GROUP.CONF(5)

💖 GROUP.CONF(5) 💖

okay bestie, so this is the manual page for group.conf from the Linux-PAM Manual — and it's literally the glow-up guide for your /etc/security/group.conf file. buckle up, we're getting you group memberships and it's giving main character energy 🎀

---

✨ NAME ✨

group.conf — the configuration file for the pam_group module 🫶

---

🌸 DESCRIPTION 🌸

so the pam_group PAM module does NOT authenticate the user, bestie. that's not its job, it's not its vibe. instead? it grants group memberships to the user during the credential setting phase of the authentication module. and those memberships are based on the service they're applying for. slay.

for this module to function correctly there must be a correctly formatted /etc/security/group.conf file present. no file, no groups, no mercy 💅

some formatting tea for you:

• white spaces are ignored (they said "we don't see it, we don't care")
• lines maybe extended with '\' (escaped newlines) — yes, the backslash is doing the "…and another thing" thing
• text following a '#' is ignored to the end of the line (comments are iconic, use them)

the syntax of the lines is as follows:

services;ttys;users;times;groups

let's break down each field because there are FIVE and they ALL matter 🔥

the fields, one by one

• the first field, the services field — a logic list of PAM service names that the rule applies to
• the second field, the tty field — a logic list of terminal names that this rule applies to
• the third field, the users field — a logic list of users, or a UNIX group, or a netgroup of users to whom this rule applies. group names get a '%' symbol in front, and netgroup names get a '@' symbol in front
• the fourth field, the times field — see below, it's got lore
• the fifth field, the groups field — also below

a logic list namely means individual tokens that are optionally prefixed with '!' (logical not) and separated with '&' (logical and) and '|' (logical or).

for these items the simple wildcard '*' may be used only once. and listen — with UNIX groups or netgroups, no wildcards or logic operators are allowed. periodt. 🙅

⏰ the times field ⏰

the times field is used to indicate "when" these groups are to be given to the user. the format here is a logic list of day/time-range entries.

the days are specified by a sequence of two character entries — MoTuSa for example is Monday Tuesday and Saturday. and here's the sneaky part: repeated days are unset, so MoMo = no day, and MoWk = all weekdays bar Monday. the way that logic works is genuinely unhinged but we respect it 💀

the two character combinations accepted are:

Mo Tu We Th Fr Sa Su Wk Wd Al

the last two being week-end days and all 7 days of the week respectively. as a final example, AlFr means all days except Friday. 🌈

each day/time-range can be prefixed with a '!' to indicate "anything but". the time-range part is two 24-hour times HHMM, separated by a hyphen, indicating the start and finish time — and heads up, if the finish time is smaller than the start time it is deemed to apply on the following day. so like, it spills over. midnight shenanigans. 🌙

👑 the groups field 👑

the groups field is a comma or space separated list of groups that the user inherits membership of. these groups are added if the previous fields are satisfied by the user's request. simple as that, no cap.

🚨 for a rule to be active, ALL of service+ttys+users must be satisfied by the applying process. ALL of them. not some. not most. ALL. this is a vibe check and everyone has to pass it.

---

🦋 EXAMPLES 🦋

these are some example lines which might be specified in /etc/security/group.conf. copy them, love them, adjust them to your life ✨

running 'xsh' on tty* (any ttyXXX device), the user 'us' is given access to the floppy (through membership of the floppy group):

xsh;tty*&!ttyp*;us;Al0000-2400;floppy

running 'xsh' on tty* (any ttyXXX device), the users 'sword', 'pike' and 'shield' are given access to games (through membership of the floppy group) after work hours:

xsh; tty* ;sword|pike|shield;!Wk0900-1800;games, sound
xsh; tty* ;*;Al0900-1800;floppy

any member of the group 'admin' running 'xsh' on tty*, is granted access (at any time) to the group 'plugdev':

xsh; tty* ;%admin;Al0000-2400;plugdev

---

💜 SEE ALSO 💜

pam_group(8), pam.d(5), pam(8) — go read these too, they're the rest of the friend group 🫶

---

🎀 AUTHOR 🎀

pam_group was written by Andrew G. Morgan <morgan@kernel.org>. we stan a legend. 👑

---

and that's the whole page bestie!! this was shipped as part of Linux-PAM, dated 09/27/2026 — so go forth, edit /etc/security/group.conf, and grant those memberships responsibly. mwah 💋✨