '13 at 18:28
  • @psusi: but you are otherwise right that I don't need newgrp anymore (at least on my home computer). At work we have still some older systems that needs it. I didn't realize it has changed. – clime Feb 27 '13 at 19:11
  • 3
    newgrp isn't entirely obsolete. It allows you to switch your primary group still. – derobert Feb 27 '13 at 22:02
2

BTW, you might not realize it but there is a passwd field in the /etc/group file. This field is either NULL (i.e. ::) or a STAR (i.e. *) is placed there. I suspect in your case the latter for this group, that a star (i.e. *) is placed in the passwd file. Thus with the group entry having what the system sees as a non-null password entry in the group file the newgrp command will respond as is appropriate.

4
  • There is x instead of * but I guess it can have the same meaning. – clime Feb 27 '13 at 19:21
  • Yes that is the case, basically if the field is non-NULL the newgrp program will request a password. I guess x is another good filler character. – mdpc Feb 27 '13 at 20:10
  • even after removing that x, newgrp still asks for password. I have set the password using gpasswd so at least I can switch now. – clime Feb 27 '13 at 20:26
  • On RedHat-based systems there is a /etc/gshadow. Like /etc/passwd the x just denotes that there is an existing entry in the shadow-file (which in turn contains the hashed password. gconv will create a missing gshadow-entry and create that x. – Nils Feb 27 '13 at 20:34
-4

newgrp (1) alters two files, /etc/passwd and /etc/group. Both need root privileges to modify.

3
  • why doesn't it then require su(do) instead of implicitly authenticating you as root? – amphibient Feb 27 '13 at 18:11
  • 1
    No, newgrp does not alter any files. – psusi Feb 27 '13 at 18:13
  • newgrp alters NO files..... – mdpc Feb 27 '13 at 18:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.