In Linux distributions, some packages create user accounts.

How can I determine which package created a given user?

I want to know specifically for Fedora and Ubuntu, but answers for other distributions are welcome.


On Debian-based systems (including Ubuntu), packages create users using maintainer scripts, usually postinst. Therefore one way could be to grep through these scripts:

grep -R --include='*.postinst' -e useradd -e adduser /var/lib/dpkg/info/

This assumes, of course, that the postinst script hasn't been deleted (either manually or because you uninstalled the package in question).

Debian policy seems to favour postinst:

[Y]ou must arrange for your package to create the user or group if necessary using adduser in the preinst or postinst script (again, the latter is to be preferred if it is possible).

The package maintainer can use preinst as well, as long as adduser is a pre-dependency.

The policy also leads us to the other source of accounts: the base-passwd package, as it states in the preceding paragraph:

If you need a statically allocated id, you must ask for a user or group id from the base-passwd maintainer, and must not release the package until you have been allocated one. Once you have been allocated one you must either make the package depend on a version of the base-passwd package with the id present in /etc/passwd or /etc/group, or arrange for your package to create the user or group itself with the correct id (using adduser) in its preinst or postinst. (Doing it in the postinst is to be preferred if it is possible, otherwise a pre-dependency will be needed on the adduser package.)

The base-passwd documentation (/usr/share/doc/base-passwd/users-and-groups.txt.gz or /usr/share/doc/base-passwd/users-and-groups.html) says:

The Debian base-passwd package contains the master versions of /etc/passwd and
/etc/group. The update-passwd tool keeps the entries in these master files in
sync on all Debian systems. They comprise only "global static" ids: that is,
those which are reserved globally for the benefit of packages which need to
include files owned by those users or groups, or need the ids compiled into

The users/groups included are (grepped out from /usr/share/doc/base-passwd/users-and-groups.txt.gz):

Users (usually with corresponding groups)

root    man     majordom    irc         gdm
daemon  lp      postgres    gnats       saned
bin     mail    www-data    nobody      klog
sys     news    backup      messagebus  syslog
sync    uucp    operator    postfix
games   proxy   list        haldaemon

Groups (without corresponding users)

adm     fax     audio       staff       sshd
tty     voice   src         users       fetchmail
disk    cdrom   shadow      lpadmin     cupsys
kmem    floppy  utmp        sasl        nogroup
dialout tape    video       scanner
dip     sudo    plugdev     ssh

The package README (/usr/share/doc/base-passwd/README) also lists out some users with UIDs in the 60000-64999 range, and states that these are created by the respective packages.

  • Is it guaranteed that such users would only be added in a postinst? – Faheem Mitha Jan 22 '15 at 16:12
  • @FaheemMitha no, nothing prevents then from using preinst, but there's no reason to and Debian policy seems to be to use postinst. – muru Jan 22 '15 at 17:34
  • Ok, in that case a comment about Debian policy would be in order, I think. It is good to quote policy and people don't do so often enough, I think. – Faheem Mitha Jan 22 '15 at 20:34
  • @FaheemMitha perhaps a link to this question? – muru Jan 22 '15 at 20:41
  • 1
    Looks good. But since I already upvoted, I can't upvote again. :-) – Faheem Mitha Jan 22 '15 at 22:49

AFAIK there is no native package manager function that creates (or removes) those functional /system users but that is done in a custom pre- or post-install script sections in RPM packages.

Typically the RPM package will create and claim ownership of the home directory of those users e.g. the httpd package creates the user apache and the home directory of the apache user is owned by the httpd package, allowing a round-about way of finding the package:

rpm -qf /var/www

You can verify if indeed the httpd package could have created the apache user with:

rpm -q --scripts httpd
  • This works if the home directory exists. It doesn't always, e.g. there is an adm user on a Fedora host I'm examining whose home directory, /var/adm, does not exist. Still I need to know whether any Fedora package ever created or still uses that user. – reinierpost Jan 22 '15 at 14:07
  • Since the users are created in the script section of RPM files, you can query all of those scripts at once: rpm -q --all --scripts | grep useradd which is quite speedy, but doesn't provide really helpful results in regard which specific rpm created the user. – HBruijn Jan 22 '15 at 14:27
  • I just wrote a Perl script that does this and greps the output. It appears to be quite effective. – reinierpost Jan 22 '15 at 16:58

I use Gentoo, So i would extract the 5th field of /etc/passwd to find the info:

cat /etc/passwd | grep cron | gawk -F: '{print $5}'

added by portage for cronbase

Portage is package management system for Gentoo. So cron account is created by portage for the package cronbase.

  • This can be simplified into a single command, gawk -F: '/code/ {print $5}' /etc/passwd – roaima Jul 19 '20 at 7:09

Warning: This is a crude way and may not work for all the users created by packages.

Most of the packages that create users will be creating those user's home directories outside /home and most times their home directories will be part of the package. In such cases, you can rpm -qf such users home directory and find out the package.

User ntp

[root@secapp01 ~]# grep ntp /etc/passwd
[root@secapp01 ~]# rpm -qf /etc/ntp

User postfix

[root@secapp01 ~]# grep postfix /etc/passwd
[root@secapp01 ~]# rpm -qf /var/spool/postfix
  • I thought of this; it works, but only if the home directory exists, which is not always the case on the host I need this for. – reinierpost Jan 22 '15 at 14:00

For systems using rpm, this will list all package that use useradd on their script

rpm -qa | xargs -n1 -I % sh -c 'echo %; rpm -q --scripts % | grep useradd' | grep useradd -B 1

With the same command we can search the targeted user by replacing useradd on the command with the searched user...

Important note here, many packages/applications create their user when they are ran, so this command won't identify their user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.