This specifies a list of groups (from /etc/group) whose members become restricted users or have permissions added/removed when they login.  This can be a comma-delimited list of group names or group IDs. It can be the special keyword all to restrict all users. In addition, you can use the all except sequence to specify that all users except users in the list of groups should be restricted.

To keep things simple, it is recommended that you create a special group named restrict in /etc/group and put all the users you want restricted in this group.

This option, in conjunction with u-restrict-mode, can be used to create multiple user classes that can have various user permissions. This is a good way to classify users as read-only, for example.

You also need to use u-restrict-mode if you don't want users restricted to their home directory. Specifically, you'd need to set u-restrict-mode=unrestricted to do that.

Examples:

u-restricted-groups=none
u-restricted-groups=all
u-restricted-groups=restrict
u-restricted-groups=restrict,users,668,guests
u-restricted-groups=all except admins,operators,wheel

u-restricted-groups=restrict

See Also:

• u-restrict-mode
• User Management
• Configuring Restricted Users
• User Classes
• Extended User Permissions