Proper way to add a user account via bash script

Question

Here's the script code I'm using now:

getent group $MYGROUP
if [ $? -ne 0 ] ; then
    sudo su -c "groupadd $MYGROUP"
fi
sudo su -c "useradd mynewuser -p mypassword -m -g $PRIMARYGRP -G $MYGROUP"

This approach works well on openSuse. But there are several problems with the user account it creates on Ubuntu so I am seeking help here.

• the terminal prompt isn't set (echo $PS1 returns nothing)
• the arrow keys and tab key do not work correctly in the terminal
• the password doesn't seem to work (although I'm still unclear exactly what this issue is)
• the /etc/sudoers rights set for this new user are not honored

If instead I manually create the user with adduser (instead of useradd) I don't have these problems on Ubuntu. But I can't use adduser on openSuse (afaik). Therefore, I need a non-Debian-exclusive script or method of adding user accounts via my bash script that works on Ubuntu (and doesn't stop working on other distros).

Finally, I would like to understand the differences between adduser and useradd. For example, I want to know which skeleton directory is used by adduser as that might be the reason useradd isn't working as expected (because I just accepted the default).

Thanks

Solution 1

My solution was provided here: https://unix.stackexchange.com/questions/82923/proper-way-to-add-a-user-account-via-bash-script by Ulrich Schwarz and Joseph R.. The main thing I had to do was add -s /bin/bash to my existing useradd command and remove -p password which expects an encrypted password.

sudo su -c "useradd mynewuser -s /bin/bash -m -g $PRIMARYGRP -G $MYGROUP"

Then do this:

sudo chpasswd << 'END'
mynewuser:password
END

Solution 2

This will work.

sudo adduser myuser --gecos "First Last,RoomNumber,WorkPhone,HomePhone" --disabled-password
echo "myuser:password" | sudo chpasswd

Solution 3

my script which automatically constructs a service account with ssh key login and no password

#add service group/user
addgroup service-runner
useradd devops-service --create-home --shell /bin/bash --groups service-runner
#gpasswd -a devops-service sudo #allowing sudo requires password, and not a good idea for a service account.
mkdir /home/devops-service/.ssh
chmod 700 /home/devops-service/.ssh
cat [email protected] >> /home/devops-service/.ssh/authorized_keys
chown devops-service:devops-service /home/devops-service -R

Comments

[guntbert]

As for the difference: from the useradd man page (man useradd): useradd is a low level utility for adding users. On Debian, administrators should usually use adduser(8) instead.

[enzotib]

Also, sudo su -c "cmd arg1 arg2" is equivalent to sudo cmd arg1 arg2.

[MountainX]

@enzotib thanks. Good to know those are equivalent on Ubuntu because they are not on openSuse. Therefore, I will keep using sudo su -c "cmd arg1 arg2" so that it works everywhere I need it to work.

[enzotib]

adduser is a perl script more than 1000 lines long, so for the differences you can take a look at the script.

[MountainX]

@enzotib Yes, I've been reading adduser but I don't know perl. So that's not a good approach for me.

[enzotib]

Let me doubt that sudo and su work differently on OpenSUSE from their standard.

[MountainX]

@enzotib - please educate me then. I'm slightly confused on this issue.

[h3.]

Now that you've clarified that you're only trying to fix an issue on Ubuntu, the question is on-topic (but marginal). However, you should not post the same question on multiple sites. Your U&L question has been answered, so I'm voting to close here.

[MountainX]

How do I close it myself?

[geirha]

Have you considered using newusers?

[MountainX]

@geirha, yes, newusers would be an option, but this is working for me: unix.stackexchange.com/questions/82923/…

[JasonS]

fyi, after using my script, I see that "sudo" is pretty much useless with the service account, as no password means it can not use sudo. You can configure it to allow no-password sudo via visudo but I don't know how to automate that in a script. Also, probably a service account with no-password sudo isn't a good (security) idea.

[David Foerster]

Why not simply test the existence of adduser with if command -v adduser >/dev/null; then or the likes? That's the only thing that matters and not the underlying distributions. Also, there are other distributions besides Debian/Ubuntu and OpenSUSE.