2

When creating a group using the command line, I can use dscl as follows:

sudo dscl . create /Groups/testgroup
sudo dscl . create /Groups/testgroup RealName "Test Group"
sudo dscl . create /Groups/testgroup gid 999

or I can use dseditgroup:

sudo dseditgroup -o create -n /Local/Default -r "Test Group" testgroup

(here, I let dseditgroup automatically assign a GID)

Many of the posts providing guidance for creating a group also include this command:

sudo dscl . create /Groups/testgroup passwd "*"

and the man page for dscl says the parameter to passwd (in this case "*") is a user_path. In the man page details for passwd, it only talks about it being used to change a password for a user, nothing about how it applies in the context of a group.

when I run

sudo dscl . create /Groups/testgroup passwd "*"

I am prompted for "Password:" and it accepts my admin password (only), and creates a Password field in testgroup. The value for this field displays as an asterisk.

Most (though not all) of the groups on my machine have a Password field such as this. I can scan them quickly using:

dscl . -readall /Groups Password

When I create a Password field for a group like this, does the asterisk indicate some kind of special user_path? Does the field keep track of which user the password is for, and what the password is? Once a Password field is created for a group, when and how might it get used? thanks!

2

Groups with passwords will allow a user to become a member of that group if the user knows the group password and even if the user is not a member of that group. I'm not sure that group passwords are even implemented in OS X.

In general, if you see the password field set with a single "*" that means the password is not set. Since macOS is POSIX, consulting the Open Group documentation will always give you some clues-http://pubs.opengroup.org/onlinepubs/9699919799/utilities/newgrp.html

  • Is your "Groups with passwords will allow user to become a member" a general principle for many OS or something you are saying macOS does (or did) specifically at some point? – bmike Jul 6 '18 at 12:17
  • @bmike- A principle from OS's in the past not macOS. I really can't pinpoint which ones but I do remember that this was possible. I think you can still do this in linux but I don't see any value in doing so. – fd0 Jul 6 '18 at 12:30
  • 1
    @fd0- thanks! I see now that the password I provide at the prompt is not what gets stored for the group, and that the asterisk is not a representation of a password, it is literally what is getting stored. The password prompt I get is just to authorize the setting of a group's password. I now also see that any text provided and stored in the password field is readable via dscl by non-admin users, which really does make it hard to understand the value in using it .. – hoeaku Jul 6 '18 at 13:26
  • I'm curious why so many of the macOS groups have a Password field created, only to assign an asterisk to it (and why some instructive posts include the step of creating and assigning the field this way). Why not just leave out the Password field if it is not going to be used? – hoeaku Jul 6 '18 at 13:33
1

This dates back to Unix. The * locks the group so only the static members are part of it. If there is no password, then anybody can become an member of the group.

newgrp groupname

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .