6

The sys-apps/shadow package on my GNU / Linux system comes with a useradd command that supports an option that I have previously overlooked: --non-unique. For the sake of convenience when shellig home from the university, I have created an alias for my original username (casual name at home) thusly:

useradd --non-unique -u 1001 \
     --no-create-home --home-dir /home/casualname \
     -g 1001 -G `id casualname -G | tr ' ' ,` universityUsername

This allows me to login from campus with the login universityUsername without creating a ~/.ssh/config alias or specifying the -l option for ssh. After logging in, whoami reports that I am casualname. This is due to the fact that casualname appears closer to the top of the /etc/passwd file.

I wonder how widely supported such aliases are and if there are any drawbacks to using them. And also, is there a way to select the preferred user alias as the acting one (what $USER is set to) on a system where the user can not re-order entries in /etc/passwd?

  • nausea and shortness of breath. If it lasts longer than 4 hours seek immediate medical attention. – mikeserv Apr 16 '14 at 2:57
10

You can't have several users with the same UID. If they have the same UID, then they're the same user.

What you have is multiple entries in the user database for the same user. That's possible in all unix variants I've seen. The user name determines which entry is used and thus which password, home directory and shell applies at login time. The first entry determines what id-based lookups to the user database will return. Some applications look up the user database by name (using perhaps $USER), others by UID; if they use the UID, then they'll get the first entry and you can't do anything about it.

This is a cute setup, but it's one of these cute but mostly useless things. It's unusual: if you have any fellow administrator, they won't thank you for it; many applications won't bother to cover this case and may behave suboptimally (e.g. depend on your $LOGNAME for some functionality, resulting in using different data depending on what user name you logged in as). It's also error-prone: you need to use root access to create the second entry, you need to remember to edit both entries in passwd or shadow (e.g. to change your password, which will require root access unlike normal passwd invocation). You should do that only if you have a very good reason.

If all you wanted was to have the same username for SSH, then the way everybody else does it is with aliases in .ssh/config. That's what they're for. It's simpler to set up, doesn't require more privileges, and doesn't set up an unusual and potentially confusing configuration.

One useful use of multiple entries for the same user is a rescue user when things go wrong. For example, a toor account (traditional name) whose shell is a statically-linked binary, which you use only for system repair.

  • Error-prone because you feel so? You will forgive me if I don't take your word for it. – Ярослав Рахматуллин Apr 22 '14 at 12:20
  • @ЯрославРахматуллин This requires using root access and editing the passwd and shadow files manually. You need to remember the existence of the multiple entries for any maintenance such as updating your password. Then you'll run into cases where applications get inconsistent information about your user name (one from the login name, one by looking the name corresponding to your UID). – Gilles Apr 22 '14 at 13:57
  • Thanks for elaborating on your answer. The chapter Multiple accounts with the same UID from Practical Unix and Internet Security mentions that "This approach should only be used for system-level accounts, not for personal accounts" without providing any compelling reasons (like your answer). - The maintenance overhead of invoking passwd for the aliases and "copying" groups from the original user is not a problem on a personal desktop. I lack the experience to see grievous implications of this approach, without ruling out that it may not be worth the effort. – Ярослав Рахматуллин Apr 23 '14 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.