Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i have a few java apps running on my server and I set it up so that each app is executed with a nologin user id.

now, when I add users with

/usr/sbin/useradd -g $MY_GROUP -s /sbin/nologin -d /home/$MY_USER $MY_USER

I was wondering if there is a convention on whether those users need a home at all and if they do - should I put them into

/home/abc

or into

/usr/local/abc

I've seen it done both ways

share|improve this question

2 Answers 2

up vote 3 down vote accepted

On RedHat like systems you can create the users as system accounts using the ‘-r’ option:

   -r This flag is used to create a system account. That is, a user with a UID lower than the value of UID_MIN defined in
      /etc/login.defs and whose password does not expire. Note that useradd will not create a home directory for such an user,
      regardless of the default setting in /etc/login.defs. You have to specify -m option if you want a home directory for a system
      account to be created. This is an option added by Red Hat

Depending on whether this option is available on your distro, this may be what you want.

share|improve this answer
3  
Debian adduser has a similar --system option –  theotherreceive Aug 19 '09 at 3:38

As a systems administrator, I prefer that all my stub accounts use / as their home directory unless I have a compelling reason to have a real home directory.

The home directory can store authentication information. For instance, the .ssh/authorized_keys files can act as a vector to allow people onto the system unintentionally or maliciously.

Otherwise, the home directory may be useful if you plan on suing to another UID and plan on having local configurations for when doing stuff as that user (I've seen this with oracle setups). I'm not keen on that sort of thing -- I prefer to just have a script that I source that sets up the local environment for me, but different strokes...

share|improve this answer
    
It doesn't matter unless someone replaces /sbin/nologin with a bash shell. The nologin shell will refuse the user everytime, even if the login is successful. –  David Rickman Aug 18 '09 at 19:27
1  
There are other things you can do with a home directory such as modify the .forward file to spawn a program that does something when the user gets mail. Many security flaws rely on several weaknesses combining. A stub user's home directory is such a feature that can weaken security, often needlessly because those stub homedirs simply don't do anything. –  chris Aug 18 '09 at 19:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.