Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Somehow, I managed to set a passwd for my _postgres user on my OS instead of setting it on the postgres role I have as my superuser / root. Anyways since this, I've been struggling with that user showing up in the account section and login screen, which I really would like to avoid. I've read through some docs about this, and setting the password to * should be all that is needed to fix this. But after several attempts doing this with and without dscl to no avail, I'm gotten to a point where I don't know what to do anymore.

I didn't think it would be even hard doing this, but clearly I'm missing something, so how do you do this?

share|improve this question
Having a password for your _postgres user isn't a particularly bad idea at all. –  Hasaan Chop Nov 15 '09 at 17:36
The postgres docs actually recommends the opposite, that way only system users can access postgres, and there is one less password to remember / security risk. –  googletorp Nov 16 '09 at 11:20
Have you tried deleting and recreating the user? –  Chealion Nov 22 '09 at 19:35
Yeah, I've tried that a few times actually. You need to somehow set the passwd to disabled as not having a passwd is not enough. This is the pain point I haven't been able to overcome. –  googletorp Nov 22 '09 at 20:33

3 Answers 3

up vote 24 down vote accepted

The easiest method for hiding system users (if their user ID is < 500) in the login window is to run the following command:

sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool TRUE

Alternatively you can manually hide just the username by running

sudo defaults write /Library/Preferences/com.apple.loginwindow HiddenUsersList -array-add '_postgres'

To hide the 'Others...' item from the login window if need be:

sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWOTHERUSERS_MANAGED -bool FALSE
share|improve this answer
This is a somewhat hacky solution and doesn't actually "solve" the problem, it just hides the symptoms. I have a lot of different system users for stuff like mysql and whatnot, and they don't show up because their password is marked as '*'. This is what I'm trying to accomplish for my postgres user. Your solution would be bad if I had other users I did want to hide, but be able to login with using others. I would really like to go to the root and actually fix this instead of hiding the problem. –  googletorp Nov 16 '09 at 11:19
This is an excellent answer, and precisely answered my question. But you're probably right that it isn't exactly the question you asked. –  Bill Michell Oct 7 '10 at 11:34
Hide500Users flag doesn't seem to work under lion anymore. Only the remaining two commands work for Lion –  Antony Nov 15 '11 at 2:51
dscl . create /Users/test
dscl . create /Users/test UniqueID 420
dscl . create /Users/test PrimaryGroupID 420
dscl . create /Users/test UserShell /bin/bash
dscl . create /Users/test NFSHomeDirectory /tmp
dscl . create /Users/test RealName Test
dscl . create /Users/test Password test

This creates a user that's visible in sysprefs/Accounts.

dscl . create /Users/test Password "*"

This hides the user. Make sure you quote the "*" or it won't work.

EDIT: I accidentally managed to recreate googletorp's situation of not being able to hide a user by setting his password to "*", and I discovered how to fix it. This time, I had created a user using dsimport, like this:

dsimport /dev/fd/0 /Local/Default I --template StandardUser << EOF
test:*:520:520:Test user:/Users/test:/bin/bash

But in that command, the * is taken to represent a literal one-character password of *, and so dsimport creates an AuthenticationAuthority property for the user and sets the password property to the shadow hash of * (which shows up as ******** in dscl, as for all passwords). After that, attempting to set the password to "*" using dscl just keeps setting the password to a literal *, instead of disabling the password. The solution is to delete the unwanted property, and then disable the password:

sudo dscl . delete /Users/test AuthenticationAuthority
sudo dscl . create /Users/test Password "*"

This hides the user.

share|improve this answer
Instead of the quotes, have you tried escaping the star? dscl . -create /Users/test Password \* –  Eric3 May 31 '11 at 4:19
As long as dscl sees a literal "*" after "Password", anything goes. –  LaC May 31 '11 at 10:19

Just in case you haven't found a viable solution (or in case someone else finds this question from Google), setting the user's shell to /usr/bin/false prevents him from logging in and hides it from the login screen and from the system preferences. To do so, use the following command line:

sudo dscl . -change /Users/[username] UserShell /bin/bash /usr/bin/false

And to revert the change:

sudo dscl . -change /Users/[username] UserShell /usr/bin/false /bin/bash

Where [username] is the name of the user you want to hide (_postgres in your case I assume). I don't know why dscl wants the old value first, but that's what the manpage says, and it works quite well.

share|improve this answer
This solution is very poor as it disables the shell for that user, the very thing that I want to use it for. If I would want to restart the database etc. –  googletorp Mar 29 '10 at 15:00
@googletorp: You can still do sudo -s -u _postgres from an admin account to get a shell as _postgres; this will work even if his UserShell is set to /usr/bin/false. Besides, doesn't setting its password to "no password", as you tried to do, also disables the account? –  zneak Mar 29 '10 at 23:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.