grpunconv

grpunconv [-R, --root CHROOT_DIR] [--help] [--version]

-R, --root CHROOT_DIR
    Apply changes within CHROOT_DIR and use its config files.

--help
    Print usage help and exit.

--version
    Output version info and exit.

grpunconv is a Linux utility from the shadow-utils package that reverts shadow group passwords to the traditional /etc/group format.

It reads /etc/gshadow, extracts encrypted passwords and group administrator lists (GID fields), and inserts them into matching entries in /etc/group. Password fields in /etc/gshadow prefixed by '!' remain unchanged; others are assumed encrypted. Upon success, /etc/gshadow is deleted.

This command disables shadow group password support, useful for simplifying configurations, legacy systems, or troubleshooting. It requires root privileges and checks file integrity: if /etc/gshadow is absent or invalid, it warns but may proceed partially.

Run on live systems cautiously, as it modifies critical files. Pair with grpconv for reversible shadow enabling/disabling. Supports chroot via -R for containerized or multi-tenant environments.

Irreversibly deletes /etc/gshadow; backup first. Fails silently on mismatches. Requires root. Not for systems without shadow groups.

0: success
1: fatal error (e.g., permissions)
2: syntax/invocation error

/etc/group (modified)
/etc/gshadow (read and deleted)

Part of shadow password suite since early 1990s (Julianne Frances Haugh). Evolved in shadow-utils for secure password separation; widely used in Linux distros like Ubuntu, Fedora.

grpconv(8), pwconv(8), pwunconv(8), shadowconfig(8)