shadow/man/login.defs.d/CONSOLE_GROUPS.xml

<varlistentry condition="no_pam">
  <term><option>CONSOLE_GROUPS</option> (string)</term>
  <listitem>
    <para>
      List of groups to add to the user's supplementary group set when
      logging in on the console (as determined by the CONSOLE setting).
      Default is none.
    <para>
    </para>
      Use with caution - it is possible for users to gain permanent access
      to these groups, even when not logged in on the console.
    </para>
  </listitem>
</varlistentry>