user – Manage user accounts
user – Manage user accounts
Synopsis
- Manage user accounts and user attributes.
- For Windows targets, use the win_user module instead.
Parameters
Parameter | Choices/Defaults | Comments |
---|---|---|
append boolean |
|
If If Mutually exclusive with |
authorization string added in 2.8 |
Sets the authorization of the user. Does nothing when used with other platforms. Can set multiple authorizations using comma separation. To delete all authorizations, use Currently supported on Illumos/Solaris. | |
comment string |
Optionally sets the description (aka GECOS) of user account. | |
create_home boolean |
|
Unless set to Changed from
|
expires float |
An expiry time for the user in epoch, it will be ignored on platforms that do not support this. Currently supported on GNU/Linux, FreeBSD, and DragonFlyBSD. Since Ansible 2.6 you can remove the expiry time specify a negative value. Currently supported on GNU/Linux and FreeBSD. | |
force boolean |
|
This only affects The behavior is the same as When used with |
generate_ssh_key boolean |
|
Whether to generate a SSH key for the user in question. This will not overwrite an existing SSH key unless used with |
group string |
Optionally sets the user's primary group (takes a group name). | |
groups list |
List of groups user will be added to. When set to an empty string Before Ansible 2.3, the only input format allowed was a comma separated string. Mutually exclusive with | |
hidden boolean added in 2.6 |
|
macOS only, optionally hide the user from the login window and system preferences. The default will be |
home path |
Optionally set the user's home directory. | |
local boolean added in 2.4 |
|
Forces the use of "local" command alternatives on platforms that implement it. This is useful in environments that use centralized authentification when you want to manipulate the local users (i.e. it uses This will check This requires that the above commands as well as Mutually exclusive with |
login_class string |
Optionally sets the user's login class, a feature of most BSD OSs. | |
move_home boolean |
|
If set to |
name string / required |
Name of the user to create, remove or modify.
| |
non_unique boolean |
|
Optionally when used with the -u option, this option allows to change the user ID to a non-unique value. |
password string |
Optionally set the user's password to this crypted value. On macOS systems, this value has to be cleartext. Beware of security issues. To create a disabled account on Linux systems, set this to To create a disabled account on OpenBSD, set this to See https://docs.ansible.com/ansible/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module for details on various ways to generate these password values. | |
password_lock boolean added in 2.6 |
|
Lock the password (usermod -L, pw lock, usermod -C). BUT implementation differs on different platforms, this option does not always mean the user cannot login via other methods. This option does not disable the user, only lock the password. Do not change the password in the same task. Currently supported on Linux, FreeBSD, DragonFlyBSD, NetBSD, OpenBSD. |
profile string added in 2.8 |
Sets the profile of the user. Does nothing when used with other platforms. Can set multiple profiles using comma separation. To delete all the profiles, use Currently supported on Illumos/Solaris. | |
remove boolean |
|
This only affects The behavior is the same as |
role string added in 2.8 |
Sets the role of the user. Does nothing when used with other platforms. Can set multiple roles using comma separation. To delete all roles, use Currently supported on Illumos/Solaris. | |
seuser string |
Optionally sets the seuser type (user_u) on selinux enabled systems. | |
shell string |
Optionally set the user's shell. On macOS, before Ansible 2.5, the default shell for non-system users was On other operating systems, the default shell is determined by the underlying tool being used. See Notes for details. | |
skeleton string |
Optionally set a home skeleton directory. Requires | |
ssh_key_bits integer |
Default: "default set by ssh-keygen" |
Optionally specify number of bits in SSH key to create. |
ssh_key_comment string |
Default: "ansible-generated on $HOSTNAME" |
Optionally define the comment for the SSH key. |
ssh_key_file path |
Optionally specify the SSH key filename. If this is a relative filename then it will be relative to the user's home directory. This parameter defaults to .ssh/id_rsa. | |
ssh_key_passphrase string |
Set a passphrase for the SSH key. If no passphrase is provided, the SSH key will default to having no passphrase. | |
ssh_key_type string |
Default: "rsa" |
Optionally specify the type of SSH key to generate. Available SSH key types will depend on implementation present on target host. |
state string |
|
Whether the account should exist or not, taking action if the state is different from what is stated. |
system boolean |
|
When creating an account This setting cannot be changed on existing users. |
uid integer |
Optionally sets the UID of the user. | |
update_password string |
|
|
Notes
Note
- There are specific requirements per platform on user management utilities. However they generally come pre-installed with the system and Ansible will require they are present at runtime. If they are not, a descriptive error message will be shown.
- On SunOS platforms, the shadow file is backed up automatically since this module edits it directly. On other platforms, the shadow file is backed up by the underlying tools used by this module.
- On macOS, this module uses
dscl
to create, modify, and delete accounts.dseditgroup
is used to modify group membership. Accounts are hidden from the login window by modifying/Library/Preferences/com.apple.loginwindow.plist
. - On FreeBSD, this module uses
pw useradd
andchpass
to create,pw usermod
andchpass
to modify,pw userdel
remove,pw lock
to lock, andpw unlock
to unlock accounts. - On all other platforms, this module uses
useradd
to create,usermod
to modify, anduserdel
to remove accounts.
See Also
See also
- authorized_key – Adds or removes an SSH authorized key
- The official documentation on the authorized_key module.
- group – Add or remove groups
- The official documentation on the group module.
- win_user – Manages local Windows user accounts
- The official documentation on the win_user module.
Examples
- name: Add the user 'johnd' with a specific uid and a primary group of 'admin'
user:
name: johnd
comment: John Doe
uid: 1040
group: admin
- name: Add the user 'james' with a bash shell, appending the group 'admins' and 'developers' to the user's groups
user:
name: james
shell: /bin/bash
groups: admins,developers
append: yes
- name: Remove the user 'johnd'
user:
name: johnd
state: absent
remove: yes
- name: Create a 2048-bit SSH key for user jsmith in ~jsmith/.ssh/id_rsa
user:
name: jsmith
generate_ssh_key: yes
ssh_key_bits: 2048
ssh_key_file: .ssh/id_rsa
- name: Added a consultant whose account you want to expire
user:
name: james18
shell: /bin/zsh
groups: developers
expires: 1422403387
- name: Starting at Ansible 2.6, modify user, remove expiry time
user:
name: james18
expires: -1
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key | Returned | Description |
---|---|---|
append boolean |
When state is 'present' and the user exists |
Whether or not to append the user to groups
Sample: True |
comment string |
When user exists |
Comment section from passwd file, usually the user name
Sample: Agent Smith |
create_home boolean |
When user does not exist and not check mode |
Whether or not to create the home directory
Sample: True |
force boolean |
When state is 'absent' and user exists |
Whether or not a user account was forcibly deleted
|
group integer |
When user exists |
Primary user group ID
Sample: 1001 |
groups string |
When groups is not empty and state is 'present'
|
List of groups of which the user is a member
Sample: chrony,apache |
home string |
When state is 'present'
|
Path to user's home directory
Sample: /home/asmith |
move_home boolean |
When state is 'present' and user exists
|
Whether or not to move an existing home directory
|
name string |
always |
User account name
Sample: asmith |
password string |
When state is 'present' and password is not empty
|
Masked value of the password
Sample: NOT_LOGGING_PASSWORD |
remove boolean |
When state is 'absent' and user exists
|
Whether or not to remove the user account
Sample: True |
shell string |
When state is 'present'
|
User login shell
Sample: /bin/bash |
ssh_fingerprint string |
When generate_ssh_key is True
|
Fingerprint of generated SSH key
Sample: 2048 SHA256:aYNHYcyVm87Igh0IMEDMbvW0QDlRQfE0aJugp684ko8 ansible-generated on host (RSA) |
ssh_key_file string |
When generate_ssh_key is True
|
Path to generated SSH private key file
Sample: /home/asmith/.ssh/id_rsa |
ssh_public_key string |
When generate_ssh_key is True
|
Generated SSH public key file
Sample: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC95opt4SPEC06tOYsJQJIuN23BbLMGmYo8ysVZQc4h2DZE9ugbjWWGS1/pweUGjVstgzMkBEeBCByaEf/RJKNecKRPeGd2Bw9DCj/bn5Z6rGfNENKBmo 618mUJBvdlEgea96QGjOwSB7/gmonduC7gsWDMNcOdSE3wJMTim4lddiBx4RgC9yXsJ6Tkz9BHD73MXPpT5ETnse+A3fw3IGVSjaueVnlUyUmOBf7fzmZbhlFVXf2Zi2rFTXqvbdGHKkzpw1U8eB8xFPP7y d5u1u0e6Acju/8aZ/l17IDFiLke5IzlqIMRTEbDwLNeO84YQKWTm9fODHzhYe0yvxqLiK07 ansible-generated on host' |
stderr string |
When stderr is returned by a command that is run |
Standard error from running commands
Sample: Group wheels does not exist |
stdout string |
When standard output is returned by the command that is run |
Standard output from running commands
|
system boolean |
When system is passed to the module and the account does not exist
|
Whether or not the account is a system account
Sample: True |
uid integer |
When UID is passed to the module
|
User ID of the user account
Sample: 1044 |
Status
- This module is guaranteed to have backward compatible interface changes going forward. [stableinterface]
- This module is maintained by the Ansible Core Team. [core]
Red Hat Support
More information about Red Hat’s support of this module is available from this Red Hat Knowledge Base article.
Authors
- Stephen Fromm (@sfromm)
© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.9/modules/user_module.html