In os X it's possible to have users without passwords. If you inspect them with dscl their password show up as *. This is used for system users such as users for databases like mysql, pgsql etc. What's nice about this is that these users doesn't show up at the login screen and you can't login as them without sudo etc.

After deleting such a user trying some things out I wanted to recreate it, but couldn't. I could manage to get a user with a blank password and I could set the password to *. But none had the same effect as above, as the user showed up on my login screen.

How do you create such a user?

  • On Linux, you pass the --disabled-password flag to adduser. Maybe OS X has something similar in its command line repertoire?
    – B.R.
    Aug 10, 2010 at 21:00
  • Did you mean; user can log in without a password or can't log in at all because no password is set? Aug 10, 2010 at 21:08
  • 1
    I notice you didn't accept an answer... one requirement to stay out of the various xdm lists is having a significantly low userid. on many systems useradd starts adding id's at 1000, and the login managers won't show user id's below that, but everything above. so though it's not an answer to this question, it might be the resolution to the problem. please note that 1000 is arbitrary and may be lower or higher on your distribution. To fix just modify the user entry in /etc/passwd to have a lower uid. Now for me to go ask similar question. Apr 7, 2011 at 19:53
  • @xenoterracide: When I recreated the user, I gave it the old ID, it was the pgsql user I deleted which has an id of one higher than the mysql one, so I'm sure it didn't have any impact in this case, but thanks for the info anyways.
    – googletorp
    Apr 7, 2011 at 21:16

8 Answers 8


You can run passwd --delete <username> after creating the user with adduser. After this, you'll be able to login without entering a password.

  • 4
    I think that's the exact opposite of what is being asked for here. Nov 29, 2011 at 13:37
  • At first, I thought this was the right (or best) answer, until I've re-read the OP's question, which mentions for "system user" and not show up on "login screen". This method will show up on login screen and you can 'sudo' using this method.
    – HidekiAI
    Apr 28, 2015 at 23:30

You can use usermod, which will disable the password using an ! rather than an *.

usermod -L <username>

From the man page on usermod:

-L, --lock Lock a user's password. This puts a '!' in front of the encrypted password, effectively disabling the password.

A user in /etc/passwd with home directory of /dev/null and shell of /sbin/nologin, can be used for sudo ing commands, but can't actually be logged into, for example;

from my /etc/passwd

tcpdump:x:104:441:added by portage for tcpdump:/dev/null:/sbin/nologin

I half remember this will make it disappear from the XDM login screen too, but I don't use XDM anymore, so that's a guess :-)

  • This is the right answer because the OP asked for account which you cannot 'sudo' or show up on "login screen", by setting to '/sbin/nologin' for shell. One thing to note is because the OP asked for "system user", should also mention that 'useradd --system' should be used to create UID in low number (as portage/ebuild does)
    – HidekiAI
    Apr 28, 2015 at 23:26

Using dscl would give

dscl . -passwd /Users/myuser ""
  • 1
    This, unlike most of the answers above it... actually worked for me. Aug 30, 2017 at 21:33

I can't be certain about OSX, but on FreeBSD you can use:

pw add user mymuser -g mygroup -s /nonexistent -h -

the value of - passed to the -h option tells pw to set the password field in master.passwd to *, thus creating a no-login account. Setting the shell isn't strictly necessary, but avoids a shell check from /etc/pw.conf.


Leaving the password field empty for the user in the passwd file will work.


If you are on Ubuntu you can swap in the password for the Ubuntu user in /etc/shadow check out this article:



On Linux I use:

sudo useradd -r -p \* -s /sbin/nologin -c "Comment My Daemon,,,"  -d "/var/uuu"  myuser

The next alternative must be more cross platform (if -r option is not available):

sudo useradd -K UID_MIN=100 -K UID_MAX=499 -K GID_MIN=100 -K GID_MAX=499 -p \* -s /sbin/nologin -c "Comment My Daemon,,,"  -d "/var/uuu"  myuser


  • password in /etc/shadow will be setted to *. Without -p \* it will be !

  • shell will be /sbin/nologin (You can use /bin/false too, but I think the /bin may be mounted too late on some systems). So user can't login

  • -d sets user's homedir


Here -r creates a system user:

This flag is used to create a system account. That is, a user with a UID lower than the value of UID_MIN defined in /etc/login.defs and whose password does not expire. Note that useradd will not create a home directory for such an user, regardless of the default setting in /etc/login.defs. You have to specify -m option if you want a home directory for a system account to be created. This is an option added by Red Hat.

Option -r may not be present on your system. So to create a system user, that is not shown on your login screen, I think, you can use -K option. Something like: -K UID_MIN=100 -K UID_MAX=499. You can try option like:

-K UID_MAX=$(cat /etc/login.defs | grep ^UID_MIN | awk '{print $2}')

to automatically determine you UID_MAX, but I've not tested on OS X. You'll need use SYS_UID_MAX for UID_MIN if it's uncommented in /etc/login.defs

The same is for GID_MAX and GID_MIN for the system group id. (See GID_MIN and if uncommented SYS_GID_MAX in /etc/login.defs to use as GID_MAX)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .