# Restriction of shell access for new user on a linux box

**URL:** <https://discourse.chef.io/t/restriction-of-shell-access-for-new-user-on-a-linux-box/6446>\
**Category:** Chef Infra (archive)\
**Created:** [March 23, 2015, 6:27pm UTC](https://discourse.chef.io/t/restriction-of-shell-access-for-new-user-on-a-linux-box/6446 "2015-03-23T18:27:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ANGELA\_EBIRIM](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@ANGELA\_EBIRIM](https://discourse.chef.io/u/ANGELA_EBIRIM)\
**Post date:** [March 23, 2015, 6:27pm UTC](https://discourse.chef.io/t/restriction-of-shell-access-for-new-user-on-a-linux-box/6446/1 "2015-03-23T18:27:04Z")

</div>

Hello everyone,

Has anyone had experience of restricting access for a particular user using the user resource in Chef?

I’m trying to create a service user who will have restricted access on a linux box.

I have done the following:-

```
 user user do
	supports :manage_home => true
  	comment "chef created service user: #{user}"
	home "/home/#{user}"
	shell '/sbin/nologin'
	action :create
end

```

but have been unsuccessful.

I noticed that during the chef run the following output was generated when an attempt was made to create a service user:

Ran [“useradd”, “-c”, “chef created service user: svc\_goagent”, “-s”, “/sbin/nologin”, “-d”, “/home/svc\_goagent”, “-m”, “svc\_goagent”] returned 3 and not 0.

Any ideas?

Many thanks

Sent from iCloud

---

<div class="post-metadata">

**Author:** ![mandi\_walls](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/mandi_walls/32/135_2.png) [@mandi\_walls](https://discourse.chef.io/u/mandi_walls)\
**Post date:** [March 23, 2015, 6:54pm UTC](https://discourse.chef.io/t/restriction-of-shell-access-for-new-user-on-a-linux-box/6446/2 "2015-03-23T18:54:59Z")

</div>

exit code 3 is invalid argument for option.

my guess would be the comment you have - there's a colon in your string  
"chef created service user: svc\_goagent".

colon is the delimiter for the passwd file and wouldn't be permitted in the  
user data.

On Mon, Mar 23, 2015 at 2:27 PM, ANGELA EBIRIM [aebirim@icloud.com](mailto:aebirim@icloud.com) wrote:

> Hello everyone,
> 
> Has anyone had experience of restricting access for a particular user  
> using the user resource in Chef?
> 
> I'm trying to create a service user who will have restricted access on a  
> linux box.
> 
> I have done the following:-
> 
> ```
> user user do
> 
> ```
> 
> supports :manage\_home =\> true  
> comment "chef created service user: #{user}"  
> home "/home/#{user}"  
> shell '/sbin/nologin'  
> action :create  
> end
> 
> but have been unsuccessful.
> 
> I noticed that during the chef run the following output was generated when  
> an attempt was made to create a service user:
> 
> Ran ["useradd", "-c", "chef created service user: svc\_goagent", "-s",  
> "/sbin/nologin", "-d", "/home/svc\_goagent", "-m", "svc\_goagent"] returned 3  
> and not 0.
> 
> Any ideas?
> 
> Many thanks
> 
> Sent from iCloud

--  
Mandi Walls  
[mandi.walls@gmail.com](mailto:mandi.walls@gmail.com)

@lnxchk

---

<div class="post-metadata">

**Author:** ![ANGELA\_EBIRIM](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@ANGELA\_EBIRIM](https://discourse.chef.io/u/ANGELA_EBIRIM)\
**Post date:** [March 23, 2015, 7:05pm UTC](https://discourse.chef.io/t/restriction-of-shell-access-for-new-user-on-a-linux-box/6446/3 "2015-03-23T19:05:13Z")

</div>

Hi Mandi,

Silly me!

That was indeed the problem. Didn’t realise that you were restricted in what you could put in the comment field.

Thanks again.  
Sent from iCloud

On Mar 23, 2015, at 11:55 AM, mandi walls [mandi.walls@gmail.com](mailto:mandi.walls@gmail.com) wrote:

exit code 3 is invalid argument for option.

my guess would be the comment you have - there’s a colon in your string “chef created service user: svc\_goagent”.

colon is the delimiter for the passwd file and wouldn’t be permitted in the user data.

On Mon, Mar 23, 2015 at 2:27 PM, ANGELA EBIRIM [aebirim@icloud.com](mailto:aebirim@icloud.com) wrote:  
Hello everyone,

Has anyone had experience of restricting access for a particular user using the user resource in Chef?

I’m trying to create a service user who will have restricted access on a linux box.

I have done the following:-

```
 user user do

```

supports :manage\_home =\> true  
comment "chef created service user: #{user}"  
home "/home/#{user}"  
shell '/sbin/nologin’  
action :create  
end

but have been unsuccessful.

I noticed that during the chef run the following output was generated when an attempt was made to create a service user:

Ran [“useradd”, “-c”, “chef created service user: svc\_goagent”, “-s”, “/sbin/nologin”, “-d”, “/home/svc\_goagent”, “-m”, “svc\_goagent”] returned 3 and not 0.

Any ideas?

Many thanks

Sent from iCloud

–  
Mandi Walls  
[mandi.walls@gmail.com](mailto:mandi.walls@gmail.com)

@lnxchk