Linux security is fundamentally built on a system of Users and Groups. A “Group” is simply a collection of users who all share the exact same permissions. For example, if you want four developers to be able to edit the files in the /var/www/html folder, you don’t assign permissions to each person individually. You create a “web-devs” group, grant the group permission to edit the folder, and then add the four users to the group.
When you are troubleshooting “Permission Denied” errors, the very first step is verifying exactly which groups a specific user belongs to. The Linux terminal provides two incredibly fast commands for this: groups (for a quick list) and id (for a deep dive).
Method 1: The “groups” Command (The Quick List)
If you just need a fast, clean, human-readable list of every group a specific user belongs to, the groups command is the best tool for the job.
- Open your terminal or SSH into your server.
- To find the groups for your own currently logged-in account, simply type:
groups
- Press Enter.
The terminal will print a horizontal list of names (e.g., john sudo adm www-data docker). The first name on the list is your “Primary Group” (usually identical to your username). Every name after that is a “Secondary Group” that you have been added to.
How to Check a Different User
If you are an administrator and you need to check the permissions of a new employee (e.g., a user named “sarah”), you do not need to log into her account. You can query her data from your own account.
- Type the command followed by her exact username:
groups sarah
- Press Enter.
The terminal will print: sarah : sarah developers testers. This instantly tells you that Sarah belongs to her own primary group, plus the developers and testers groups.
Method 2: The “id” Command (The Technical Deep Dive)
While the groups command is easy to read, it does not provide the numerical IDs that the Linux kernel actually uses behind the scenes. If you are writing a bash script, setting up an NFS file share, or migrating a user to a different server, you need the raw numbers (the UID and GID). You must use the id command.
- Type this command:
id
- Press Enter.
The output will look much more complex (e.g., uid=1000(john) gid=1000(john) groups=1000(john),27(sudo),33(www-data)).
Here is how to read that data:
- uid: The User ID number. This is how the Linux kernel identifies John (he is user #1000).
- gid: The Primary Group ID number. (When John creates a brand new file, the file will automatically be owned by group #1000).
- groups: The Secondary Group IDs. This shows that John also has the powers of group #27 (sudo/administrator access) and group #33 (the Apache web server group).
Just like the previous method, you can append a username to check someone else’s IDs (e.g., id sarah).
Method 3: Read the Raw /etc/group File
If you don’t know the username, but you want to see a list of everyone who belongs to a specific group (e.g., you want to see exactly who has “sudo” administrator access on the server), you must read the raw configuration file that controls the entire system.
- Type this command to search the file specifically for the word “sudo”:
grep "sudo" /etc/group
- Press Enter.
The terminal will output a line like this: sudo:x:27:john,sarah,mike
This tells you that the sudo group (which is group ID #27) currently contains three users: John, Sarah, and Mike. If Mike is no longer employed at the company, you know you need to immediately revoke his access.