Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
How to Make a User with a Numeric Username in Linux (2014) (dampfkraft.com)
68 points by polm23 on Feb 3, 2019 | hide | past | favorite | 11 comments


usernames are strings, and what exactly is in them doesn't matter.

"1234" is a string in anyone's language. I have to say I've never thought of doing this and can't see a use for it but I'll bet there are some lovely bugs to be discovered. Also, you can have more than one name -> uid. There can be multiple uid = 0 for example, indeed calling uid = 0 "root" is only a convention and is also unnecessary.


> but I'll bet there are some lovely bugs to be discovered.

https://github.com/systemd/systemd/issues/6237

> systemd can't handle the process previlege that belongs to user name starts with number, such as 0day

Apparently systemd will run services owned by users with a name that starts with a digit as root.


Jesus that is a depressing read.

  - "some configurations might lead to serious vulnerabilities"

  - "I can't reproduce on fedora. Not a bug".


I always wonder how bugs (is this a bug?) like that, and that one time when you could log into macOS by repeatedly pressing "Login"[0] even happen. Like, what's the logic behind that?

[0]: https://threatpost.com/critical-apple-login-bug-puts-macos-h...


Reading the issue it looks like Poettering confidently replies that these aren't valid user names, but then when he's challenged to defend that he tries to walk it back to being just not a good idea. So that's how it happens. People make unwarranted assumptions.


In my experience it’s unwarranted assumptions about data formats (e.g. usernames aren’t numbers) and not checking the specs.

Also, putting off coding for corner cases, and then forgetting to.

I’ve been guilty of doing both.


> "1234" is a string in anyone's language.

Isn't that the point of the article?


I imagine there's quite a lot of utilities that will break.

This bug in systemd mentions a few other utilities that have trouble: https://access.redhat.com/solutions/3103631

It's likely not an exhaustive list either.


Not to mention that it's really confusing if the username is numeric, but the uid != uname. I guess that's why the old debian set uid to uname in this case.


Hey, author here. While I wrote this in 2014 I still take the same steps when setting up a user on a new box, and I haven't had any new problems with it.

Do note I only do this on personal machines - in shared environments or at work I generally use my initials.


If it ain't broke, don't fix it.

If it is broken, then fix it, or break it so others can see.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: