<blockquote>
<p><em>... mostly achieves the lock behavior, but it also creates the user. The <code>state</code> property only has possible values <code>present</code> and <code>absent</code> ...</em></p>
</blockquote>
<p>Right, that would be the best approach and expected behavior.</p>
<blockquote>
<p><em>One can obtain a fact on the user presence using <code>ansible.builtin.getent</code> and then conditionally use <code>ansible.builtin.user</code>.</em></p>
</blockquote>
<p>And also right, this would be too the recommended approach.</p>
<p>In other words, currently there is no possibility to configure such within one single task and if not using <code>shell</code> module, custom scripts or custom modules.</p>
<p><strong>Similar Q&amp;A</strong></p>
<ul>
<li><a href="https://serverfault.com/a/1035610/448950">Ansible, only disable existing users?</a></li>
</ul>

CC BY-SA 4.0
2022-12-02T17:10:25.470Z
2022-12-02T17:10:25.470Z
U880D
<p>Given a username, if that user exists, lock it, otherwise keep it missing.</p>
<p>The most likely module is <code>ansible.builtin.user</code>. There passing <code>password: &quot;*&quot;</code> and <code>shell: &quot;/usr/sbin/nologin&quot;</code> mostly achieves the lock behavior, but it also creates the user. The <code>state</code> property only has possible values <code>present</code> and <code>absent</code>, neither of which describes the desired behavior.</p>
<p>One can obtain a fact on the user presence using <code>ansible.builtin.getent</code> and then conditionally use <code>ansible.builtin.user</code>. Is there a better way?</p>

<ansible>
How to lock a user using ansible?
Helmut Grohne
# How to lock a user using ansible?

(Asked by: username_0 on 2022-12-02)

Given a username, if that user exists, lock it, otherwise keep it missing.

The most likely module is `ansible.builtin.user`. There passing `password: "*"` and `shell: "/usr/sbin/nologin"` mostly achieves the lock behavior, but it also creates the user. The `state` property only has possible values `present` and `absent`, neither of which describes the desired behavior.

One can obtain a fact on the user presence using `ansible.builtin.getent` and then conditionally use `ansible.builtin.user`. Is there a better way?

**Tags:** ansible


---

## 1 answers

### Answer by username_1 on 2022-12-02. Score: 2 | Accepted answer

> *... mostly achieves the lock behavior, but it also creates the user. The `state` property only has possible values `present` and `absent` ...*

Right, that would be the best approach and expected behavior.

> *One can obtain a fact on the user presence using `ansible.builtin.getent` and then conditionally use `ansible.builtin.user`.*

And also right, this would be too the recommended approach.

In other words, currently there is no possibility to configure such within one single task and if not using `shell` module, custom scripts or custom modules.

**Similar Q&A**

* [Ansible, only disable existing users?](https://serverfault.com/a/1035610/448950)


---

