User

create has 19 configuration properties. They are uid, username, group, group_create, home, home_mode, home_create, shell, full_name, email, password, password_disabled, locked, smb, sudo_commands, sudo_commands_nopasswd, sshpubkey, groups, and attributes. A username, full name, primary group, and password status are all required for user creation. For more details, see Create Configuration Properties.

The command returns a blank line.

To confirm the user is created, use get_user_obj or go to Credentials > Local Users in the SCALE Web UI.

From the CLI prompt, enter:

account user create username=testuser full_name="Test User" group_create=true password=passwort1234

Press Enter

From the account prompt, enter:

user create username=testuser full_name="Test User" group_create=true password=passwort1234

Press Enter

Where testuser is the desired username, Test User is a description for the user, true is a boolean value, and passwort1234 is the desired password for the account.

This command contains the minimum required properties to successfully create a user.

account user create username=testuser full_name="Test User" group_create=true password=passwort1234

The command returns a blank line.

To confirm the user is deleted, use get_user_obj or go to Credentials > Local Users in the SCALE Web UI.

By default, the user delete command also deletes the users’s primary group if it is not being used by another user. The delete_group option set to false retains the user’s primary group.

From the CLI prompt, enter:

account user delete id=3001

Press Enter

From the account prompt, enter:

user delete id=3001

Press Enter

Where 3001 is the user ID number for the account.

account user delete id=<UID>

Use the delete_group option to retain the user’s primary group.

account user delete id=<UID> options={"delete_group": false}

The get_next_uid command does not require entering properties or values.

get_next_uid returns the next available UID in numerical order. Default behavior begins identification number for local users at 3000.

From the CLI prompt, enter:

account user get_next_uid

Press Enter

From the account prompt, enter:

user get_next_uid

Press Enter

account user get_next_uid
3003

The get_user_obj command returns username, account UID, primary group GID, full name (displayed as pw_gecos), home directory, and shell preference setting.

The user account can be specified using either the username or UID.

get_user_obj has two additional options. The get_groups option includes the user’s assigned groups in the command results. Results do not include nested groups for Active Directory users.

The sid_info option retrieves the Security Identifier (SID) and domain information for the user. In some instances retrieving SID and domain information makes the operation hang until the winbindd request timeout has been reached if the winbindd connection manager has not yet marked the domain as offline. Check the Active Directory service state prior to batch operations using this option.

From the CLI prompt, enter:

account user get_user_obj get_user_obj={“uid”: 3001}

Press Enter

From the account prompt, enter:

user get_user_obj get_user_obj={“uid”: 3001}

Press Enter

Where 3001 is the id number for the targeted account.

You can also use get_user_obj={“username”: “testuser”}, where testuser is the username of the targeted account.

account user get_user_obj get_user_obj={"username": "testuser", "get_groups": true, "sid_info": true}
+-----------+--------------+
|   pw_name | testuser     |
|    pw_uid | 3000         |
|    pw_gid | 65534        |
|  pw_gecos | Test User    |
|    pw_dir | /nonexistent |
|  pw_shell | /usr/bin/zsh |
| grouplist | 65534        |
|           | 3000         |
|           | 3009         |
|           | 545          |
|           | 3022         |
|           | 3002         |
|  sid_info | <null>       |
+-----------+--------------+

The has_local_administrator_set_up command does not require entering properties or values.

From the CLI prompt, enter:

account user has_local_administrator_set_up

From the account prompt, enter:

user has_local_administrator_set_up

account user has_local_administrator_set_up
true

The provisioning_uri command requires the username property. Enter the command, then press Enter. The command returns the OTP provisioning URI for authenticator app QR encoding.

From the CLI prompt, enter:

account user provisioning_uri username=username

Where:

• username is the user you want to see the provisioning URI for.

account user provisioning_uri username=admin	
otpauth://totp/mysystems:truenas%50TrueNAS?secret=Noni&is...	

Use pop_attribute to manage custom account attributes. Use cases for the attributes storage object include custom user metadata, access control, user categorization, integration with external systems, and automation and policies.

The command returns true if the attribute is successfully deleted. The command returns false if the specified key or user attribute does not exist.

From the CLI prompt, enter:

account user pop_attribute id=3001 key="favorite_color"

Press Enter

From the account prompt, enter:

account user pop_attribute id=3001 key="favorite_color"

Press Enter

Where 3001 is the UID of the target account and favorite_color is the account dictionary key to erase.

account user pop_attribute id=3001 key="favorite_color"
true

Enter the command with no additional attributes or properties to perform a basic query of all local users.

Add additional properties to return the value of the specified key(s) for all users. There are 23 query properties available.

Expanded information may be requested by specifying the extra option "extra": {"additional_information": []}.

There are two additional_information options supported.

From the CLI prompt, enter:

account user query

Press Enter

From the account prompt, enter:

user query

Press Enter

+-----+-----------+------------+------------+----------+-------+--------------+---------+---------+-----------------+--------+---------------+------------------------+------------+------------+--------+-------------+-----------+-----------+
| uid | username  | unixhash   | smbhash    | home     | shell | full_name    | builtin | smb     | password_disabled | locked | sudo_commands | sudo_commands_nopasswd | attributes | email      | group  | groups      | sshpubkey | immutable |
+-----+-----------+------------+------------+----------+-------+--------------+---------+---------+-----------------+--------+---------------+------------------------+------------+------------+--------+-------------+-----------+-----------+
| 0   | root      | *          |            | /root    | /...  | root         | true    | false   | true            | false  | <empty list>  | <empty list>           | <dict>     | <null>     | <dict> | b..._administrators | <null>    | true      |
| 1   | daemon    | *          |            | /root    | /...  | Owner...     | true    | false   | false           | false  | <empty list>  | <empty list>           | <dict>     | <null>     | <dict> | <empty list> | <null>    | true      |
...

Additional properties included in the command string return specific information.

account user query uid
+-------+
| uid   |
+-------+
| 0     |
| 1     |
| 2     |
| 5     |
| 9     |
| 6     |
| 111   |
| 13    |
| 10    |
...

query can also return information about a specific user.

The renew_2fa_secret command requires the username property. Enter the command, then press Enter. The command returns a table of user settings when successful, and displays an error if run when 2FA is not enabled.

From the CLI prompt, enter:

account user renew_2fa_secret username=username

Where:

• username is the user you want to renew the 2FA secret for.

account user renew_2fa_secret username=admin
+---------------------------+------------------------------------------------------------------+
|                        id | 33                                                               |
|                       uid | 950                                                              |
|                  username | admin                                                            |
|                  unixhash | $6$yhZKtncm0ZY1wGnU$d9t9UmrUfFca8f17y8FddYj6PTvpEdwNT3aOEQurH... |
|                   smbhash |                                                                  |
|                      home | /home/admin                                                      |
|                     shell | /usr/bin/zsh                                                     |
|                 full_name | Local Administrator                                              |
|                   builtin | false                                                            |
|                       smb | false                                                            |
|         password_disabled | false                                                            |
|      ssh_password_enabled | true                                                             |
|                    locked | false                                                            |
|             sudo_commands | ALL                                                              |
|    sudo_commands_nopasswd | <empty list>                                                     |
|                     email | user@email.com                                                   |
|                     group | <dict>                                                           |
|                    groups | 40                                                               |
|                 sshpubkey | <null>                                                           |
|                 immutable | true                                                             |
| twofactor_auth_configured | true                                                             |
|                     local | true                                                             |
|              id_type_both | false                                                            |
|                   nt_name |                                                                  |
|                       sid |                                                                  |
+---------------------------+------------------------------------------------------------------+

Use set_attribute to manage custom account attributes. Use cases for the attributes storage object include custom user metadata, access control, user categorization, integration with external systems, and automation and policies.

From the CLI prompt, enter:

account user set_attribute id=3001 key="favorite_color" value="blue"

Press Enter

From the account prompt, enter:

user set_attribute id=3001 key="favorite_color" value="blue"

Press Enter

Where 3001 is the UID of the account to update, favorite_color is the desired property, and blue is the corresponding value.

account user set_attribute id=3001 key="favorite_color" value="blue"
true

Enter the CLI from the Console setup menu before configuring a local administrator or root user account.

The command returns a blank line.

To confirm the administrator is set up, use has_local_administrator_set_up, get_user_obj, or log in to the SCALE Web UI using the admin username and password.

From the CLI prompt, enter:

account user setup_local_administrator username:admin password:passw0rt

Press Enter

From the account prompt, enter:

user setup_local_administrator username:admin password:passw0rt

Press Enter

Where passw0rt is the desired admin account password.

setup_local_administrator accepts only “admin” or “root” for username. It is recommended to use “admin.” Root user access is a deprecated method.

Enter the command with no additional properties to return shell choices available to all users.

Additional shell choices are available to users with administrative privileges (members of the builtin_administrators group). Use group_ids to retrieve all options available to members of that group.

From the CLI prompt, enter:

account user shell_choices

Press Enter

From the account prompt, enter:

user shell_choices

Press Enter

account user shell_choices
+-------------------+---------+
| /usr/sbin/nologin | nologin |
|     /usr/bin/bash | bash    |
|    /usr/bin/rbash | rbash   |
|     /usr/bin/dash | dash    |
|       /usr/bin/sh | sh      |
|      /usr/bin/zsh | zsh     |
|     /usr/bin/tmux | tmux    |
+-------------------+---------+

To view available shell options for accounts with admin privileges, use group_ids. Target the builtin_administrators group by GID or group name.

account user shell_choices group_ids=[544]
+----------------------+-----------------+
|    /usr/sbin/nologin | nologin         |
|         /usr/bin/cli | TrueNAS CLI     |
| /usr/bin/cli_console | TrueNAS Console |
|        /usr/bin/bash | bash            |
|       /usr/bin/rbash | rbash           |
|        /usr/bin/dash | dash            |
|          /usr/bin/sh | sh              |
|        /usr/bin/tmux | tmux            |
|         /usr/bin/zsh | zsh             |
+----------------------+-----------------+

[qe-scale-04]> account user shell_choices group_ids=["builtin_administrators"]
+----------------------+-----------------+
|    /usr/sbin/nologin | nologin         |
|         /usr/bin/cli | TrueNAS CLI     |
| /usr/bin/cli_console | TrueNAS Console |
|        /usr/bin/bash | bash            |
|       /usr/bin/rbash | rbash           |
|        /usr/bin/dash | dash            |
|          /usr/bin/sh | sh              |
|        /usr/bin/tmux | tmux            |
|         /usr/bin/zsh | zsh             |
+----------------------+-----------------+

Syntax and available properties for update closely follow those of create.

The command returns a blank line.

To confirm the user is updated, use get_user_obj or go to Credentials > Local Users in the SCALE Web UI.

From the CLI prompt, enter:

account user update uid_or_username=3001

Enter all properties and corresponding values to update.

Press Enter

From the account prompt, enter:

user update uid_or_username=3001

Enter all properties and corresponding values to update.

Press Enter

Where 3001 represents the UID or user name of the target account.

The verify_twofactor_token command requires the username and token properties. The property argument is separated by the = delimiter. Enter the command, then press Enter. The command returns boolean true if provided username and token are successfully authenticated.

From the CLI prompt, enter:

account user verify_twofactor_token username=username token=password

Where:

• username is the user you want to verify.
• password is the user password.

account user verify_twofactor_token username=admin token=abcd1234
true