# man > ADDUSER(8) [_ADDUSER_(8)](https://www.chedong.com/phpMan.php/man/ADDUSER/8/markdown) System Manager's Manual [_ADDUSER_(8)](https://www.chedong.com/phpMan.php/man/ADDUSER/8/markdown) ## NAME adduser, addgroup - add or manipulate users or groups ## SYNOPSIS **adduser **[**--add-extra-groups**] [**--allow-all-names**] [**--allow-bad-names**] [**--comment _**comment_] [**--conf _**file_] [**--debug**] [**--disabled-login**] [**--disabled-password**] [**--encrypt-home**] [**--firstgid _**id_] [**--firstuid _**id_] [**--gid _**id_] [**--home _**dir_] [**--ingroup _**group_] [**--lastgid _**id_] [**--lastuid _**id_] [**--no-create-home**] [**--shell _**shell_] [**--quiet**] [**--uid _**id_] [**--verbose**] [**--stdoutmsglevel _**prio_] [**--stderrmsglevel _**prio_] [**--logmsglevel _**prio_] **user** **adduser --system **[**--comment _**comment_] [**--conf _**file_] [**--debug**] [**--gid _**id_] [**--group**] [**--home _**dir_] [**--ingroup _**group_] [**--no-create-home**] [**--shell _**shell_] [**--uid _**id_] [**--quiet**] [**--verbose**] [**--stdoutmsglevel _**prio_] [**--stderrmsglevel _**prio_] [**--logmsglevel _**prio_] **user** **adduser --group **[**--conf _**file_] [**--debug**] [**--firstgid _**id_] [**--gid _**ID_] [**--lastgid _**id_] [**--quiet**] [**--verbose**] [**--stdoutmsglevel _**prio_] [**--stderrmsglevel _**prio_] [**--logmsglevel _**prio_] **group** **addgroup **[**--conf _**file_] [**--debug**] [**--firstgid _**id_] [**--gid _**ID_] [**--lastgid _**id_] [**--quiet**] [**--verbose**] [**--stdoutmsglevel _**prio_] [**--stderrmsglevel _**prio_] [**--logmsglevel _**prio_] **group** **addgroup --system **[**--gid _**id_] [**--conf _**file_] [**--quiet**] [**--verbose**] [**--stdoutmsglevel _**prio_] [**--stderrmsglevel _**prio_] [**--logmsglevel _**prio_] **group** **adduser **[**--conf _**file_] [**--debug**] [**--quiet**] [**--verbose**] [**--stdoutmsglevel _**prio_] [**--stderrmsglevel _**prio_] [**--logmsglevel _**prio_] **user group** ### adduser --help ### adduser --version ## DESCRIPTION **adduser **and **addgroup **add users and groups to the system according to command line options and configuration information in _/etc/adduser.conf_. They are friendlier front ends to the low level tools like **useradd**, **groupadd **and **usermod **programs, by default choosing Debian policy conformant UID and GID values, creating a home directory with skeletal configuration, running a custom script, and other features. **adduser **and **addgroup **are intended as a policy layer, making it easier for package maintainers and local administrators to create local system accounts in the way Debian expects them to be created, taking the burden to adapt to the probably changing specifications of Debian policy. **adduser --system **takes special attention on just needing a single call in the package main‐ tainer scripts without any conditional wrappers, error suppression or other scaffolding. **adduser **honors the distinction between _dynamically_ _allocated_ _system_ _users_ _and_ _groups_ and _dy‐_ _namically_ _allocated_ _user_ _accounts_ that is documented in Debian Policy, Chapter 9.2.2. For a full list and explanations of all options, see the OPTIONS section. **adduser **and **addgroup **can be run in one of five modes: ### Add a normal user If called with one non-option argument and without the **--system **or **--group **options, **adduser** will add a normal user, that means a _dynamically_ _allocated_ _user_ _account_ in the sense of De‐ bian Policy. This is commonly referred to in **adduser **as a _non-system_ _user._ **adduser **will choose the first available UID from the range specified by **FIRST_UID **and **LAST_UID **in the configuration file. The range may be overridden with the **--firstuid **and **--lastuid **options. Finally, the UID can be set fully manually with the **--uid **option. By default, each user is given a corresponding group with the same name. This is commonly called _Usergroups_ and allows group writable directories to be easily maintained by placing the appropriate users in the new group, setting the set-group-ID bit in the directory, and ensuring that all users use a umask of 002. For a usergroup, **adduser **will choose the first available GID from the range specified by **FIRST_GID **and **LAST_GID **in the configuration file. The range may be overridden with the **--firstgid **and **--lastgid **options. Finally, the GID can be set fully manually with the **--gid** option. The interaction between **USERS_GID**, **USERS_GROUP**, and **USERGROUPS **is explained in detail in **ad‐** [**duser.conf**(5)](https://www.chedong.com/phpMan.php/man/duser.conf/5/markdown). Users' primary groups can also be overridden from the command line with the **--gid **or **--in‐** **group **options to set the group by id or name, respectively. Also, users can be added to one or more supplemental groups defined as **EXTRA_GROUPS **in the configuration file either by set‐ ting **ADD_EXTRA_GROUPS **to 1 in the configuration file, or by passing **--add-extra-groups **on the command line. **adduser **will copy files from _/etc/skel_ into the home directory and prompt for the comment field and a password if those functions have not been turned off / overridden from the com‐ mand line. UID, comment, home directory and shell might be pre-determined with the **UID_POOL **and **GID_POOL** option, documented in [**adduser.conf**(5)](https://www.chedong.com/phpMan.php/man/adduser.conf/5/markdown). To set up an encrypted home directory for the new user, add the **--encrypt-home **option. For more information, refer to the -b option of [**ecryptfs-setup-private(1)](https://www.chedong.com/phpMan.php/man/ecryptfs-setup-private/1/markdown).** ### Add a system user If called with one non-option argument and the **--system **option, **adduser **will add a _dynami‐_ _cally_ _allocated_ _system_ _user,_ often abbreviated as _system_ _user_ in the context of the **adduser** package. **adduser **will choose the first available UID from the range specified by **FIRST_SYSTEM_UID **and **LAST_SYSTEM_UID **in the configuration file. This can be overridden with the **--uid **option. By default, system users are placed in the **nogroup **group. To place the new system user in an already existing group, use the **--gid **or **--ingroup **options. If the **--group **is given and the identically named group does not already exist, it is created with the same ID. If no home directory is specified, the default home directory for a new system user is _/nonexistent_. This directory should never exist on any Debian system, and **adduser **will never create it automatically. Unless a shell is explicitly set with the **--shell **option, the new system user will have the shell set to _/usr/sbin/nologin_. **adduser --system **does not set a password for the new ac‐ count. Skeletal configuration files are not copied. Other options will behave as for the creation of a normal user. The files referenced by **UID_POOL **and **GID_POOL **do also work. ### Add a group If **adduser **is called with the **--group **option and without the **--system **option, or **addgroup **is called respectively, a user group will be added. A _dynamically_ _allocated_ _system_ _group,_ often abbreviated as _system_ _group_ in the context of the **adduser **package, will be created if **adduser **is called with the **--system **option. A GID will be chosen from the respective range specified for GIDs in the configuration file (**FIRST_GID**, **LAST_GID**, **FIRST_SYSTEM_GID**, **LAST_SYSTEM_GID**). To override that mechanism, you can give the GID using the **--gid **option. For non-system groups, the range specified in the configuration file may be overridden with the **--firstgid **and **--lastgid **options. The group is created with no members. ### Add an existing user to an existing group If called with two non-option arguments, **adduser **will add an existing user to an existing group. ## OPTIONS Different modes of **adduser **allow different options. If no valid modes are listed for a op‐ tion, it is accepted in all modes. Short versions for certain options may exist for historical reasons. They are going to stay supported, but are removed from the documentation. Users are advised to migrate to the long version of options. ### --add-extra-groups Add new user to extra groups defined in the configuration files' **EXTRA_GROUPS **setting. The old spelling **--add_extra_groups **is deprecated and will be supported in Debian bookworm only. Valid Modes: **adduser**, **adduser --system**. ### --allow-all-names Allow any user- and groupname which is supported by the underlying [**useradd**(8)](https://www.chedong.com/phpMan.php/man/useradd/8/markdown), includ‐ ing names containing non-ASCII characters. See VALID NAMES in [**adduser.conf**(5)](https://www.chedong.com/phpMan.php/man/adduser.conf/5/markdown). Valid Modes: **adduser**, **adduser --system**, **addgroup**, **addgroup --system**. ### --allow-bad-names Disable **NAME_REGEX **and **SYS_NAME_REGEX **check of names. Only a weaker check for valid‐ ity of the name is applied. See VALID NAMES in [**adduser.conf**(5)](https://www.chedong.com/phpMan.php/man/adduser.conf/5/markdown). Valid Modes: **ad‐** **duser**, **adduser --system**, **addgroup**, **addgroup --system**. **--comment _**comment_ Set the comment field for the new entry generated. **adduser **will not ask for the in‐ formation if this option is given. This field is also known under the name GECOS field and contains information that is used by the [**finger**(1)](https://www.chedong.com/phpMan.php/man/finger/1/markdown) command. This used to be the **--gecos **option, which is deprecated and will be removed after Debian bookworm. Valid Modes: **adduser**, **adduser --system**. **--conf _**file_ Use _file_ instead of _/etc/adduser.conf_. Multiple **--conf **options can be given. ### --debug Synonymous to --stdoutmsglevel=debug. Deprecated. ### --disabled-login ### --disabled-password Do not run [**passwd**(1)](https://www.chedong.com/phpMan.php/man/passwd/1/markdown) to set a password. In most situations, logins are still possible though (for example using SSH keys or through PAM) for reasons that are beyond **ad‐** **duser**'s scope. **--disabled-login **will additionally set the shell to _/usr/sbin/nologin_. Valid Mode: **adduser**. **--firstuid _**ID_ **--lastuid _**ID_ **--firstgid _**ID_ **--lastgid _**ID_ Override the first UID / last UID / first GID / last GID in the range that the uid is chosen from (**FIRST_UID**, **LAST_UID**, **FIRST_GID **and **LAST_GID**, **FIRST_SYSTEM_UID**, **LAST_SYS‐** **TEM_UID**, **FIRST_SYSTEM_GID **and **LAST_SYSTEM_GID **in the configuration file). If a group is created as a usergroup, **--firstgid **and **--lastgid **are ignored. The group gets the same ID as the user. Valid Modes: **adduser**, **adduser --system**, for **--firstgid **and **--lastgid **also **addgroup**. ### --force-badname ### --allow-badname These are the deprecated forms of **--allow-bad-names**. It will be removed during the release cycle of the Debian release after _bookworm_. ### --extrausers Uses extra users as the database. **--gid _**ID_ When creating a group, this option sets the group ID number of the new group to _GID_. When creating a user, this option sets the primary group ID number of the new user to _GID_. Valid Modes: **adduser**, **adduser --system**, **addgroup**, **addgroup --system**. ### --group Using this option in **adduser --system **indicates that the new user should get an iden‐ tically named group as its primary group. If that identically named group is not al‐ ready present, it is created. If not combined with **--system**, a group with the given name is created. The latter is the default action if the program is invoked as **ad‐** **dgroup**. Valid Modes: **adduser --system**, **addgroup**, **addgroup --system**. **--help **Display brief instructions. **--home _**dir_ Use _dir_ as the user's home directory, rather than the default specified by the config‐ uration file (or _/nonexistent_ if **adduser --system **is used). If the directory does not exist, it is created. Valid Modes: **adduser**, **adduser --system**. **--ingroup _**GROUP_ When creating a user, this option sets the primary group ID number of the new user to the GID of the named group. Unlike with the **--gid **option, the group is specified here by name rather than by numeric ID number. The group must already exist. Valid Modes: **adduser**, **adduser --system**. **--lastuid _**ID_ **--lastgid _**ID_ Override the last UID / last GID. See **--firstuid**. ### --no-create-home Do not create a home directory for the new user. Note that the pathname for the new user's home directory will still be entered in the appropriate field in the _/etc/passwd_ file. The use of this option does not imply that this field should be empty. Rather, it indicates to **adduser **that some other mechanism will be responsible for initializing the new user's home directory. Valid Modes: **adduser**, **adduser --sys‐** **tem**. ### --quiet Synonymous to --stdoutmsglevel=warn. Deprecated. **--shell _**shell_ Use _shell_ as the user's login shell, rather than the default specified by the configu‐ ration file (or _/usr/sbin/nologin_ if **adduser --system **is used). Valid Modes: **adduser**, **adduser --system**. ### --system Nomally, **adduser **creates _dynamically_ _allocated_ _user_ _accounts_ _and_ _groups_ as defined in Debian Policy, Chapter 9.2.2. With this option, **adduser **creates a _dynamically_ _allo‐_ _cated_ _system_ _user_ _and_ _group_ and changes its mode respectively. Valid Modes: **adduser**, **addgroup**. **--uid _**ID_ Force the new userid to be the given number. **adduser **will fail if the userid is al‐ ready taken. Valid Modes: **adduser**, **adduser --system**. ### --verbose Synonymous to --stdoutmsglevel=info. Deprecated. **--stdoutmsglevel _**prio_ **--stderrmsglevel _**prio_ **--logmsglevel _**prio_ Minimum priority for messages logged to syslog/journal and the console, respectively. Values are _trace_, _debug_, _info_, _warn_, _err_, and _fatal_. Messages with the priority set here or higher get printed to the respective medium. Messages printed to stderr are not repeated on stdout. That allows the local admin to control **adduser**'s chattiness on the console and in the log independently, keeping probably confusing information to itself while still leaving helpful information in the log. ### -v --version Display version and copyright information. ## EXIT VALUES **0 **Success: The user or group exists as specified. This can have 2 causes: The user or group was created by this call to **adduser **or the user or group was already present on the system as specified before **adduser **was invoked. If **adduser --system **is invoked for a user already existing with the requested or compatible attributes, it will also return 0. **11 **The object that **adduser **was asked to create does already exist. **12 **The object that **adduser **or **deluser **was asked to operate on does not exist. **13 **The object that **adduser **or **deluser **was asked to operate on does ont have the proper‐ ties that are required to complete the operation: A user (a group) that was requested to be created as a system user (group) does already exist and is not a system user (group), or A user (group) that was requested to be created with a certain UID (GID) does already exist and has a different UID (GID), or A system user (group) that was requested to be deleted does exist, but is not a system user (group). **21 **The UID (GID) that was explicitly requested for a new user (group) is already in use. **22 **There is no available UID (GID) in the requested range. **23 **There is no group with the requested GID for the primary group for a new user. **31 **The chosen name for a new user or a new group does not conform to the selected naming rules. **32 **The home directory of a new user must be an absolute path. **41 **The group that was requested to be deleted is not empty. **42 **The user that was requested to be removed from a group is not a member in the first place. **43 **It is not possible to remove a user from its primary group, or no primary group se‐ lected for a new user by any method. **51 **Incorrect number or order of command line parameters detected. **52 **Incompatible options set in configuration file. **53 **Mutually incompatible command line options detected. **54 adduser **and **deluser **invoked as non-root and thus cannot work. **55 deluser **will refuse to delete the _root_ account. **56 **A function was requested that needs more packages to be installed. See Recommends: and Suggests: of the adduser package. **61 **Adduser was aborted for some reason and tried to roll back the changes that were done during execution. **62 **Internal adduser error. This should not happen. Please try to reproduce the issue and file a bug report. **71 **Error creating and handling the lock. **72 **Error accessing the configuration file(s). **73 **Error accessing a pool file. **74 **Error reading a pool file, syntax error in file. **75 **Error accessing auxiliary files. **81 **An executable that is needed by **adduser **or **deluser **cannot be found. Check your instal‐ lation and dependencies. **82 **Executing an external command returned some unexpected error. **83 **An external command was terminated with a signal. **84 **A syscall terminated with unexpected error. Or for many other yet undocumented reasons which are printed to console then. You may then consider to remove **--quiet **to make **adduser **more verbose. ## SECURITY **adduser **needs root privileges and offers, via the **--conf **command line option to use different configuration files. Do not use [**sudo**(8)](https://www.chedong.com/phpMan.php/man/sudo/8/markdown) or similar tools to give partial privileges to **ad‐** **duser **with restricted command line parameters. This is easy to circumvent and might allow users to create arbitrary accounts. If you want this, consider writing your own wrapper script and giving privileges to execute that script. ## FILES _/etc/adduser.conf_ Default configuration file for [**adduser**(8)](https://www.chedong.com/phpMan.php/man/adduser/8/markdown) and [**addgroup**(8)](https://www.chedong.com/phpMan.php/man/addgroup/8/markdown) _/usr/local/sbin/adduser.local_ Optional custom add-ons, see [**adduser.local**(8)](https://www.chedong.com/phpMan.php/man/adduser.local/8/markdown) ## NOTES Unfortunately, the term _system_ _account_ suffers from double use in Debian. It both means an account for the actual Debian system, distinguishing itself from an _application_ _account_ which might exist in the user database of some application running on Debian. A _system_ _account_ in this definition has the potential to log in to the actual system, has a UID, can be member in system groups, can own files and processes. Debian Policy, au contraire, in its Chapter 9.2.2, makes a distinguishment of _dynamically_ _allocated_ _system_ _users_ _and_ _groups_ and _dynami‐_ _cally_ _allocated_ _user_ _accounts_, meaning in both cases special instances of _system_ _accounts_. Care must be taken to not confuse this terminology. Since **adduser **and [**deluser**(8)](https://www.chedong.com/phpMan.php/man/deluser/8/markdown) never ad‐ dress _application_ _accounts_ and everything in this package concerns _system_ _accounts_ here, the usage of the terms _user_ _account_ and _system_ _account_ is actually not ambiguous in the context of this package. For clarity, this document uses the definition _local_ _system_ _account_ _or_ _group_ if the distinction to _application_ _accounts_ or accounts managed in a directory service is needed. **adduser **used to have the vision to be the universal front end to the various directory ser‐ vices for creation and deletion of regular and system accounts in Debian since the 1990ies. This vision has been abandoned as of 2022. The rationale behind this includes: that in prac‐ tice, a small server system is not going to have write access to an enterprise-wide directory service anyway, that locally installed packages are hard to manage with centrally controlled system accounts, that enterprise directory services have their own management processes any‐ way and that the personpower of the **adduser **team is unlikely to be ever strong enough to write and maintain support for the plethora of directory services that need support. **adduser **will constrict itself to being a policy layer for the management of local system ac‐ counts, using the tools from the **password **package for the actual work. ## BUGS Inconsistent use of terminology around the term _system_ _account_ in docs and code is a bug. Please report this and allow us to improve our docs. **adduser **takes special attention to be directly usable in Debian maintainer scripts without conditional wrappers, error suppression and other scaffolding. The only thing that the pack‐ age maintainer should need to code is a check for the presence of the executable in the postrm script. The **adduser **maintainers consider the need for additional scaffolding a bug and encourage their fellow Debian package maintainers to file bugs against the **adduser **pack‐ age in this case. ## SEE ALSO [**adduser.conf**(5)](https://www.chedong.com/phpMan.php/man/adduser.conf/5/markdown), [**deluser**(8)](https://www.chedong.com/phpMan.php/man/deluser/8/markdown), [**groupadd**(8)](https://www.chedong.com/phpMan.php/man/groupadd/8/markdown), [**useradd**(8)](https://www.chedong.com/phpMan.php/man/useradd/8/markdown), [**usermod**(8)](https://www.chedong.com/phpMan.php/man/usermod/8/markdown), Debian Policy 9.2.2. Debian GNU/Linux [_ADDUSER_(8)](https://www.chedong.com/phpMan.php/man/ADDUSER/8/markdown)