I have a lot of groups (20) associated with my Linux account. I've learned that to use the groups near the end of the list I need to use the 'newgrp' command so that my particular group shows up at the beginning of my list. On our system, anyone with more than 16 groups will get permission denied errors when trying to access files/folders belonging to a group listed after the first 16 assigned to the user.

For example, when I run groups I get the following output:

g1 g2 g3 g4 g5 g6 g7 g8 g9 g10 g11 g12 g13 g14 g15 g16 g17

But when I try and access files belonging to g17 I get a permission denied error. I can get around this by running newgrp g17 after which the groups command returns:

g17 g1 g2 g3 g4 g5 g6 g7 g8 g9 g10 g11 g12 g13 g14 g15 g16

Is there a way to set the default order for my groups so that I can set my commonly used groups to the top of the list so that I don't need to use newgrp so often? I have a few groups that I use most frequently and I'd like to have it such that those show up at the beginning of the list every time I log into a server.

  • I've got a Linux-system account with 115 groups. (Yes, it's AD joined.) I don't seem to have any problem using any of the groups. Please provide an example of a typical failure. – roaima Apr 18 '18 at 23:12
  • I suspect I have issues using more than 16 concurrent groups because of our NFS setup, but I'm not that familiar with the reasons – lonestar21 Apr 18 '18 at 23:31
  • This is an NFS limitation and as such should be mentioned in your question that the files you're trying to access are on an NFS server. – roaima Apr 18 '18 at 23:42

The 16 group limit on the NFS server is pretty easy to work around.

Here is a bit more details http://www.xkyle.com/solving-the-nfs-16-group-limit-problem/

But the short answer is to edit the following in your nfs server startup config

rpc.mountd –manage-gids

Commercial filers such as NetApp, Isilon, and Qumulo all have an option for server side group lookups but the process is unique to each vendor and their versions. So for those, contact the vendor.

But this all relies on their being a central authentication system such as ldap or nis that both the client and the server use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.