User & Group Management

Stop letting developers lock themselves out of service accounts

🧩 The Challenge

You finally grant a developer sudo access to a service account so they can troubleshoot a legacy app, and ten minutes later they change the primary group or screw up the permissions so nobody can log in. Dealing with these tickets is a total drain when you realize they broke the environment with a single accidental usermod command.

💡 The Fix

Start using the -G flag to append groups instead of the -g flag that changes the primary group. It keeps the account stable while still granting the access they need.

usermod -aG [groupname] [username]

⚙️ Why It Works

Adding the -a flag tells the system to append, meaning the existing group memberships stay exactly where they are. Using -g by itself is a dangerous trap that resets the primary group and often breaks file access for the service itself.

🚀 Pro-Tip: Always double check with id [username] before and after you run the change, because trust is fine but verifying keeps your pager quiet.

Linux Tips & Tricks | © ngelinux.com | 8/29/2026