Somehow, I managed to set a passwd for my _postgres user on my OS instead of setting it on the postgres role I have as my superuser / root. Anyways since this, I've been struggling with that user showing up in the account section and login screen, which I really would like to avoid. I've read through some docs about this, and setting the password to * should be all that is needed to fix this. But after several attempts doing this with and without dscl to no avail, I'm gotten to a point where I don't know what to do anymore.

I didn't think it would be even hard doing this, but clearly I'm missing something, so how do you do this?

  • Having a password for your _postgres user isn't a particularly bad idea at all. Nov 15, 2009 at 17:36
  • 1
    The postgres docs actually recommends the opposite, that way only system users can access postgres, and there is one less password to remember / security risk.
    – googletorp
    Nov 16, 2009 at 11:20
  • Have you tried deleting and recreating the user?
    – Chealion
    Nov 22, 2009 at 19:35
  • Yeah, I've tried that a few times actually. You need to somehow set the passwd to disabled as not having a passwd is not enough. This is the pain point I haven't been able to overcome.
    – googletorp
    Nov 22, 2009 at 20:33

3 Answers 3


The easiest method for hiding system users (if their user ID is < 500) in the login window is to run the following command:

sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool TRUE

Alternatively you can manually hide just the username by running

sudo defaults write /Library/Preferences/com.apple.loginwindow HiddenUsersList -array-add '_postgres'

To hide the 'Others...' item from the login window if need be:

sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWOTHERUSERS_MANAGED -bool FALSE
  • 2
    This is a somewhat hacky solution and doesn't actually "solve" the problem, it just hides the symptoms. I have a lot of different system users for stuff like mysql and whatnot, and they don't show up because their password is marked as '*'. This is what I'm trying to accomplish for my postgres user. Your solution would be bad if I had other users I did want to hide, but be able to login with using others. I would really like to go to the root and actually fix this instead of hiding the problem.
    – googletorp
    Nov 16, 2009 at 11:19
  • 1
    This is an excellent answer, and precisely answered my question. But you're probably right that it isn't exactly the question you asked. Oct 7, 2010 at 11:34
  • 3
    Hide500Users flag doesn't seem to work under lion anymore. Only the remaining two commands work for Lion
    – Antony
    Nov 15, 2011 at 2:51
  • Note that this will not hide the user on the initial boot screen if you have FileVault2 on. Nov 19, 2015 at 15:03
dscl . create /Users/test
dscl . create /Users/test UniqueID 420
dscl . create /Users/test PrimaryGroupID 420
dscl . create /Users/test UserShell /bin/bash
dscl . create /Users/test NFSHomeDirectory /tmp
dscl . create /Users/test RealName Test
dscl . create /Users/test Password test

This creates a user that's visible in sysprefs/Accounts.

dscl . create /Users/test Password "*"

This hides the user. Make sure you quote the "*" or it won't work.

EDIT: I accidentally managed to recreate googletorp's situation of not being able to hide a user by setting his password to "*", and I discovered how to fix it. This time, I had created a user using dsimport, like this:

dsimport /dev/fd/0 /Local/Default I --template StandardUser << EOF
test:*:520:520:Test user:/Users/test:/bin/bash

But in that command, the * is taken to represent a literal one-character password of *, and so dsimport creates an AuthenticationAuthority property for the user and sets the password property to the shadow hash of * (which shows up as ******** in dscl, as for all passwords). After that, attempting to set the password to "*" using dscl just keeps setting the password to a literal *, instead of disabling the password. The solution is to delete the unwanted property, and then disable the password:

sudo dscl . delete /Users/test AuthenticationAuthority
sudo dscl . create /Users/test Password "*"

This hides the user.

  • Instead of the quotes, have you tried escaping the star? dscl . -create /Users/test Password \*
    – Eric3
    May 31, 2011 at 4:19
  • As long as dscl sees a literal "*" after "Password", anything goes.
    – LaC
    May 31, 2011 at 10:19

Just in case you haven't found a viable solution (or in case someone else finds this question from Google), setting the user's shell to /usr/bin/false prevents him from logging in and hides it from the login screen and from the system preferences. To do so, use the following command line:

sudo dscl . -change /Users/[username] UserShell /bin/bash /usr/bin/false

And to revert the change:

sudo dscl . -change /Users/[username] UserShell /usr/bin/false /bin/bash

Where [username] is the name of the user you want to hide (_postgres in your case I assume). I don't know why dscl wants the old value first, but that's what the manpage says, and it works quite well.

  • 1
    This solution is very poor as it disables the shell for that user, the very thing that I want to use it for. If I would want to restart the database etc.
    – googletorp
    Mar 29, 2010 at 15:00
  • @googletorp: You can still do sudo -s -u _postgres from an admin account to get a shell as _postgres; this will work even if his UserShell is set to /usr/bin/false. Besides, doesn't setting its password to "no password", as you tried to do, also disables the account?
    – zneak
    Mar 29, 2010 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.