6

During my application install, I used to create a new group and a new user using the 'groupadd' and 'useradd' commands

groupadd my_group
useradd -r -s /sbin/nologin -g my_group my_user

But in one of the Linux machines, where the LDAP is enabled (the LDAP server is not running on this machine, but it's configured for LDAP client), I find that the 'groupaddanduseradd` commands are adding the group and user into the LDAP and not as local user / group.

I didn't want to add the user/group to LDAP, as I actually needed a local user, who will be owning my applications config file and one of the process will be run using the new user. I don't thing that LDAP user's can be used for chown commands to change the file ownerships.

On googling, I found that there is a luseradd / lgroupadd command which can add the user locally. But this tools are present in only RHEL by default. So on other distros like Ubuntu and SUSE, it' is not present by default and needs to be explicitly installed. So i can not rely on this luseradd/lgroupdadd utilities.

I don't want to manually add the user and group in /etc/group and /etc/passwd file as it is a hack and it involves generating a unique group id and user id for my new group and user.

  1. Is there any other alternative to add a local user which can be used across all linux distros ?

  2. What is the best check to see if my machine is LDAP enabled ? I want to use this check to decide if I have to use useradd/groupadd commands or not.

  • For the second question, look into /etc/nsswitch.conf, which should contain a line like passwd: files ldap. And in /etc/pam.d/common-auth the authentication modules should be defined. Additionally, calling getent passwd will show all users from /etc/passwd and LDAP, if enabled. – ridgy Dec 8 '16 at 12:34
  • About: I don't thing that LDAP user's can be used for chown commands to change the file ownerships. Users accounts defined in a LDAP directory have the same privileges than users defined in local files. If you observe a different behavior, that might be a bug, or some cache that need to be updated. Non root users need the CAP_CHOWN to change file ownership regardless of where they are defined. – jlliagre Aug 20 '18 at 21:31
1

If you want to rule out manually editing the passwd and group file with vipw and vigr, respectively, then there's very likely not a method that will work with "all linux distros". But you mentioned Ubuntu and SUSE, which do have ways of doing that. Both Ubuntu and SUSE have 'libuser' in their repositories. You can either install libuser and then use luseradd and lgroupadd, or you can include libuser in your application.

$ sudo apt-get install libuser

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.