7

During my application install, I used to create a new group and a new user using the 'groupadd' and 'useradd' commands

groupadd my_group
useradd -r -s /sbin/nologin -g my_group my_user

But in one of the Linux machines, where the LDAP is enabled (the LDAP server is not running on this machine, but it's configured for LDAP client), I find that the 'groupaddanduseradd` commands are adding the group and user into the LDAP and not as local user / group.

I didn't want to add the user/group to LDAP, as I actually needed a local user, who will be owning my applications config file and one of the process will be run using the new user. I don't thing that LDAP user's can be used for chown commands to change the file ownerships.

On googling, I found that there is a luseradd / lgroupadd command which can add the user locally. But this tools are present in only RHEL by default. So on other distros like Ubuntu and SUSE, it' is not present by default and needs to be explicitly installed. So i can not rely on this luseradd/lgroupdadd utilities.

I don't want to manually add the user and group in /etc/group and /etc/passwd file as it is a hack and it involves generating a unique group id and user id for my new group and user.

  1. Is there any other alternative to add a local user which can be used across all linux distros ?

  2. What is the best check to see if my machine is LDAP enabled ? I want to use this check to decide if I have to use useradd/groupadd commands or not.

2
  • For the second question, look into /etc/nsswitch.conf, which should contain a line like passwd: files ldap. And in /etc/pam.d/common-auth the authentication modules should be defined. Additionally, calling getent passwd will show all users from /etc/passwd and LDAP, if enabled.
    – ridgy
    Commented Dec 8, 2016 at 12:34
  • About: I don't thing that LDAP user's can be used for chown commands to change the file ownerships. Users accounts defined in a LDAP directory have the same privileges than users defined in local files. If you observe a different behavior, that might be a bug, or some cache that need to be updated. Non root users need the CAP_CHOWN to change file ownership regardless of where they are defined.
    – jlliagre
    Commented Aug 20, 2018 at 21:31

1 Answer 1

1

If you want to rule out manually editing the passwd and group file with vipw and vigr, respectively, then there's very likely not a method that will work with "all linux distros". But you mentioned Ubuntu and SUSE, which do have ways of doing that. Both Ubuntu and SUSE have 'libuser' in their repositories. You can either install libuser and then use luseradd and lgroupadd, or you can include libuser in your application.

$ sudo apt-get install libuser
3
  • 2
    libuser does not mean "local user". It has a LDAP backend.
    – mattdm
    Commented Nov 27, 2021 at 3:07
  • 1
    You are correct. Thank you for pointing that out. 'luseradd' does not mean "add a local user". Also, the libuser package is Red Hat specific, and appears not to have caught on with other distros, and so should probably be avoided anyway. Commented Nov 30, 2021 at 15:16
  • 1
    Yeah... I checked with some of the current maintainers of the package, and it's definitely not actually an active concern. It's patched and updated for security issues but that's just about it. Unfortunately... this turns out to be weirdly hard and there's not really any great alternatives that I know of either.
    – mattdm
    Commented Dec 1, 2021 at 15:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .