pure number allowed as username in the useradd command?

[Joachim Backes]

Can somebody explain why pure numbers are allowed for username in the
useradd command?

sudo useradd 123456789

is not rejected!

As is known, this leads to big problems if referring to such a user and
the username differs from the userid: should such a username be
interpreted as username or userid?

Thanks for each comment.

Kind regards

--

Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt;

http://www.rhrk.uni-kl.de/~backes

[Tom H]

On Fri, Dec 3, 2010 at 3:38 AM, Hiisi <saippua5(a)gmail.com&gt; wrote:
>  pe, 2010-12-03 kello 02:04 -0500, Tom H kirjoitti:
> > I've always assumed that Linux had the same restrictions but "man 5
> > passwd" on my F14 box yields nothing so I've just googled and the only
> > restriction that
> > http://www.kernel.org/doc/man-pages/online/pages/man5/passwd.5.html
> > sets is "It should not contain capital letters".
>
>  Probably it's not a restriction but just a recommendation.
>  ]$ whoami
>  Sampo 
True. I've just checked "man 5 passwd" on a Debian sid VM and it
doesn't have the "capital letters" text. (I had to install man-pages
to get the passwd(5) manpage. It's strange that a Fed Live CD install
doesn't include it. I presume that it's to make space.)

[Hiisi]

pe, 2010-12-03 kello 02:04 -0500, Tom H kirjoitti:
>  I've always assumed that Linux had the same restrictions but
> "man 5
>  passwd" on my F14 box yields nothing so I've just googled and the only
>  restriction that
>  http://www.kernel.org/doc/man-pages/online/pages/man5/passwd.5.html
>  sets is "It should not contain capital letters".  
Probably it's not a restriction but just a recommendation.
]$ whoami
Sampo

F12, upgraded from F11.
-- 
We are MicroSoft.  You will be assimilated.  Resistance is futile.
	-- Attributed to B.G., Gill Bates

[Tom H]

On Thu, Dec 2, 2010 at 8:04 PM, Genes MailLists <lists(a)sapience.com&gt; wrote:
>  On 12/02/2010 07:42 PM, Marko Vojinovic wrote:
> > On Thursday 02 December 2010 21:02:17 Aaron Konstam wrote:
> >> On Thu, 2010-12-02 at 18:10 +0100, Joachim Backes wrote:
> >>> Can somebody explain why pure numbers are allowed for username in the
> >>> useradd command?
> >>>
> >>> sudo useradd 123456789
> >>>
> >>> is not rejected!
> >>>
> >>> As is known, this leads to big problems if referring to such a user and
> >>> the username differs from the userid: should such a username be
> >>> interpreted as username or userid?
>
>   Can you be specific - what big problems are these ? Never tried, but
>  it is by means obvious that this would be problematic.
>
> > So I guess 12345 should be a valid username as any other, and useradd
> > correctly allows for creation of such usernames. No bug there.
>
>   Agreed - without knowing what the problems are it is hard to say that
>  useradd (or anything else) should disallow numerical id's .. 
In Solaris, there are restrictions on the username. It has to start
with a letter, cannot start with a hyphen, and cannot contain a colon.
(There may be more restrictions; these are the ones that I remember.)

I've always assumed that Linux had the same restrictions but "man 5
passwd" on my F14 box yields nothing so I've just googled and the only
restriction that
http://www.kernel.org/doc/man-pages/online/pages/man5/passwd.5.html
sets is "It should not contain capital letters".

[Tom H]

On Fri, Dec 3, 2010 at 7:09 AM, Marko Vojinovic <vvmarko(a)gmail.com&gt; wrote:
>  On Friday 03 December 2010 06:28:27 Joachim Backes wrote:
> >
> > See chown: allows username and userid as new owner. So if a numerical
> > userid is the same as a username (having another userid), which user is
> > meant? The user with this username, or the user with this userid?
>
>  The username is assumed first, and looked up in /etc/passwd for a corresponding
>  userid. If not found, and if the input is numeric, then it is assumed to be a
>  userid. 
Thanks. I guess we can call this progress!

[Marko Vojinovic]

On Friday 03 December 2010 06:28:27 Joachim Backes wrote:
>  On 12/03/2010 02:04 AM, Genes MailLists wrote:
>  > On 12/02/2010 07:42 PM, Marko Vojinovic wrote:
>  >> On Thursday 02 December 2010 21:02:17 Aaron Konstam wrote:
>  >>> On Thu, 2010-12-02 at 18:10 +0100, Joachim Backes wrote:
>  >>>> Can somebody explain why pure numbers are allowed for username in the
>  >>>> useradd command?
>  >>>> 
>  >>>> sudo useradd 123456789
>  >>>> 
>  >>>> is not rejected!
>  >>>> 
>  >>>> As is known, this leads to big problems if referring to such a user
>  >>>> and the username differs from the userid: should such a username be
>  >>>> interpreted as username or userid?
>
>  See chown: allows username and userid as new owner. So if a numerical
>  userid is the same as a username (having another userid), which user is
>  meant? The user with this username, or the user with this userid? 
The username is assumed first, and looked up in /etc/passwd for a corresponding 
userid. If not found, and if the input is numeric, then it is assumed to be a 
userid.

HTH, :-)
Marko

[Hiisi]

pe, 2010-12-03 kello 00:42 +0000, Marko Vojinovic kirjoitti:
>  On Thursday 02 December 2010 21:02:17 Aaron Konstam wrote:
>  > On Thu, 2010-12-02 at 18:10 +0100, Joachim Backes wrote:
>  > > Can somebody explain why pure numbers are allowed for username in the
>  > > useradd command?
>  > > 
>  > > sudo useradd 123456789
>  > > 
>  > > is not rejected!
>  > > 
>  > > As is known, this leads to big problems if referring to such a user and
>  > > the username differs from the userid: should such a username be
>  > > interpreted as username or userid?
>   
<--SNIP-->
>  HTH, :-)
>  Marko
>   
My system serves as email2sms gate. On this system there's a lot of user
accounts consisted only of digits. They're interpreted as phone numbers.
Each user has an email address like this: <phone
number&gt;(a)&lt;gate_address.com&gt; (e.g. 79057777009(a)mygate.com). And sending
email to that account results in sending an SMS to <phone number> where
text of SMS is the body of email. Everything works like a charm! I've
not encountered any problems with nearly 50 users on my system with
unames from pure numbers.
-- 
Ok, I'm just uploading the new version of the kernel, v1.3.33, also
known as "the buggiest kernel ever".
	-- Linus Torvalds

[Joachim Backes]

On 12/03/2010 02:04 AM, Genes MailLists wrote:
>  On 12/02/2010 07:42 PM, Marko Vojinovic wrote:
> > On Thursday 02 December 2010 21:02:17 Aaron Konstam wrote:
> >> On Thu, 2010-12-02 at 18:10 +0100, Joachim Backes wrote:
> >>> Can somebody explain why pure numbers are allowed for username in the
> >>> useradd command?
> >>>
> >>> sudo useradd 123456789
> >>>
> >>> is not rejected!
> >>>
> >>> As is known, this leads to big problems if referring to such a user and
> >>> the username differs from the userid: should such a username be
> >>> interpreted as username or userid?
> >
>  
>     Can you be specific - what big problems are these ? Never tried, but
>  it is by means obvious that this would be problematic. 
See chown: allows username and userid as new owner. So if a numerical
userid is the same as a username (having another userid), which user is
meant? The user with this username, or the user with this userid?

>  
> > So I guess 12345 should be a valid username as any other, and useradd 
> > correctly allows for creation of such usernames. No bug there.
> >
>  
>   Agreed - without knowing what the problems are it is hard to say that
>  useradd (or anything else) should disallow numerical id's .. 

-- 
Joachim Backes <joachim.backes(a)rhrk.uni-kl.de&gt;

http://www.rhrk.uni-kl.de/~backes

[Genes MailLists]

On 12/02/2010 07:42 PM, Marko Vojinovic wrote:
>  On Thursday 02 December 2010 21:02:17 Aaron Konstam wrote:
> > On Thu, 2010-12-02 at 18:10 +0100, Joachim Backes wrote:
> >> Can somebody explain why pure numbers are allowed for username in the
> >> useradd command?
> >>
> >> sudo useradd 123456789
> >>
> >> is not rejected!
> >>
> >> As is known, this leads to big problems if referring to such a user and
> >> the username differs from the userid: should such a username be
> >> interpreted as username or userid?
>   
   Can you be specific - what big problems are these ? Never tried, but
it is by means obvious that this would be problematic.

>  So I guess 12345 should be a valid username as any other, and useradd
>
>  correctly allows for creation of such usernames. No bug there.
>   
 Agreed - without knowing what the problems are it is hard to say that
useradd (or anything else) should disallow numerical id's ..

[Marko Vojinovic]

On Thursday 02 December 2010 21:02:17 Aaron Konstam wrote:
>  On Thu, 2010-12-02 at 18:10 +0100, Joachim Backes wrote:
>  > Can somebody explain why pure numbers are allowed for username in the
>  > useradd command?
>  > 
>  > sudo useradd 123456789
>  > 
>  > is not rejected!
>  > 
>  > As is known, this leads to big problems if referring to such a user and
>  > the username differs from the userid: should such a username be
>  > interpreted as username or userid? 
I am by no means an expert on this, but AFAIK all scripts and apps have (or at 
least should have) a well-defined input semantics. IOW, no script should try to 
be "smart" and heuristically guess whether you provided a username or a userid 
in the input. It should always expect *only* *one* of these two.

Now, if it expects a username, once you provide it the script will look it up 
in /etc/passwd to find a corresponding userid. In this case there is no problem 
with username being completely numeric.

If the script expects a userid, once you provide it it will use it, and either 
ignore the username (if it is not important) or look it up in /etc/passwd (if 
it is important). In this case there is also no problem with the username 
being completely numeric.

The only problematic situation may arise if the script does not have a well-
defined input rules, and can expect either the username or userid, and then try 
to guess what you have entered, based on the contents and the context. In this 
case confusion can arise. But I would say that such kind of a script has a bug 
and should be fixed, rather than that numeric usernames should be forbidden.

There is no conceptual problem with having numeric usernames, as long as each 
app knows exactly what input to expect, and use /etc/passwd to make a proper 
map from username to userid and vice versa. Any app which doesn't know exactly 
what input to expect is just broken, simply put. If you encounter such an app 
or script, file a bug against it.

So I guess 12345 should be a valid username as any other, and useradd 
correctly allows for creation of such usernames. No bug there.

P.S. A bit of heuristic thinking: numeric usernames are a very elementary 
thing to consider, and if they were not supposed to exist, wrong useradd 
behavior would have been spotted and corrected a looooong time ago. ;-)

HTH, :-)
Marko

[Aaron Konstam]

On Thu, 2010-12-02 at 18:10 +0100, Joachim Backes wrote:
>  Can somebody explain why pure numbers are allowed for username in
> the
>  useradd command?
>  
>  sudo useradd 123456789
>  
>  is not rejected!
>  
>  As is known, this leads to big problems if referring to such a user and
>  the username differs from the userid: should such a username be
>  interpreted as username or userid?
>  
>  Thanks for each comment.
>  
>  Kind regards
>   
As you said using a pure number for userid can be diasterous But you
question needs to be answered by the creator of useradd.

I once created a useradd program with added functionality and I know
from first hand experience that are many pitfalls to get it to work
properly. Consider what happens if you have a userid that is the same
number as a userid.

-- 
=======================================================================
meetings, n.: A place where minutes are kept and hours are lost.
=======================================================================
Aaron Konstam telephone: [phone] e-mail: akonstam(a)sbcglobal.net