Managing Users and Groups

1. Creating Users

Parameter	Description	Default
name	User name to create	Required
uid	User ID to assign	None
group	Primary group name	Same as user name
groups	Additional groups (comma-separated)	None
home	Home directory path	/home/<name>
shell	Login shell path	/bin/bash
password	Encrypted password (use `ansible.builtin.set_fact` for hashing)	None
state	`present` or `absent`	`present`

Example: Create a user with custom group and shell

- name: Create a new user
  ansible.builtin.user:
    name: john_doe
    uid: 1005
    group: developers
    groups: sudo, docker
    home: /home/john_doe
    shell: /bin/zsh
    state: present

Example: Create a user with encrypted password

- name: Create user with encrypted password
  ansible.builtin.user:
    name: jane_smith
    password: "$6$salt$encrypted_hash"
    state: present

Note: For secure password handling, use ansible.builtin.set_fact to generate or store hashed passwords.

2. Setting User Password

Parameter	Description	Values
name	User account name	`string`
password	Hashed password for the user	`string`
update_password	When to update the password	`always`, `on_create`

Example: Setting a User Password

- name: Set password for user john
  user:
    name: john
    password: "$6$salt$hashedpassword"

Note: The password must be a valid hashed value. Use ansible.builtin.user with update_password: always to update the password if it already exists.

3. Setting User Shell

Parameter	Description	Default	Notes
name	User name to manage	Required
shell	Shell to set for the user	/bin/bash	Can be any valid shell path
state	Whether to ensure the user exists or not	present	Use `absent` to remove user

Example: Setting User Shell

- name: Set user shell to /bin/zsh
  ansible.builtin.user:
    name: john
    shell: /bin/zsh

Note: Ensure the specified shell is installed on the target system before setting it for a user.

4. Creating Home Directory

Parameter	Description	Default
name	User name to create	Required
home	Home directory path to set	/home/`{{ name }}`
createhome	Whether to create the home directory	`false`
shell	Shell to assign to the user	/bin/bash

Example: Create User with Home Directory

- name: Create user with home directory
  ansible.builtin.user:
    name: "john"
    createhome: true
    home: "/home/john"
    shell: "/bin/bash"

Note: Setting createhome: true ensures that the home directory is created if it does not exist.

5. Setting User Groups

Property	Description	Values
name	Name of the group	`group_name`
gid	Group ID	`1000`
state	Whether the group should exist or be absent	`present`, `absent`
system	Whether to create a system group	`true`, `false`

Example: Create a group

- name: Create a group
  ansible.builtin.group:
    name: developers
    gid: 1001
    state: present

Example: Remove a group

- name: Remove a group
  ansible.builtin.group:
    name: oldgroup
    state: absent

6. Removing Users

Option	Values	Notes
name	`username`	The name of the user to remove
state	`absent`	Ensures the user is removed
remove	`true`	Whether to remove the user's home directory and mail spool
force	`false`	Force remove even if the user is logged in

Example: Remove a user with home directory

- name: Remove user with home directory
  ansible.builtin.user:
    name: "johndoe"
    state: absent
    remove: true

Example: Remove a user without home directory

- name: Remove user without home directory
  ansible.builtin.user:
    name: "janedoe"
    state: absent
    remove: false

7. Managing SSH Keys

Property	Description	Example
name	Name of the SSH key	`mykey`
state	Whether the key should be present or absent	`present`
user	User to manage the key for	`ansible_user`
key	Public key content (required when state=present)	`ssh-rsa AAAAB3NzaC1yc2E... user@example.com`
path	Path to the authorized_keys file (optional)	`/home/ansible_user/.ssh/authorized_keys`

Example: Add SSH key to user

- name: Add SSH key to user
  ansible.posix.authorized_key:
    user: ansible_user
    key: "{{ lookup('file', '/path/to/public/key.pub') }}"

Example: Remove SSH key from user

- name: Remove SSH key from user
  ansible.posix.authorized_key:
    user: ansible_user
    key: "{{ lookup('file', '/path/to/public/key.pub') }}"
    state: absent

8. Creating Groups

Parameter	Description	Default
name	Name of the group to create	Required
gid	Group ID to assign to the group	None
state	Whether the group should exist or be absent	`present`
system	Whether to create a system group (Linux only)	`false`

Example: Create a group with a specific GID

- name: Create a group with GID 1005
  ansible.builtin.group:
    name: developers
    gid: 1005
    state: present

Example: Create a system group

- name: Create a system group
  ansible.builtin.group:
    name: appgroup
    system: true
    state: present

9. Setting Group GID

Property	Description	Values	Notes
gid	Group ID	`integer`	Unique identifier for the group. If not specified, system assigns next available GID.
name	Group Name	`string`	Required field to define the group.

Example: Creating a Group with Specific GID

- name: Create group with specific GID
  group:
    name: developers
    gid: 1005

10. Managing Sudo Access

Property	Description	Example
name	User name to manage	`ansible_user`
groups	Groups the user belongs to	`["wheel", "docker"]`
sudoers	Path to sudoers file or content	`/etc/sudoers.d/ansible_user`

Example: Configure Sudo Access for a User

- name: Ensure user has sudo access
  ansible.builtin.user:
    name: ansible_user
    groups:
      - wheel
      - docker
    sudoers: /etc/sudoers.d/ansible_user

Example: Define Sudoers Content

- name: Create sudoers file for ansible_user
  ansible.builtin.copy:
    content: |
      ansible_user ALL=(ALL) NOPASSWD: ALL
    dest: /etc/sudoers.d/ansible_user
    mode: '0440'

11. Locking and Unlocking Users

Property	Description	Example
name	User name to manage	`john_doe`
state	Whether the user should be present or absent. Use `absent` to remove a user, `present` to create or update.	`present`
password	Password hash for the user. Use `ansible.builtin.password_hash` to generate.	`$6$salt$hash`
shell	Shell to assign to the user account	`/bin/bash`
groups	Groups the user should belong to	`["wheel", "docker"]`
system	Whether to create a system user (default: `false`)	`true`
home	Home directory path for the user	`/home/john_doe`
uid	Unique user identifier (UID)	`1001`
gid	Primary group identifier (GID)	`1001`
comment	Comment or GECOS field for the user	`John Doe, IT Department`
expires	Account expiration date (YYYY-MM-DD)	`2025-12-31`
locked	Lock or unlock the user account. NEW	`true` or `false`

Example: Locking a User Account

- name: Lock user account
  ansible.builtin.user:
    name: john_doe
    locked: true

Example: Unlocking a User Account

- name: Unlock user account
  ansible.builtin.user:
    name: john_doe
    locked: false

Note: The locked parameter is available in Ansible 2.10+.