We were thinking of not using the default primary group for our RHEL users. What I mean by default:
User: melbin
Primary group: melbin
We will instead do something like:
User: melbin
Primary group: webmasters
Our goal for this is to allow users to share things easier since people seem to forget to sg when they are working on shared files. We thought this would make more sense than making the shell automatically sg on login.
Can't remember why we went the way we did on this issue about 10 years ago, but we ended up setting the mode of the containing directories to 2770. Probably because of multiple group memberships of our users.
Works pretty well for us, and Cron periodically runs a find /foo -type d ! -perm 2770 -execdir chmod 2770 '{}' \; and a complimentary 'chmod 0660' for files w/ type f.
There actually could be security reprecutions, if you choose not to use the private groups.
Users may have an expectation, that content in their home directory is only visible to themselves. If you have a more permissive umask, and a primary group, shared by many users, then files created in the home folder may be visible to more users, then a person expects.
If this box only exists for a single purpose, and nobody is using that box for things they might consider personal, then this may not matter to much.
