Systemd sysuser confusion about expired account with u! [solved]

graysky · 2025-07-06 10:34:49

It seems that the expected behavior of a user account created with a sysusers file containing the "fully locked" configuration (for example see nfs-utils) is be expired.

I am using this in my AUR package for kodi-standalone-service's sysusers.conf which results in an inability to start the service due to the expired account.

man 5 sysusers.d wrote:

Type u may be suffixed with an exclamation mark ("u!") to create a fully locked account. This is recommended, since logins should typically not be allowed for system users. With or without the exclamation mark an invalid password is set. For "u!", the account is also locked, which makes a difference for non-password forms of authentication, such as SSH or similar.

Maybe the term "locked" in the man page means expired?

Last edited by graysky (2025-07-06 14:24:07)

seth · 2025-07-06 13:58:10

https://github.com/systemd/systemd/issu … -549372469
Slightly older systemd version on ALARM?

graysky · 2025-07-06 14:03:43

I just edited my original post, seth. I was mistaken. Both behave the same.

seth · 2025-07-06 14:07:51

Then there's no mystery - the feature was explicitly added to "fully lock" the user, https://man.archlinux.org/man/passwd.1#OPTIONS - see the --lock comments
Why that's recommended for sysusers, idk.

graysky · 2025-07-06 14:23:57

Thanks for the link. I guess for non-interactive accounts only.

Arch Linux

#1 2025-07-06 10:34:49

Systemd sysuser confusion about expired account with u! [solved]

#2 2025-07-06 13:58:10

Re: Systemd sysuser confusion about expired account with u! [solved]

#3 2025-07-06 14:03:43

Re: Systemd sysuser confusion about expired account with u! [solved]

#4 2025-07-06 14:07:51

Re: Systemd sysuser confusion about expired account with u! [solved]

#5 2025-07-06 14:23:57

Re: Systemd sysuser confusion about expired account with u! [solved]

Board footer