Understanding Linux Groups: wheel and sudo Groups Explained for LFCS

Welcome to Part 2 of the LFCS Certification - Phase 1 series! In the previous post, you learned about Linux distributions and set up your learning environment. Now, we're diving into a critical concept for system administration: Linux groups and how they control administrative privileges.

What Are Groups in Linux?

Before diving into wheel and sudo, let's understand the fundamental concept of groups in Linux.

The Basics: Users and Groups

In Linux, every user belongs to at least one group, and usually multiple groups. Think of groups as:

• Collections of users with similar permissions
• Access control mechanisms for files and resources
• Administrative boundaries for system management
• Security containers that define what users can and cannot do

Why Do Groups Matter for LFCS?

Groups are essential for system administration because they:

1. Control sudo access: Only certain groups can run administrative commands
2. Manage file permissions: Groups determine who can read, write, or execute files
3. Organize users: Logical grouping of users with similar roles
4. Simplify administration: Change group permissions instead of individual users
5. Enhance security: Principle of least privilege - users only get necessary access

Types of Groups in Linux

Linux has two types of group memberships for each user:

1. Primary Group

• Every user has exactly ONE primary group
• Created automatically when user is created (usually same name as username)
• Default group for files/directories created by the user
• Specified in /etc/passwd (GID field)
• Cannot be removed (user must always have a primary group)

Example: When user john creates a file, it's owned by user john and group john (his primary group).

2. Supplementary Groups (Secondary Groups)

• Users can belong to multiple supplementary groups
• Provide additional permissions beyond the primary group
• Specified in /etc/group
• Can be added or removed freely
• Common examples: wheel, sudo, docker, developers

Example: User john (primary group: john) is also member of wheel, docker, and developers groups.

Understanding the /etc/group File

Group information is stored in the /etc/group file. Let's examine it:

cat /etc/group

Example output (truncated):

root:x:0:
bin:x:1:
daemon:x:2:
sys:x:3:
adm:x:4:syslog,john
tty:x:5:
disk:x:6:
lp:x:7:
wheel:x:10:john,admin
sudo:x:27:john
cdrom:x:24:john
developers:x:1001:john,sarah,mike
docker:x:998:john,sarah

/etc/group Format Explained

Each line in /etc/group follows this format:

group_name:password:GID:user_list

Example breakdown:

wheel:x:10:john,admin

• Group name: wheel
• Password field: x (group passwords are rarely used)
• GID: 10 (Group ID number)
• Members: john and admin are members of the wheel group

Viewing /etc/group Safely

# View the entire file
cat /etc/group

# View with line numbers
cat -n /etc/group

# Search for specific group
grep "^wheel:" /etc/group

# Show only group names
cut -d: -f1 /etc/group

# Count total groups
wc -l /etc/group

Example output of grep "^wheel:" /etc/group:

wheel:x:10:centos9

Explanation:

• grep searches for lines
• ^wheel: means "lines starting with wheel:"
• ^ is a regex anchor for "start of line"
• This ensures we match the wheel group, not a user named "wheel"

The wheel Group (RedHat Family)

The wheel group is a special administrative group used in RedHat-family distributions (RHEL, CentOS, Fedora, Rocky Linux, AlmaLinux).

What is the wheel Group?

wheel is a Unix tradition (since BSD Unix) representing the "big wheel" or important people who can become superuser.

Key characteristics:

• Purpose: Grant users sudo privileges
• Distributions: RedHat, CentOS, Fedora, Rocky Linux, AlmaLinux
• GID: Typically 10
• Configuration: Controlled by /etc/sudoers
• Default behavior: Members can use sudo to run commands as root

Historical Background

The name "wheel" comes from the phrase "big wheel" - slang for an important person. In early Unix systems (BSD), only users in the wheel group could use su to become root.

Modern Linux uses wheel for sudo access instead of su, but the name and concept remain.

How wheel Group Works

Checking wheel Group on RedHat Systems

1. Check if wheel group exists:

getent group wheel

Output:

wheel:x:10:centos9

Explanation:

• getent retrieves entries from system databases
• group wheel queries the group database for wheel group
• Output shows wheel group exists with GID 10
• User centos9 is a member

2. List all members of wheel group:

grep "^wheel:" /etc/group

Output:

wheel:x:10:centos9,admin

3. Check if current user is in wheel group:

id

Output:

uid=1000(centos9) gid=1000(centos9) groups=1000(centos9),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Explanation of id output:

• uid=1000(centos9) - User ID and username
• gid=1000(centos9) - Primary group ID and name
• groups=1000(centos9),10(wheel) - All groups user belongs to
  • 1000(centos9) is the primary group
  • 10(wheel) is a supplementary group
• context=... - SELinux security context (RedHat feature)

4. Check another user's groups:

id username

Example:

id john

Output:

uid=1001(john) gid=1001(john) groups=1001(john),10(wheel),994(docker)

This shows john is in wheel and docker groups.

The wheel Group in /etc/sudoers

The wheel group's sudo access is configured in /etc/sudoers:

sudo cat /etc/sudoers | grep wheel

Output:

## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL

Explanation:

• %wheel - The % indicates a group (not a user)
• ALL=(ALL) - Can run commands as any user
• ALL (at end) - Can run all commands
• Translation: Any user in the wheel group can run any command as any user using sudo

The sudo Group (Debian Family)

The sudo group serves the same purpose as wheel, but is used in Debian-family distributions (Ubuntu, Debian, Linux Mint).

What is the sudo Group?

Key characteristics:

• Purpose: Grant users sudo privileges (identical purpose to wheel)
• Distributions: Ubuntu, Debian, Linux Mint, Pop!_OS
• GID: Typically 27
• Configuration: Controlled by /etc/sudoers
• Default behavior: Members can use sudo to run commands as root

Why Two Different Groups?

The difference is purely historical:

• BSD Unix tradition → wheel group → adopted by RedHat
• Debian philosophy → created sudo group for clarity
• Functionality: Identical - both grant sudo access
• Modern systems: You'll encounter both depending on distribution

Checking sudo Group on Debian Systems

1. Check if sudo group exists:

getent group sudo

Output (Ubuntu example):

sudo:x:27:ubuntu,john

2. Check current user's groups:

id

Output (Ubuntu example):

uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),27(sudo),30(dip),46(plugdev)

Key difference from RedHat:

• Group 27(sudo) instead of 10(wheel)
• Many more default groups on Ubuntu (adm, dip, plugdev, etc.)

3. View sudo group in /etc/sudoers:

sudo cat /etc/sudoers | grep sudo

Output:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Explanation:

• Similar to wheel configuration
• %sudo grants privileges to sudo group members
• ALL=(ALL:ALL) ALL - run any command as any user:group

Checking Group Membership

Linux provides several commands to check group membership. Let's explore each one:

1. The id Command (Most Comprehensive)

The id command shows user and group information.

Basic usage:

id

Output:

uid=1000(centos9) gid=1000(centos9) groups=1000(centos9),10(wheel)

Explanation:

• uid=1000(centos9) - User ID (UID) and username
  • 1000 is the numeric user ID
  • centos9 is the username
• gid=1000(centos9) - Primary Group ID (GID) and name
  • User's primary group (same as username is common)
• groups=1000(centos9),10(wheel) - All groups
  • First group (1000) is primary
  • Additional groups (10/wheel) are supplementary

Check specific user:

id john

Output:

uid=1001(john) gid=1001(john) groups=1001(john),10(wheel),994(docker),1002(developers)

Check if user is in specific group:

id -nG john | grep -w wheel

Explanation:

• id -nG john - Show only group names (n=names, G=all groups)
• grep -w wheel - Search for exact word "wheel"
• If output shows "wheel", user is in the group

id Command Options:

2. The groups Command (Simple Group List)

Shows groups for a user in simple format.

Current user:

groups

Output:

centos9 wheel

Specific user:

groups john

Output:

john : john wheel docker developers

Explanation:

• First item (john) is the username
• Colon (:) separator
• Remaining items are groups (first one is usually primary group)

3. The getent Command (Database Query)

Queries system databases directly.

Get group information:

getent group wheel

Output:

wheel:x:10:centos9,john

Check all groups:

getent group

This shows all groups in /etc/group format.

Check if user exists:

getent passwd john

Output:

john:x:1001:1001:John Doe:/home/john:/bin/bash

4. Checking /etc/group Directly

grep wheel /etc/group

Output:

wheel:x:10:centos9,john

Or:

cat /etc/group | grep wheel

Adding Users to Groups

Now let's learn how to actually add users to groups like wheel or sudo.

Using usermod Command (Recommended)

The usermod command modifies user accounts.

Add user to wheel group (RedHat):

sudo usermod -aG wheel john

Explanation of each part:

• sudo - Run with elevated privileges (required for user modification)
• usermod - User modify command
• -a - Append - add to group without removing from other groups
• -G - Supplementary Groups - specify supplementary groups to add to
• wheel - The group name
• john - The username

⚠️ CRITICAL: Always use -a with -G!

# CORRECT - Appends to groups
sudo usermod -aG wheel john

# WRONG - Removes from all other supplementary groups!
sudo usermod -G wheel john

Without -a, the user is removed from ALL other supplementary groups and only added to the specified one!

Add user to sudo group (Ubuntu):

sudo usermod -aG sudo john

Add user to multiple groups at once:

sudo usermod -aG wheel,docker,developers john

Explanation:

• Groups are comma-separated
• No spaces between group names
• john will be added to all three groups

Using gpasswd Command (Alternative)

Another way to add users to groups:

sudo gpasswd -a john wheel

Explanation:

• gpasswd - Group password administration tool
• -a - Add user to group
• john - Username to add
• wheel - Group name

Remove user from group:

sudo gpasswd -d john wheel

Explanation:

• -d - Delete user from group

Verifying Group Addition

After adding a user to a group, verify:

id john

Output:

uid=1001(john) gid=1001(john) groups=1001(john),10(wheel)

Now john is in the wheel group!

Important: Group Changes Require Logout

CRITICAL CONCEPT: Group membership changes don't take effect for currently logged-in sessions!

# Add john to wheel group
sudo usermod -aG wheel john

# John checks his groups
id
# Still shows old groups! Must logout and login again

Why? Group memberships are assigned at login time. Current sessions retain old group information.

To apply changes:

1. Logout and login again (most reliable)
2. Or use: su - john (start new login shell)
3. Or use: newgrp wheel (change current session's primary group temporarily)

Real-World Scenarios

Let's work through common system administration scenarios involving groups.

Scenario 1: Creating a New Administrative User (RedHat)

Task: Create a new user sarah who can perform administrative tasks on CentOS Stream 9.

Steps:

# 1. Create the user account
sudo useradd -m -s /bin/bash sarah

# Explanation:
# useradd - create new user
# -m - create home directory
# -s /bin/bash - set default shell to bash
# sarah - username

# 2. Set password for sarah
sudo passwd sarah

# You'll be prompted to enter password twice

# 3. Add sarah to wheel group for sudo access
sudo usermod -aG wheel sarah

# 4. Verify sarah has wheel group membership
id sarah

# Output should show:
# uid=1002(sarah) gid=1002(sarah) groups=1002(sarah),10(wheel)

# 5. Test sudo access (login as sarah)
su - sarah
# Enter sarah's password

# Try a sudo command
sudo whoami

# Should output: root
# This confirms sarah can use sudo!

Scenario 2: Creating a New Administrative User (Ubuntu)

Task: Create user mike with sudo privileges on Ubuntu.

# 1. Create user
sudo useradd -m -s /bin/bash mike

# 2. Set password
sudo passwd mike

# 3. Add to sudo group (not wheel on Ubuntu!)
sudo usermod -aG sudo mike

# 4. Verify
id mike

# Output shows:
# groups=1003(mike),27(sudo)

# 5. Test
su - mike
sudo whoami
# Should output: root

Scenario 3: Removing Administrative Privileges

Task: Remove sudo access from user john on RedHat system.

# Remove john from wheel group
sudo gpasswd -d john wheel

# Verify removal
getent group wheel
# john should not appear in member list

# Or check john's groups
id john
# wheel group (10) should not appear

# john must logout and login for change to take effect

Scenario 4: Multiple Groups for Developer

Task: Create developer user with multiple group memberships.

# 1. Create user
sudo useradd -m -s /bin/bash developer1

# 2. Set password
sudo passwd developer1

# 3. Create development groups (if they don't exist)
sudo groupadd developers
sudo groupadd testers
sudo groupadd docker-users

# 4. Add user to multiple groups
sudo usermod -aG developers,testers,docker-users,wheel developer1

# 5. Verify
id developer1

# Output:
# groups=1004(developer1),10(wheel),1001(developers),1002(testers),1003(docker-users)

Scenario 5: Checking Who Has Sudo Access

Task: List all users who have sudo privileges on the system.

On RedHat (check wheel group):

getent group wheel

Output:

wheel:x:10:centos9,john,sarah

On Ubuntu (check sudo group):

getent group sudo

Output:

sudo:x:27:ubuntu,mike

More detailed script:

# Check all members of wheel group
echo "Users in wheel group:"
getent group wheel | cut -d: -f4 | tr ',' '\n'

# Output:
# Users in wheel group:
# centos9
# john
# sarah

🧪 Practice Labs

Time to practice! Complete these labs to master group management.

Lab 1: Understanding Group Membership (Beginner)

1. Check your current user's groups:

   id
   groups
   

   Copy

2. Check if wheel or sudo group exists on your system:

   getent group wheel
   getent group sudo
   

   Copy

3. View the /etc/group file:

   cat /etc/group
   tail -20 /etc/group
   

   Copy

4. Count how many groups exist on your system:

   wc -l /etc/group
   

   Copy

5. List only group names (first field):

   cut -d: -f1 /etc/group
   

   Copy

6. Find your primary group:

   id -gn
   

   Copy

7. List all your supplementary groups:

   id -Gn
   

   Copy

Lab 2: Checking Specific Groups (Beginner)

1. Search for wheel group in /etc/group:

   grep "^wheel:" /etc/group
   

   Copy

2. Check if your user is in wheel group:

   id | grep wheel
   

   Copy

3. List all system groups (GID < 1000):

   awk -F: '$3 < 1000 {print $1":"$3}' /etc/group
   

   Copy

4. List all regular groups (GID >= 1000):

   awk -F: '$3 >= 1000 {print $1":"$3}' /etc/group
   

   Copy

5. Find which users are in wheel group:

   getent group wheel | cut -d: -f4
   

   Copy

Lab 3: Creating Test User and Groups (Intermediate)

1. Create a new user named testuser1:

   sudo useradd -m -s /bin/bash testuser1
   sudo passwd testuser1
   

   Copy

2. Check testuser1's groups:

   id testuser1
   

   Copy

3. Create a new group called testers:

   sudo groupadd testers
   

   Copy

4. Verify the group was created:

   getent group testers
   

   Copy

5. Find the GID of testers group:

   getent group testers | cut -d: -f3
   

   Copy

Lab 4: Adding Users to Groups (Intermediate)

1. Add testuser1 to testers group:

   sudo usermod -aG testers testuser1
   

   Copy

2. Verify the addition:

   id testuser1
   getent group testers
   

   Copy

3. Add testuser1 to wheel group (RedHat) or sudo group (Ubuntu):

   # RedHat/CentOS
   sudo usermod -aG wheel testuser1
   
   # Ubuntu/Debian
   sudo usermod -aG sudo testuser1
   

   Copy

4. Verify testuser1 now has sudo access:

   id testuser1
   

   Copy

5. Create another group and add testuser1:

   sudo groupadd developers
   sudo usermod -aG developers testuser1
   id testuser1
   

   Copy

Lab 5: Multiple Group Operations (Intermediate)

1. Create three test users:

   for user in testuser2 testuser3 testuser4; do
     sudo useradd -m -s /bin/bash $user
     echo "Created: $user"
   done
   

   Copy

2. Create two groups:

   sudo groupadd frontend-devs
   sudo groupadd backend-devs
   

   Copy

3. Add testuser2 and testuser3 to frontend-devs:

   sudo usermod -aG frontend-devs testuser2
   sudo usermod -aG frontend-devs testuser3
   

   Copy

4. Add testuser3 and testuser4 to backend-devs:

   sudo usermod -aG backend-devs testuser3
   sudo usermod -aG backend-devs testuser4
   

   Copy

5. Verify group memberships:

   getent group frontend-devs
   getent group backend-devs
   id testuser3  # Should be in both groups
   

   Copy

Lab 6: Using gpasswd (Intermediate)

1. Use gpasswd to add testuser1 to docker group (create if needed):

   sudo groupadd docker  # If doesn't exist
   sudo gpasswd -a testuser1 docker
   

   Copy

2. Verify with getent:

   getent group docker
   

   Copy

3. Remove testuser1 from testers group:

   sudo gpasswd -d testuser1 testers
   

   Copy

4. Verify removal:

   getent group testers
   id testuser1
   

   Copy

Lab 7: Testing Sudo Access (Intermediate)

1. Switch to testuser1:

   su - testuser1
   # Enter testuser1's password
   

   Copy

2. Try accessing /root without sudo:

   ls /root
   # Should get: Permission denied
   

   Copy

3. Try with sudo (if testuser1 is in wheel/sudo group):

   sudo ls /root
   # Enter testuser1's password
   # Should work!
   

   Copy

4. Try running an admin command:

   sudo dnf list installed | head
   # or on Ubuntu:
   sudo apt list --installed | head
   

   Copy

5. Exit back to your main user:

   exit
   

   Copy

Lab 8: Group Change Without Logout (Advanced)

1. Add current user to a new group:

   sudo groupadd tempgroup
   sudo usermod -aG tempgroup $USER
   

   Copy

2. Check groups without logout:

   id
   # tempgroup won't appear yet
   

   Copy

3. Use newgrp to activate the group:

   newgrp tempgroup
   id
   # Now tempgroup appears!
   

   Copy

4. Exit the newgrp shell:

   exit
   

   Copy

5. Or start a new login shell:

   su - $USER
   id
   # tempgroup should now appear
   exit
   

   Copy

Lab 9: Comprehensive User Setup Script (Advanced)

Create a script to set up a new administrative user:

#!/bin/bash
# setup-admin-user.sh

# Check if running as root
if [ "$EUID" -ne 0 ]; then
  echo "Please run as root or with sudo"
  exit 1
fi

# Get username from argument
if [ -z "$1" ]; then
  echo "Usage: $0 <username>"
  exit 1
fi

USERNAME=$1

# Create user
echo "Creating user: $USERNAME"
useradd -m -s /bin/bash $USERNAME

# Set password
echo "Set password for $USERNAME:"
passwd $USERNAME

# Add to admin group (detect distribution)
if [ -f /etc/redhat-release ]; then
  # RedHat family
  usermod -aG wheel $USERNAME
  echo "Added $USERNAME to wheel group"
elif [ -f /etc/debian_version ]; then
  # Debian family
  usermod -aG sudo $USERNAME
  echo "Added $USERNAME to sudo group"
fi

# Show result
echo "User created successfully!"
id $USERNAME

Save and use:

chmod +x setup-admin-user.sh
sudo ./setup-admin-user.sh newadmin

Lab 10: Finding All Admin Users (Advanced)

Create a script to find all users with sudo access:

#!/bin/bash
# find-admin-users.sh

echo "=== Users with Administrative Access ==="
echo

# Check RedHat-style (wheel group)
if getent group wheel > /dev/null 2>&1; then
  echo "Wheel group members:"
  getent group wheel | cut -d: -f4 | tr ',' '\n' | sed 's/^/  - /'
  echo
fi

# Check Debian-style (sudo group)
if getent group sudo > /dev/null 2>&1; then
  echo "Sudo group members:"
  getent group sudo | cut -d: -f4 | tr ',' '\n' | sed 's/^/  - /'
  echo
fi

# Check root user
echo "Root user: $(getent passwd root | cut -d: -f1)"

Run it:

chmod +x find-admin-users.sh
./find-admin-users.sh

Lab 11-15: Challenge Tasks (Real-World)

Lab 11: Department Groups

Create a company structure:

1. Create groups: hr, engineering, sales
2. Create 2 users per department
3. Add users to appropriate groups
4. Create shared directories for each department
5. Verify only department members can access their directory

Lab 12: Group Audit

1. List all groups with their GIDs
2. Find groups with no members
3. Find users belonging to more than 5 groups
4. Document which users have admin access

Lab 13: Group Migration

1. Create user on RedHat system with wheel access
2. Export user info
3. Create equivalent user on Ubuntu system with sudo access
4. Verify both have same privileges

Lab 14: Privilege Removal

1. Identify a test user with admin privileges
2. Remove from wheel/sudo group
3. Verify they can no longer use sudo
4. Add back to admin group
5. Verify sudo works again

Lab 15: Group Hierarchy

1. Create nested group structure (admin, senior-admin, super-admin)
2. Document which group should have which privileges
3. Assign test users to different levels
4. Test privilege escalation

Lab 16-20: Advanced Scenarios

Lab 16: Write script to bulk add users from a CSV file to specific groups

Lab 17: Create automated weekly report of group memberships

Lab 18: Implement temporary admin access (add to wheel, set reminder to remove after 24 hours)

Lab 19: Audit script that checks for users with admin access who shouldn't have it

Lab 20: Create group-based access control for application deployment

📚 Best Practices

🚨 Common Pitfalls to Avoid

📝 Command Cheat Sheet

Checking Groups

# View all groups
cat /etc/group

# Check current user's groups
id
groups

# Check specific user's groups
id username
groups username

# Check if group exists
getent group groupname

# List all group names
cut -d: -f1 /etc/group

# Check if user is in specific group
id -nG username | grep -w groupname

Group Information Commands

# Show only user ID
id -u

# Show only username
id -un

# Show only primary group ID
id -g

# Show only primary group name
id -gn

# Show all group IDs
id -G

# Show all group names
id -Gn

Adding Users to Groups

# Add user to one group (append mode)
sudo usermod -aG groupname username

# Add user to multiple groups
sudo usermod -aG group1,group2,group3 username

# Add user to group with gpasswd
sudo gpasswd -a username groupname

Removing Users from Groups

# Remove user from group
sudo gpasswd -d username groupname

# Set user's groups (removes from unlisted groups)
sudo usermod -G group1,group2 username  # No -a flag!

Creating and Managing Groups

# Create new group
sudo groupadd groupname

# Create group with specific GID
sudo groupadd -g 2000 groupname

# Delete group
sudo groupdel groupname

# Modify group name
sudo groupmod -n newname oldname

# Modify group GID
sudo groupmod -g 3000 groupname

Admin Group Specifics

# Add user to admin group (RedHat/CentOS)
sudo usermod -aG wheel username

# Add user to admin group (Ubuntu/Debian)
sudo usermod -aG sudo username

# Check wheel group members
getent group wheel

# Check sudo group members
getent group sudo

# List all admin users (RedHat)
getent group wheel | cut -d: -f4 | tr ',' '\n'

# List all admin users (Ubuntu)
getent group sudo | cut -d: -f4 | tr ',' '\n'

Advanced Group Commands

# Change primary group temporarily
newgrp groupname

# Show groups with their GIDs
getent group | cut -d: -f1,3

# Find all members of a group
getent group groupname | cut -d: -f4 | tr ',' '\n'

# List groups user belongs to (from /etc/group)
grep username /etc/group

# Find empty groups (no members)
awk -F: '$4 == "" {print $1}' /etc/group

🎯 Key Takeaways

🚀 What's Next?

Now that you understand groups and how the wheel/sudo groups grant administrative privileges, you're ready to learn about the root user and privilege escalation!

In the next post (Part 3), we'll cover:

• Understanding the root user (UID 0)
• How root differs from Windows Administrator
• The root user's relationship with the Linux kernel
• The su command for switching users
• Difference between su and su - (login shell)
• How /etc/profile and environment variables work
• When to use su vs sudo
• Best practices for root access

Coming Up in Phase 1:

• Part 4: Mastering sudo for Temporary Privilege Escalation
• Part 5: Creating and Managing sudo Configuration
• Parts 6-10: Basic Commands and Help Systems
• And 42 more posts!

💬 Discussion

I'd love to hear about your experience:

• Are you using a RedHat-based system (wheel) or Debian-based system (sudo)?
• Did you successfully add test users to admin groups?
• Have you encountered any issues with group management?
• What real-world scenarios involve group management in your work?

Connect with me:

• 🐙 GitHub - LFCS practice scripts
• 📧 Contact - Questions about LFCS

This is Part 2 of 52 in the LFCS Certification - Phase 1 series. Stay tuned for Part 3: Understanding the Root User and su Command!