AnsibleByExample

Ansible Linux User Management Guide

Beginneransibleusermodulelinux
2024-01-015By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

Introduction

Managing users and groups across dozens or hundreds of Linux servers manually is error-prone and time-consuming. Ansible's user and group modules automate the entire lifecycle — creating accounts, managing group memberships, setting passwords, distributing SSH keys, and enforcing policies consistently across your fleet.

Core Modules

ModulePurpose
ansible.builtin.userManage user accounts
ansible.builtin.groupManage groups
ansible.posix.authorized_keyManage SSH authorized keys
ansible.builtin.lineinfileEdit sudoers and config files

Quick Examples

Create a User

- name: Create developer user
  ansible.builtin.user:
    name: developer
    comment: "Developer Account"
    groups: docker,sudo
    append: true
    shell: /bin/bash
    state: present

Create a Group

- name: Create application group
  ansible.builtin.group:
    name: appteam
    gid: 2000
    state: present

Set Password

- name: Set user password
  ansible.builtin.user:
    name: developer
    password: "{{ 'MySecurePass' | password_hash('sha512') }}"
    update_password: on_create  # Only set on initial creation

Add SSH Key

- name: Add authorized SSH key
  ansible.posix.authorized_key:
    user: developer
    key: "{{ lookup('file', 'files/developer_id_rsa.pub') }}"
    state: present

Complete User Provisioning Playbook

---
- name: Provision team users
  hosts: all
  become: true
  vars:
    team_users:
      - name: alice
        groups: [sudo, docker, appteam]
        shell: /bin/bash
        ssh_key: "ssh-rsa AAAA... alice@company.com"
      - name: bob
        groups: [docker, appteam]
        shell: /bin/bash
        ssh_key: "ssh-rsa AAAA... bob@company.com"
      - name: charlie
        groups: [appteam]
        shell: /bin/bash
        ssh_key: "ssh-rsa AAAA... charlie@company.com"

  tasks:
    - name: Create application group
      ansible.builtin.group:
        name: appteam
        state: present

    - name: Create user accounts
      ansible.builtin.user:
        name: "{{ item.name }}"
        groups: "{{ item.groups }}"
        append: true
        shell: "{{ item.shell }}"
        create_home: true
        state: present
      loop: "{{ team_users }}"

    - name: Deploy SSH keys
      ansible.posix.authorized_key:
        user: "{{ item.name }}"
        key: "{{ item.ssh_key }}"
        exclusive: true
      loop: "{{ team_users }}"

    - name: Set password expiration policy
      ansible.builtin.user:
        name: "{{ item.name }}"
        password_expire_max: 90
        password_expire_min: 7
      loop: "{{ team_users }}"

Tutorials

User Management

Group Management

PostgreSQL Users

Windows User Management

AWX User Management

Troubleshooting

User Module Parameters Reference

ParameterTypeDescription
namestringUsername (required)
statestringpresent or absent
uidintUser ID
groupstringPrimary group
groupslistSecondary groups
appendboolAppend to groups (don't replace)
shellstringLogin shell
homestringHome directory path
create_homeboolCreate home directory
commentstringGECOS comment field
passwordstringHashed password
update_passwordstringalways or on_create
systemboolCreate system account
expiresfloatAccount expiry (epoch)
generate_ssh_keyboolGenerate SSH key pair
ssh_key_bitsintSSH key bits (default: 4096)
ssh_key_typestringKey type (rsa, ed25519, etc.)
removeboolRemove home dir on absent
forceboolForce removal even if logged in
password_expire_maxintMax days between password changes
password_expire_minintMin days between password changes

Offboarding Users

- name: Offboard departed employees
  hosts: all
  become: true
  vars:
    departed_users:
      - alice
      - bob

  tasks:
    - name: Lock accounts
      ansible.builtin.user:
        name: "{{ item }}"
        password_lock: true
      loop: "{{ departed_users }}"

    - name: Remove cron jobs
      ansible.builtin.cron:
        name: "*"
        user: "{{ item }}"
        state: absent
      loop: "{{ departed_users }}"
      ignore_errors: true

    - name: Remove user accounts and home directories
      ansible.builtin.user:
        name: "{{ item }}"
        state: absent
        remove: true
        force: true
      loop: "{{ departed_users }}"

Conclusion

Ansible makes Linux user management scalable and consistent — from creating accounts with proper group memberships and SSH keys to enforcing password policies and offboarding departed employees. Use the user module for accounts, group for groups, and authorized_key for SSH access. Store passwords in Ansible Vault, use update_password: on_create to avoid resetting passwords on every run, and always use append: true when adding secondary groups to avoid removing existing memberships.

All Tutorials