local-users¶

Local user accounts to create on the machine

A list of local user accounts for the local-users-create task to create or update on Linux or Windows. Accounts that already exist are updated in place.

Each entry accepts:

username (required): the login name.
name: the full name. GECOS on Linux, Full Name on Windows.
password: on Linux a value beginning with $ is applied as a crypt(3) hash, anything else as plain text. Windows accepts plain text only. When omitted, an existing account keeps its password and a new one gets none.
groups: supplementary groups to add the account to. Created if missing on Linux; must already exist on Windows. Existing memberships are kept.
home: the home directory. An existing account whose home differs is moved, contents included. Defaults to the system's choice.
shell: the login shell, Linux only. Defaults to the first of /bin/bash, /usr/bin/bash, /bin/sh found on the host. Always set explicitly, since some distributions default useradd to /sbin/nologin. The task fails if the shell is not executable.

Marked Secure, so the value is encrypted at rest. The task reads it at run time with the job token instead of rendering it into the job script, so passwords are not written to disk on the target.

On Linux, prefer a hash from openssl passwd -6 over plain text; it cannot be replayed if the profile is exposed.

Example:

YAML

local-users:
  - username: operator
    name: Site Operator
    password: "changeme"
    groups:
      - wheel
  - username: monitor
    name: Monitoring Agent
    home: /var/lib/monitor

Objects that Reference local-users¶

Not used in current content packs

Objects used by local-users¶

Not used in current content packs