Users¶
Creates and maintains the host's admin user.
Rune: users - Active when: manage = true - Default: on (user core)
What it deploys¶
- Creates the user with the configured shell and a home directory, appending it to the sudo group (
sudoon Debian/Ubuntu,wheelon RHEL) whensudois set. - Password: applied when set; with no password and
sudoon, passwordless sudo is configured via/etc/sudoers.d/<name>. - SSH keys: merges keys copied from the connecting user's
authorized_keys(root's, in the usual root bootstrap - hencecopy_root_keys) and/or fetched from a GitHub account, deduplicates them, and installs them with correct ownership and modes (plus a~/.ssh/socketsdirectory for multiplexing). - Optionally sets root's shell to match the user's.
Configuration (features.users)¶
| Field | Default | Description |
|---|---|---|
manage |
true |
Manage the user at all |
name |
"core" |
Username (portable filename charset enforced) |
password |
None |
Password; None + sudo => passwordless sudo |
sudo |
true |
Add to the sudo/wheel group |
shell |
"/bin/zsh" |
Shell.BASH, Shell.ZSH, or Shell.ZSH_USER (/usr/bin/zsh) |
copy_root_keys |
true |
Copy the connecting user's authorized_keys |
fetch_key_from_github |
None |
GitHub username whose public keys to import |
set_root_shell_like_user |
true |
Sync root's shell to the user's |
password is redacted in --debug-inventory output.
Keep at least one key source
Nothing rejects manage = true with both copy_root_keys = false and fetch_key_from_github = None.
The user is then created without SSH keys while network security disables password authentication and root login - locking you out of SSH on the next cast.
Interactions¶
- Network security disables SSH password authentication (and root login) when
users.manageis true - keep at least one key source enabled so you can still log in. - Containers adds this user to the
dockergroup. - Shell profiles with
for_user = trueprovisions this user's shell environment. - HAProxy and Xray grant this user ACL access to their config directories.
zsh before the profiles rune
The default shell is zsh, which the base package set installs.
If you disable the base packages, make sure the configured shell exists - server.user does not install it.