Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use apache2-mpm-itk to run one of my web applications with a custom uid and gid, both for audit and security reasons. This works nicely, however I am not sure what kind of privileges this user would need. I am currently doing something like useradd mywebapp -U -d/tmp -c"Custom webapp User" but that creates pretty much a regular user.

So first a newbie question: how do I add a 'system' user that can that cannot be used for e.g. ssh'in or does not appear in the login screen on Ubuntu Desktop?

And what kind of privileges would I need to give this user? E.g. I assume that www-data can write to the Apache log files, so it needs something more than a regular user. But at the same time I don't want to give it more privileges than necessary to run my webapp, definitely not root.

share|improve this question
up vote 2 down vote accepted
sudo useradd username 

will work just fine for your requirement. It creates the user with unset/random password. If you insist on disabling shell access to the user you could change the shell option for this user to /bin/false with commands like

sudo chsh username

As for not showing username in GDM login screen, you need to give the username UID below 1000. This makes Ubuntu treat the user as a system user, which then won't show up on the login screen.

Add the user in whatever way you prefer(maybe just like above), and then run:

sudo usermod -u 599 username

Where 599 is an unused UID below 1000, and username is your new user.

share|improve this answer
Is there a smart way I can detect if a UID has been taken? All of this has to end up in an Ubuntu package. – Jeroen Feb 5 '12 at 3:39
cat /etc/passwd | awk -F: '{print $3}' | sort -n – kaji Feb 5 '12 at 3:41
What would be a smart way to find an unused uid between say 500 and 1000? – Jeroen Feb 5 '12 at 3:56
there is no inbuilt commmand that i know of that will do the job. How about writing your own script for that ! – kaji Feb 5 '12 at 4:07
Alright. But this does not address the permissions issue. The new user won't have permission to write to access.log / error.log , etc... – Jeroen Feb 6 '12 at 3:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.