--- a/debian/passwd.install
+++ b/debian/passwd.install
@@ -9,6 +9,7 @@
 usr/sbin/cppw
 usr/sbin/groupadd
 usr/sbin/groupdel
+usr/sbin/groupmems
 usr/sbin/groupmod
 usr/sbin/grpck
 usr/sbin/grpconv
@@ -33,6 +34,7 @@
 usr/share/man/*/man8/chpasswd.8
 usr/share/man/*/man8/groupadd.8
 usr/share/man/*/man8/groupdel.8
+usr/share/man/*/man8/groupmems.8
 usr/share/man/*/man8/groupmod.8
 usr/share/man/*/man8/grpck.8
 usr/share/man/*/man8/grpconv.8
@@ -59,6 +61,7 @@
 usr/share/man/man8/chpasswd.8
 usr/share/man/man8/groupadd.8
 usr/share/man/man8/groupdel.8
+usr/share/man/man8/groupmems.8
 usr/share/man/man8/groupmod.8
 usr/share/man/man8/grpck.8
 usr/share/man/man8/grpconv.8
--- a/debian/passwd.postinst
+++ b/debian/passwd.postinst
@@ -31,6 +31,24 @@
     			exit 1
 		)
 	fi
+	if ! getent group groupmems | grep -q '^groupmems:[^:]*:99'
+	then
+		groupadd -g 99 groupmems || (
+    			cat <<EOF
+************************  TESTSUITE  *****************************
+Group ID 99 has been allocated for the groupmems group.  You have either
+used 99 yourself or created a groupmems group with a different ID.
+Please correct this problem and reconfigure with ``dpkg --configure passwd''.
+
+Note that both user and group IDs in the range 0-99 are globally
+allocated by the Debian project and must be the same on every Debian
+system.
+EOF
+    			exit 1
+		)
+# FIXME
+		chgrp groupmems /usr/sbin/groupmems
+	fi
     ;;
 esac
 
--- a/debian/rules
+++ b/debian/rules
@@ -60,6 +60,7 @@
 	dh_installpam -p passwd --name=chsh
 	dh_installpam -p passwd --name=chpasswd
 	dh_installpam -p passwd --name=newusers
+	dh_installpam -p passwd --name=groupmems
 ifeq ($(DEB_HOST_ARCH_OS),hurd)
 # login is not built on The Hurd, but some utilities of passwd depends on
 # /etc/login.defs.
@@ -87,3 +88,6 @@
 	chgrp shadow debian/passwd/usr/bin/expiry
 	chmod g+s debian/passwd/usr/bin/chage
 	chmod g+s debian/passwd/usr/bin/expiry
+	chgrp groupmems debian/passwd/usr/sbin/groupmems
+	chmod u+s debian/passwd/usr/sbin/groupmems
+	chmod o-x debian/passwd/usr/sbin/groupmems
--- /dev/null
+++ b/debian/passwd.groupmems.pam
@@ -0,0 +1,8 @@
+# The PAM configuration file for the Shadow 'groupmod' service
+#
+
+# This allows root to modify groups without being prompted for a password
+auth		sufficient	pam_rootok.so
+
+@include common-auth
+@include common-account