How to check which package created a user?

It is suspected that some packages have scripts run at install time which create user accounts in /etc/passwd. How can I check which package created a specific user?

Solution 1:

This will work reasonably reliably if the package was installed via dpkg (including with apt install). See muru's answer for a list of users created in the default Ubuntu installation and the package that creates them. For those users, this method will not produce any output.

You can use the command:

grep -RlE '(adduser|useradd).*systemd' /var/lib/dpkg/info --include='*inst' | sed -r 's:.*/(.*)\.[-a-z]+inst:\1:'

replace <user> with the name of the user you are interested in, for example, systemd

This searches the preinst and postinst scripts of all packages known to dpkg for the adduser or useradd command and the user in question, to see which package is responsible for creating that user. The result is piped to sed so it returns only the package name itself instead of the full name of the script file.

Explanation

grep -RlE search recursively and print only the names of files containing matches, use extended regular expressions
'(adduser|useradd).*<user>' /var/lib/dpkg/info --include='*inst' search for the adduser or useradd command and the user you want to find on the same line (.* will match any characters between them, catching any command options) in the directory where dpkg stores scripts, in files whose names end with inst
sed -r 's:.*/(.*)\.[-a-z]+inst:\1:' strip off everything before & including the last / in the full path and the .preinst or .postinst extension

Thanks to @muru for suggesting a neater and faster way of searching than using find here :)

Solution 2:

There is an important exception to the usual adduser-added users and groups here: the ones that come with Ubuntu by default. These are provided by the base-passwd package. A list of users and groups added by this package is given (and described) in /usr/share/doc/base-passwd/users-and-groups.{html,txt.gz}. The list is:

Users (usually with corresponding groups)

root    man     majordom    irc         gdm
daemon  lp      postgres    gnats       saned
bin     mail    www-data    nobody      klog
sys     news    backup      messagebus  syslog
sync    uucp    operator    postfix
games   proxy   list        haldaemon

Groups (without corresponding users)

adm     fax     audio       staff       sshd
tty     voice   src         users       fetchmail
disk    cdrom   shadow      lpadmin     cupsys
kmem    floppy  utmp        sasl        nogroup
dialout tape    video       scanner
dip     sudo    plugdev     ssh

The package README (/usr/share/doc/base-passwd/README) also lists out some users with UIDs in the 60000-64999 range, and states that these are created by the respective packages.

Also see:

Unix & Linux: How to find out which package a user belongs to?
The source code of base-passwd for 14.04 - you can see the list of users and groups in the *.master files.