Can someone explain the purpose, and benefits, of having an additional and separate extrausers user database in certain Linux systems (such as in Debian or in Ubuntu Core)? Why is not the standard /etc/{group,passwd,shadow} enough?

  • Please tell, where these extrausers are? Nov 5, 2018 at 13:46
  • Normally located at /var/lib/extrausers/{group,passwd,shadow}.
    – Ess
    Nov 6, 2018 at 11:28
  • I don't have it. Nov 6, 2018 at 21:39

2 Answers 2


Debian's libnss-extrausers package makes it very easy to combine users and groups from two sources:

I use my private home PC and laptop regularly to remotely mount file systems from the sec=krb5 NFS file server of my university department. In order to see and use in commands like ls -l, groups, chgrp, cd ~user/, etc. the user and group identifiers associated with files, these need to be listed in the local getent/nsswitch database. I have my private family-member users in /etc/passwd. I don't want to use LDAP on a private home PC or laptop, as this would cause inconvenient delays when the LDAP server is not reachable (when the VPN to the university department is down). So I simply use a script that regularly copies all users and groups in the department's LDAP server in /var/lib/extrausers/{group,password} on my private machines.

The /var/lib/extrausers/ mechanism makes this extremely convenient: my script can simply overwrite all files in there, without having to modify /etc/{group,passwd} and having to keep track where which entry in there came from. I could even maintain these extra users and groups there via an automatically updated deb package.

I'm currently looking for a similar solution for macOS, and I wish it too had /var/lib/extrausers. Any suggestions?


Well it can be usefull when you want to mix "manualy" maintened passwd files an automated deployment of "immutables" local users with tools like chef/puppet/ansible for exemple (there are other way yes).

  • There is a better explanation in Debian bug #791661.
    – JdeBP
    Nov 5, 2018 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.