14

It is suspected that some packages have scripts run at install time which create user accounts in /etc/passwd. How can I check which package created a specific user?

16

This will work reasonably reliably if the package was installed via dpkg (including with apt install). See muru's answer for a list of users created in the default Ubuntu installation and the package that creates them. For those users, this method will not produce any output.

You can use the command:

grep -RlE '(adduser|useradd).*systemd' /var/lib/dpkg/info --include='*inst' | sed -r 's:.*/(.*)\.[-a-z]+inst:\1:'

replace <user> with the name of the user you are interested in, for example, systemd

This searches the preinst and postinst scripts of all packages known to dpkg for the adduser or useradd command and the user in question, to see which package is responsible for creating that user. The result is piped to sed so it returns only the package name itself instead of the full name of the script file.

Explanation

  • grep -RlE search recursively and print only the names of files containing matches, use extended regular expressions
  • '(adduser|useradd).*<user>' /var/lib/dpkg/info --include='*inst' search for the adduser or useradd command and the user you want to find on the same line (.* will match any characters between them, catching any command options) in the directory where dpkg stores scripts, in files whose names end with inst
  • sed -r 's:.*/(.*)\.[-a-z]+inst:\1:' strip off everything before & including the last / in the full path and the .preinst or .postinst extension

Thanks to @muru for suggesting a neater and faster way of searching than using find here :)

  • You should check for preinst as well since there are some packages creating users in that script. But I get the idea so I'll accept it. – Cyker Dec 5 '16 at 10:22
  • @Cyker Yeah thanks :) I will edit... I'm looking into it now to see if I can catch them all – Zanna Dec 5 '16 at 10:23
  • grep -Rl 'adduser.*<user>' /var/lib/dpkg/info --include='*inst' to simplify the find -exec grepthing. – muru Dec 5 '16 at 10:40
  • thanks @muru that is awesome... (now I just need basename -s to accept wildcards/regex...) so I can make it chop off the pre AND post inst suffixes (but I didn't find any preinst scripts with adduser so shrug) – Zanna Dec 5 '16 at 10:59
  • @Zanna the Debian Policy recommends postinst, so it's unlikely you'd find any that uses preinst (but I suppose the rare case might exist). – muru Dec 5 '16 at 11:08
15

There is an important exception to the usual adduser-added users and groups here: the ones that come with Ubuntu by default. These are provided by the base-passwd package. A list of users and groups added by this package is given (and described) in /usr/share/doc/base-passwd/users-and-groups.{html,txt.gz}. The list is:

Users (usually with corresponding groups)

root    man     majordom    irc         gdm
daemon  lp      postgres    gnats       saned
bin     mail    www-data    nobody      klog
sys     news    backup      messagebus  syslog
sync    uucp    operator    postfix
games   proxy   list        haldaemon

Groups (without corresponding users)

adm     fax     audio       staff       sshd
tty     voice   src         users       fetchmail
disk    cdrom   shadow      lpadmin     cupsys
kmem    floppy  utmp        sasl        nogroup
dialout tape    video       scanner
dip     sudo    plugdev     ssh

The package README (/usr/share/doc/base-passwd/README) also lists out some users with UIDs in the 60000-64999 range, and states that these are created by the respective packages.

Also see:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.