206

I'd like to create a user and a group both called subversion on a RHEL 5 system. I looked at the man page for useradd and I guess the command would be just be...

useradd subversion

However, not sure how to avoid creating a home dir. Also, I don't want it to be a user that can log in to the system.

The main purpose is just to provide an owner for a SVN repository.

Improve this question
1
  • Have you really looked at man page of useradd and didn't find -M (do not create HOME directory)?
    – inemanja
    Commented Oct 17, 2018 at 11:42

8 Answers 8

Reset to default
114

You can use the -M switch (make sure it's a capital) to ensure no home directory will be created:

useradd -M subversion

then lock the account to prevent logging in:

usermod -L subversion
Improve this answer
11
  • 93
    This isn't a particularly strong answer, the user created by this means still has a shell. And you did not even warn the OP that this was the case. Retrospectively that would be usermod -s /bin/false subversion, or with --shell /bin/false to useradd
    – Lee Hambley
    Commented Sep 14, 2011 at 16:55
  • 10
    @beak the account is locked, having a shell is a moot point.
    – user1931
    Commented Sep 14, 2011 at 22:55
  • 20
    @beak actually only the root user would be able to su to the locked account, but why bother if the person has gained root access already? And setting the shell doesn't do much when a user can run su -s /bin/bash username and bypass that.
    – user1931
    Commented Sep 15, 2011 at 22:44
  • 22
    thanks for taking the time to have the discussion, you are of course correct; but it pains me to see non-login users with shells defined, it strikes me as lazy, and incase someone is unfamiliar with the system, it's nice that they can't accidentally do something unintended; hackers are a different breed, if they already got a shell on the machine, I think it's basically game over
    – Lee Hambley
    Commented Sep 16, 2011 at 6:43
  • 15
    These comments covered exactly the things I was hoping to learn, thanks @Beaks && John T
    – Rixius
    Commented Feb 14, 2013 at 20:27
310

You can use the following command:

useradd -r subversion

For more info, check manual pages with this command:

man useradd

You will find in this documentation the following flag that can be used for your purpose.

-r, --system                  create a system account

The -r flag will create a system user - one which does not have a password, a home dir and is unable to login.

Improve this answer
4
  • 1
    this command will even create a group for the user called the same. So the "subversion" user will be in the "subversion" group. Great for when you later want to do "sudo chown -R subversion:subversion /path/to/folder"
    – s3v1
    Commented Aug 15, 2013 at 12:07
  • 64
    with -r alone we can still login though. we need -s /bin/false to disable the user shell.
    – c4il
    Commented Oct 25, 2013 at 13:27
  • 8
    @c4il But the only one that can login into them is root, right? I mean, they don't have a password, so I would expect only root to be able to log into them.
    – Camilo Martin
    Commented Jul 12, 2014 at 20:48
  • but we can assign them passwords anyways, I tried passwd subversion.
    – Shayan
    Commented Sep 21, 2019 at 17:26
45

Another solution to create a system user, using adduser :

adduser --system --no-create-home --group yourusername

You can remove --group if you don't need group yourusername, and --no-create-home if you do need a home for this user.

As mentionned by py4on in comments, on some systems one may need to use the --disabled-login option in order to, well, disable login for this user. It seems to be the default behaviour under Debian, though.

Beware that the numeric ID of the user will be of a system account. You can fix the uid using the --uid option, though.

Finally, note that on some systems (e.g. Fedora) adduser is a symlink to useradd, in which case this answer is not valid.

Improve this answer
2
  • 5
    To address "I don't want it to be a user that can log in" add the flag --disabled-login as well (before yourusername)
    – toxefa
    Commented Jul 30, 2015 at 10:37
  • @py4on : Though this option is documented in the manpage, it seems to be the default under Debian at least.
    – Skippy le Grand Gourou
    Commented Aug 1, 2015 at 19:59
34

The cleanest answer to the original question is to run the command:

adduser subversion --shell=/bin/false

And if you don't want the home directory either:

adduser subversion --shell=/bin/false --no-create-home

or, if you want an even more locked down system user (Normally this won't create a home directory - it has been reported that it will still create a home directory in linux mint as per comment below)

adduser subversion --system --group

All these commands will create a group with the same name as the user

Improve this answer
2
  • 1
    On Mint the last command definitely creates a home dir: Creating home directory '/home/nodejs' ...
    – jcollum
    Commented Feb 2, 2019 at 22:38
  • should I also add L
    – alper
    Commented Jul 7, 2020 at 18:53
28

The safest form of doing this would be to use adduser like so:

$ adduser -r -s /bin/nologin subversion

NOTE: Be sure to include -s /sbin/nologin to disable any login shell from being made available to the account.

Confirmation of setup

$ grep subversion /etc/passwd /etc/shadow
/etc/passwd:subversion:x:496:496::/home/subversion:/bin/nologin
/etc/shadow:subversion:!!:17232::::::

However there's no directory:

$ ll /home | grep subversion
$

Confirm that the account is otherwise usable:

$ sudo -u subversion whoami
subversion

$ sudo -u subversion date
Tue Mar  7 08:58:57 EST 2017

Removal

If you need to remove this account:

$ userdel subversion -r
userdel: subversion mail spool (/var/spool/mail/subversion) not found
userdel: subversion home directory (/home/subversion) not found
$

And confirm:

$ grep rtim-hc-user /etc/passwd /etc/shadow
$
Improve this answer
5
  • 4
    adduser doesn't recognize the -r option. I think you meant useradd.
    – felwithe
    Commented Jul 29, 2017 at 16:30
  • @felwithe no, every answer I write up I always test before posting. I checked and that switch shows on a CentOS 6.x system.
    – slm
    Commented Jul 29, 2017 at 20:10
  • Here is a pastebin of the result. I'm on Ubuntu 16 LTS. I don't know what version of adduser is installed but I never imagined it would change much over time or system to system. I then tried it with a --system flag instead, which created a homedir for the user (I didn't want one). Finally I just did it with useradd instead of adduser and it worked as planned. So I just assumed that you'd mistyped it as adduser when it was supposed to be useradd.
    – felwithe
    Commented Jul 30, 2017 at 0:18
  • 1
    @felwithe yeah I wasn't doubting you, just letting you know that I tried it 8-). I'm a mod on the Unix and Linux site and these cmds are notoriously different b/w distros. The OP mentions RHEL in the question hence why I answered it like so, but they didn't tag it as red hat specific, which is part of the confusion on this Q&A IMO.
    – slm
    Commented Jul 30, 2017 at 0:31
  • Setting the shell to /bin/nologin appears to be the correct answer here. Thanks for that :)
    – miversen33
    Commented May 6 at 15:49
7

In Debian, you could create a system user (without home directory) and login shell:

useradd --system --shell=/usr/sbin/nologin <username>

If your nologin program is in /sbin/nologin, please change accordingly.

Improve this answer
3

On a CentOS 7 machine you can use the following commands:

  • If the user does not exist:

    useradd testuser --shell=/sbin/nologin

  • if you want to modify an existing user:

    usermod testuser --shell=/sbin/nologin
Improve this answer
0

Start by generating an encrypted password for the user with a maximum of 8 characters long by doing: 

openssl passwd -crypt new_password_less_than_eight_chars_long

Then you do:

useradd -m -g groupname -G otherGroupsSeperatedByComma -p encryptedPassword username
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .