1

In my network environment I already have a user with the same UID (user id) and GID (group id) than the default user pi on Raspbian. This conflicts with user rights on my network, so I have to change these ids. How can I do this?

5
  • 2
    Anyone with this issue should consider whether in context it is really an XY problem before jumping to the conclusion that they need to change the user ID. File archiving tools like tar usually have a simple option to map ownership, and the same goes for remote mounted filesystems. These are more secure solutions since they can be applied to any source id (as opposed to relying on a system where the ids must match across a network). Put another way, if you are relying on identical uids across a network maybe you are doing something dubious ;)
    – goldilocks
    Apr 20, 2020 at 14:39
  • 2
    Why not just create a new user and disable the Pi logon? It’s a two minute job to add the new user to the security groups and sudo as needed. In fact it’s better to start with limited rights and build up only those needed. Am I missing something?
    – user115418
    Apr 20, 2020 at 18:23
  • @goldilocks I have expected those reservations ;-) But I have a Single sign on using SSSD against OpenLDAP server with Kerberos SASL/GSSAPI together with NFS4 encrypted mounts. And yes, before deciding to change uid/gid I had a look at mapping ids, e.g. with /etc/idmapd.conf and name query order in /etc/nsswitch.conf and other things.
    – Ingo
    Apr 20, 2020 at 18:31
  • @goldilocks Because I always have to manage the problematic device, I decided to change uid/gid to have a consistent setting all over my network and not to loose the overview what I have fiddled on different devices to match the network conditions.
    – Ingo
    Apr 20, 2020 at 18:31
  • @Andyroo That's exactly what I want to do. As noted in my comment to @goldilocks I don't have just one RasPi to manage standalone. I remotely logon to the RasPi and on first logon it creates its home directory automatically. Then I want to manage the services that user pi can use (e.g. use vlc to watch TV). So to be on the save side I like to preserve its local account. pi does not have a centralized account on the network. It's only used for the local services. Later when I have got more experience I may change it and manage local services when first login.
    – Ingo
    Apr 20, 2020 at 18:41

2 Answers 2

2

This is what I do.

Warning: Use at your own risk as making a mistake may require a reinstall.

  1. log in as the pi user and add two more users with sudo adduser name1 and sudo adduser name2. The name2 user is a safeguard in case you make a mistake. Give both users the same password.
  2. IMPORTANT. Now give the pi user the same password as used for the other two users. Use the passwd command to set the password.
  3. Add both the new users to the sudo group. sudo adduser name1 sudo and sudo adduser name2 sudo.
  4. Login as the new users in turn an check they can use sudo, e.g. sudo ls.
  5. Login as name2.
  6. Edit /etc/passwd and /etc/group. Swap all occurrences of pi to name1 and vice versa. Be careful.
  7. Last step. Change the home directory ownerships. sudo chown pi.pi -R /home/pi and sudo chown name1.name1 -R /home/name1.
2
  • Nice solution and I like it ;) But it doesn't help in my situation. 1) It doesn't solve the problem with the running process with old users rights. 2) It doesn't change user rights on files outside the home directory (ok, no problem to do that). 3) You still have an account, now with name1, with the old uid and gid. Because of single sign on with an ldap directory for user accounts I must not have that.
    – Ingo
    Apr 22, 2020 at 18:00
  • Yes, my answer is for the situation when you freshly install a Pi and want another user to have the 1000 uid and 1000 gid assigned to the Pi user.
    – joan
    Apr 22, 2020 at 20:03
1

You can use usermod to change the user id UID and the group id GID of a user. But it is not all done with it. All files that are owned by the user has his id stored as metadata, so we have to scan all files and change its ids also. And there is another issue with the user pi on Raspbian. If you try to change his uid you get an error message that prevents changes:

rpi ~$ sudo usermod -u 65532 pi
usermod: user pi is currently used by process 608

And no, it doesn't help to kill all the processes owned by the user pi with sudo pkill -9 -u pi. At least one process is restarted immediately. It only helps to chroot into the not running filesystem of the SD Card and execute the commands. For this we need a second SD Card with Raspbian (Raspbian Light is sufficient) that you use to boot the RasPi. Then attach the original SD Card with your Card Reader to it. I assume it is attached as device /dev/sda. Now modify its filesystem as follows.

Chroot into the filesystem:

rpi ~$ sudo -Es
rpi ~# mkdir /mnt/p2
rpi ~# mount /dev/sda2 /mnt/p2
rpi ~# chroot /mnt/p2 /bin/bash

Change the ids and modify the files owned by user pi. It has uid and gid 1000. I will change them to 65532:

root@raspberrypi:/# usermod -u 65532 pi
root@raspberrypi:/# groupmod -g 65532 pi
root@raspberrypi:/# find / -group 1000 -exec chgrp -h pi {} \;
root@raspberrypi:/# find / -user 1000 -exec chown -h pi {} \;

Now check if its all correct:

root@raspberrypi:/# ls -aln /home/pi/
root@raspberrypi:/# id -u pi
root@raspberrypi:/# id -g pi
root@raspberrypi:/# grep pi /etc/passwd
root@raspberrypi:/# grep pi /etc/group
root@raspberrypi:/# find / -user pi -ls
root@raspberrypi:/# find / -group pi -ls

Clean up:

root@raspberrypi:/# exit
rpi ~# umount /mnt/p2
rpi ~# rmdir /mnt/p2
rpi ~# exit
rpi ~$

Boot the modified SD Card and use it. Most I have taken from How to Change a USER and GROUP ID on Linux For All Owned Files. Thanks to Vivek Gite. For more detailed information about the commands, look at his instructions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.