Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In an unusual scenario, I have to get rid of a specific system user account called 'lp' (line printing deamon) on an openSUSE system.

Can I just comment out the line for that account in /etc/passwd without running into an inconsistent system state?

Background: The account's user name conflicts with an account name I wish to use within SAMBA. I do not really need the line printing function as I do not know if that account is used by other essential processes.

Has anybody else had experience with removing system accounts?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

I'd run a quick find on the system to see if there are any files that are owned by this user, lp prior.

$ find -user lp

If this returns any files you can back track those files using OpenSUSE's package manager. I belive it uses RPM so a command like this would work:

$ rpm -qf /path/to/file/find/found

This will give you the opportunity to decide if these packages could just be deleted instead. Deleting these packages will most likely take care of removing the user account lp as part of the uninstall.

If no packages are found then this account can either be removed from /etc/passwd, /etc/shadow, & /etc/group. You did check to see if the account had any associated groups didn't you?

A command like this will tell you what groups are associated to this user:

$ id lp
uid=4(lp) gid=7(lp) groups=7(lp)

A easier method to remove the user would be to use one of the built-in commands. They're typically a command like this: userdel <username>.

For example:

 $ sudo userdel lp

A path forward

Comment below from the OP (@MasterofCelebration):

Well, I found some packages belonging to essential functions (e.g. ghostscript, filesystem) which I do not necessarily like to remove.. So I thought about changing the account name and adding a new account for the desired user (leaving the system account’s UID to its new name, e.g. ‘lprint’). The tricky part now is that I do not know what will actually happen with the new user’s home directory used by e.g. “printing applications” or other common used stuff although I don’t need that at all (I don’t even need the home directory of the new user, it’s for SAMBA purposes only).

I would leave any packages that are identified as being associated with the user lp alone.

The tricky part is going to be that the username lp is most likely being called out by a configuration file or two, in addition to potentially owning files on the disk.

Here's what I would do:

  1. I would leave the old UID alone for lp. Change it's name from lp to lpold.
  2. Make your new account with a new UID and go ahead and call it lp.
  3. Do a search for lp in the /etc directory and see if you can identify any configuration files that explicitly call out lp, if you find them, change them to lpold.

Doing it this way you won't have to touch the files on disk, they'll automatically show up as being owned by lpold. Also it will allow you to segregate the files on disk of lpold and the new lp.

The only risk you have to content with now, is that there may be a service which is started as user lp, which would now be your new lp and not the old one. The search through /etc should root these out.

share|improve this answer
    
I:ll try that today.. sounds like a good idea. if I can omit Unix printing services at all, that could work out! –  Master of Celebration Jul 16 '13 at 4:48
    
Well, I found some packages belonging to essential functions (e.g. ghostscript, filesystem) which I do not necessarily like to remove.. So I thought about changing the account name and adding a new account for the desired user (leaving the system account’s UID to its new name, e.g. ‘lprint’). The tricky part now is that I do not know what will actually happen with the new user’s home directory used by e.g. “printing applications” or other common used stuff although I don’t need that at all (I don’t even need the home directory of the new user, it’s for SAMBA purposes only). –  Master of Celebration Jul 16 '13 at 11:34
    
@MasterofCelebration - see my updates, let me know if they help you out. –  slm Jul 16 '13 at 14:15
    
your updated idea is just great. I already thought about renaming the account name referring the system account's UID, but starting to search for that name in all configuration files seems to be an even better idea on top! that should do the trick for a running system. only thing being still problematic would be an update of packages / distribution, but for this special scenario I won't apply any of them. I'll try that out asap, but won't have the time for that before winter, sorry. Thank you in advance! –  Master of Celebration Jul 16 '13 at 17:55

Commenting out the account in /etc/passwd and /etc/shadow will effectively delete the user. The same for /etc/group and /etc/gshadow.

Be aware, if the user is the owner of files, those files will be assigned to a unassigned UID, which does not hurt per se but is ugly and may be undesirable (i.e. that UID could be reused later and those file would belong then to the new user). Best to use find first to find and delete files owned by this user.

Anyway, I would not do it. What if you need to install CUPS some day? Will you make your user CUPS admin? Think also your distribution scripts within packages may operate with the lp name: i.e. a service may allow lp have rights to read/write some files (why? I don't know, but it may happen).

In short, you can, but overall is not a good idea to grab system users of your Linux distribution and give them a use different to the one they were designed.

share|improve this answer
1  
It's not that the files will be "reassigned" it's that the UID that they're identified on the disk with, will no longer have a name associated to it, so commands like ls will just list the UID. –  slm Jul 15 '13 at 18:30
    
sure.. that's why I thought about renaming as well (e.g. lprint). –  Master of Celebration Jul 16 '13 at 4:46

I wouldn't, especially not for one of the traditional low-numbered accounts like lp. If you ever want to add printer-support - like CUPS - you'll get into trouble... and remember, CUPS may very well be a dependency for packages you'll install in the future. Even if you don't install something like CUPS, lp has been a standard user (in Unix-systems) for decades, so packages may depend upon it and there may be parts of the system that uses it anyway. Also the lp user/group may belong to groups by default, and/or own files, directories and devices.

You would be better off finding another name for whatever user you want to create.

share|improve this answer
    
the good news is, that user shall be on higher privileges anyway, so it wouldn't be that big security problem. But, I already thought about renaming as well! Maybe I can leave that UID with another system account (e.g. lprint) I created - just for the cause.. –  Master of Celebration Jul 16 '13 at 4:54

I guess you can just make a backup of /etc/passwd and /etc/shadow and run userdel... I don't know SUSE (use Ubuntu and Debian myself), but I don't think you'll run into problems.

BTW, can't you use pdbedit or smbpasswd to give your samba another user lp? Does the system one really conflict?

share|improve this answer
    
unfortunately, yes it does... –  Master of Celebration Jul 16 '13 at 4:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.