I started using puppet for managing our RHEL servers. At this point I try to setup the user management. We are running a NIS environment on our campus, so until now I added the line +testuser::::: to the /etc/passwd file which then received the user information over NIS. What I want to achieve is that I have a set of admin users (admin1, admin2 and admin3) which can log in to every machine and a set of users (user1, user2 and user3) which are different on every machines. At the end of the passwd file I need an entry line +::::::/sbin/nologin to have all users information available but grant no access to them.

So /etc/passwd on one machine would look like


and on an other machine


Because the admin users are rather static but the normal users vary from system to system, I thought to declare the admin users in a module and the normal users on a per node basis.

My first problem is, how to edit the /etc/passwd file to add the lines. Furthermore it's important that the sorting is correct, so that the nologin line is at the end. Do you have any idea how to achieve this in a flexible manner?

Thanks and regards


Puppet will edit /etc/passwd on its own accord, when you add user resources to your manifest, such as

user {
        ensure => present,
        uid => 1003,
        password => '$6$...',

Ordering of existing lines will be tricky at best. Puppet natively does not support anything like that. My advice would be to use an exec resource like this:

exec {
        unless => '/script/that/returns-true-if-nologins-line-is-currently-at-the-end'

You would want Puppet to perform that after syncing all user resources to your system. There are different ways to go about that, all with their pros and cons.

Assuming your manifests are not too complex, you can likely get away with global defaults for the user type.

User { before => Exec['/path/to/script-that-moves-nologin-line-to-the-end'] }

Just be careful that no user resources overwrites this with a different before value.

Other alternatives include

  • overriding the the before value of all existing user resources with a resource collector
  • run stages
  • gathering your user resources in few classes and just add require => Class[...] to the exec

Among others that are probably conceivable.

  • The problem remains on how to add the +user1:::::: lines into /etc/passwd. I thought there might be a way to do it with puppet rather than an external bash script. I was also looking at augeas, but it can't deal with the preceded + sign. So you would add and sort the lines in /etc/passwd using a bash script? If this would be possible to do with puppet, another nice thing to have would be a file with all the admin users which I could reference in the manifest and easily edit if anything changes. – fetch101 Aug 5 '14 at 11:00
  • Oh, I wasn't reading thoroughly enough. I guess the user type cannot currently handle that. You could open a feature request for that, I suppose. As for handling configuration data in files outside the manifest - you can use an ENC or Hiera for that. – Felix Frank Aug 5 '14 at 13:05

There is a function in the latest version of stdlib - (https://forge.puppetlabs.com/puppetlabs/stdlib) - called 'file_line', which may help you achieve what you are aiming to do:

I've not tested this, but the resource would likely look something like this:

file_line { 'nis_admin_users':
  path  => '/etc/passwd',
  line  => '+::::::/sbin/nologin',

However, I'm not sure how to ensure that the line is placed right at the bottom, since you mention that the ordering does matter. Is it likely that the original file would contain a similar line already? If so, you could use the additional optional parameter to file_line called 'match', and craft a regex to match on.

Alternately, look at using augues rather -> http://projects.puppetlabs.com/projects/1/wiki/puppet_augeas#Using+Puppet+with+Augeas

  • 1
    I have looked at the file_line function, which might me useful to insert lines. Unfortunately augeas can't handle the + signs in the passwd file. – fetch101 Aug 8 '14 at 15:17
  • Ah, didn't realise that augeas had that limitation :-/ – Andrew Aug 9 '14 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.