In Linux distributions, some packages create user accounts.
How can I determine which package created a given user?
I want to know specifically for Fedora and Ubuntu, but answers for other distributions are welcome.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
On Debian-based systems (including Ubuntu), packages create users using maintainer scripts, usually
postinst. Therefore one way could be to grep through these scripts:
grep -R --include='*.postinst' -e useradd -e adduser /var/lib/dpkg/info/
This assumes, of course, that the
postinst script hasn't been deleted (either manually or because you uninstalled the package in question).
Debian policy seems to favour
[Y]ou must arrange for your package to create the user or group if necessary using
postinstscript (again, the latter is to be preferred if it is possible).
The package maintainer can use
preinst as well, as long as
adduser is a pre-dependency.
The policy also leads us to the other source of accounts: the
base-passwd package, as it states in the preceding paragraph:
If you need a statically allocated id, you must ask for a user or group id from the
base-passwdmaintainer, and must not release the package until you have been allocated one. Once you have been allocated one you must either make the package depend on a version of the
base-passwdpackage with the id present in
/etc/group, or arrange for your package to create the user or group itself with the correct id (using
adduser) in its
postinst. (Doing it in the
postinstis to be preferred if it is possible, otherwise a pre-dependency will be needed on the adduser package.)
base-passwd documentation (
The Debian base-passwd package contains the master versions of /etc/passwd and /etc/group. The update-passwd tool keeps the entries in these master files in sync on all Debian systems. They comprise only "global static" ids: that is, those which are reserved globally for the benefit of packages which need to include files owned by those users or groups, or need the ids compiled into binaries.
The users/groups included are (grepped out from
root man majordom irc gdm daemon lp postgres gnats saned bin mail www-data nobody klog sys news backup messagebus syslog sync uucp operator postfix games proxy list haldaemon
adm fax audio staff sshd tty voice src users fetchmail disk cdrom shadow lpadmin cupsys kmem floppy utmp sasl nogroup dialout tape video scanner dip sudo plugdev ssh
The package README (
/usr/share/doc/base-passwd/README) also lists out some users with UIDs in the 60000-64999 range, and states that these are created by the respective packages.
AFAIK there is no native package manager function that creates (or removes) those functional /system users but that is done in a custom pre- or post-install script sections in RPM packages.
Typically the RPM package will create and claim ownership of the home directory of those users e.g. the
httpd package creates the user apache and the home directory of the apache user is owned by the httpd package, allowing a round-about way of finding the package:
rpm -qf /var/www
You can verify if indeed the httpd package could have created the apache user with:
rpm -q --scripts httpd
Warning: This is a crude way and may not work for all the users created by packages.
Most of the packages that create users will be creating those user's home directories outside /home and most times their home directories will be part of the package. In such cases, you can
rpm -qf such users home directory and find out the package.
[root@secapp01 ~]# grep ntp /etc/passwd ntp:x:38:38::/etc/ntp:/sbin/nologin [root@secapp01 ~]# rpm -qf /etc/ntp ntpdate-4.2.6p5-1.el6.x86_64
[root@secapp01 ~]# grep postfix /etc/passwd postfix:x:89:89::/var/spool/postfix:/sbin/nologin [root@secapp01 ~]# rpm -qf /var/spool/postfix postfix-2.6.6-6.el6_5.x86_64
For systems using rpm, this will list all package that use
useradd on their script
rpm -qa | xargs -n1 -I % sh -c 'echo %; rpm -q --scripts % | grep useradd' | grep useradd -B 1
With the same command we can search the targeted user by replacing
useradd on the command with the searched user...
Important note here, many packages/applications create their user when they are ran, so this command won't identify their user.