/ 
Rex-1.16.1
⭐ Starred 717 / Rex::Commands::User
Security Advisories (1)
CVE-2026-94140 (2026-10-21)

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.

NAME

Rex::Commands::User - Manipulate users and groups

DESCRIPTION

With this module you can manage user and groups.

SYNOPSIS

use Rex::Commands::User;

task "create-user", "remoteserver", sub {
  create_user "root",
    uid         => 0,
    home        => '/root',
    comment     => 'Root Account',
    expire      => '2011-05-30',
    groups      => [ 'root', '...' ],
    password    => 'blahblah',
    system      => 1,
    create_home => TRUE,
    shell       => '/bin/bash',
    ssh_key     => "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChUw...";
};

EXPORTED FUNCTIONS

account($name, %option)

Manage user account.

account "krimdomu",
  ensure         => "present",  # default
  uid            => 509,
  home           => '/root',
  comment        => 'User Account',
  expire         => '2011-05-30',
  groups         => [ 'root', '...' ],
  login_class    => 'staff',   # on OpenBSD
  password       => 'blahblah',
  crypt_password => '*', # on Linux, OpenBSD and NetBSD
  system         => 1,
  create_home    => TRUE,
  shell          => '/bin/bash',
  ssh_key        => "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChUw...";

There is also a no_create_home option similar to create_home but doing the opposite. If both used, create_home takes precedence as it the preferred option to specify home directory creation policy.

If none of them are specified, Rex follows the remote system's home creation policy.

The crypt_password option specifies the encrypted value as found in /etc/shadow; on Linux special values are '*' and '!' which mean 'disabled password' and 'disabled login' respectively.

create_user($user => {})

Create or update a user.

This function supports the following hooks:

before

This gets executed before the user is created. All original parameters are passed to it.

after

This gets executed after the user is created. All original parameters, and the user's UID are passed to it.

get_uid($user)

Returns the uid of $user.

get_user($user)

Returns all information about $user.

user_groups($user)

Returns group membership about $user.

user_list()

Returns user list via getent passwd.

task "list_user", "server01", sub {
  for my $user (user_list) {
    print "name: $user / uid: " . get_uid($user) . "\n";
  }
};

delete_user($user)

Delete a user from the system.

delete_user "trak", {
  delete_home => 1,
  force     => 1,
};

lock_password($user)

Lock the password of a user account. Currently this is only available on Linux (see passwd --lock) and OpenBSD.

unlock_password($user)

Unlock the password of a user account. Currently this is only available on Linux (see passwd --unlock) and OpenBSD.

create_group($group, {})

Create or update a group.

create_group $group, {
  gid => 1500,
  system => 1,
};

get_gid($group)

Return the group id of $group.

get_group($group)

Return information of $group.

$info = get_group("wheel");

delete_group($group)

Delete a group.