# Harvesting UIDs above 1000

**URL:** <https://forum.ansible.com/t/harvesting-uids-above-1000/34064>\
**Category:** Ansible Project\
**Tags:** rhel\
**Created:** [October 20, 2020, 3:27pm UTC](https://forum.ansible.com/t/harvesting-uids-above-1000/34064 "2020-10-20T15:27:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joseph\_Alexander](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@Joseph\_Alexander](https://forum.ansible.com/u/Joseph_Alexander)\
**Post date:** [October 20, 2020, 3:27pm UTC](https://forum.ansible.com/t/harvesting-uids-above-1000/34064/1 "2020-10-20T15:27:24Z")

</div>

I have a task from our program security to verify all local accounts on all of our RHEL servers and turn them in. I have a working playbook, but I’m wondering if there is a better, more cleaner way to do this.

I have a script that I place on each server that runs one command:  
for i in $(awk -F: ‘$3 \>= 1000 {print $1}’ /etc/passwd); do id $i; done \> results.txt

then I fetch that file and save it as the {{ ansible\_fqdn }}.txt

I was thinking there has to use a template to iterate through the passwd file something like this:  
{% for item in users %}  
{{ item }} {{ lookup(‘pipe’, "id -u " + item) }}  
then some type of when uid \>=1000 append it to results.txt line  
{% endfor %}

But I just cannot find anything on google about replacing that users variable with the passwd file or something similar. I appreciate any help. I could do it the first way, but would like a cleaner solution that uses ansible rather than scripts.

Thanks!

---

<div class="post-metadata">

**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\
**Post date:** [October 21, 2020, 6:10am UTC](https://forum.ansible.com/t/harvesting-uids-above-1000/34064/2 "2020-10-21T06:10:37Z")

</div>

> I have a task from our program security to verify all local accounts on all of our RHEL servers and turn them in. I have  
> a working playbook, but I'm wondering if there is a better, more cleaner way to do this.
> 
> I have a script that I place on each server that runs one command:  
> for i in $(awk -F: '$3 \>= 1000 {print $1}' /etc/passwd); do id $i; done \> results.txt
> 
> then I fetch that file and save it as the {{ ansible\_fqdn }}.txt
> 
> I was thinking there has to use a template to iterate through the passwd file something like this:  
> {% for item in users %}  
> {{ item }} {{ lookup('pipe', "id -u " + item) }}  
> then some type of when uid \>=1000 append it to results.txt line  
> {% endfor %}
> 
> But I just cannot find anything on google about replacing that users variable with the passwd file or something similar.  
> I appreciate any help. I could do it the first way, but would like a cleaner solution that uses ansible rather than scripts.

On modern systems passwd file is not authoritative (LDAP, Samba). The getent utility lists all users of the system  
(getent passwd) and there is a corresponding Ansible module.

So I suggest the following solution:

tasks:  
&nbsp;&nbsp;&nbsp;&nbsp;- name: Retrieve user information  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;getent:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;database: passwd  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;split: ':'  
&nbsp;&nbsp;&nbsp;&nbsp;- name: Build list of users with uid \>= 1000  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set\_fact:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;users: "{{ users | default() + [item.key] }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;when: item.value[1] | int \>= 1000  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;with\_dict:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"{{ getent\_passwd }}"  
&nbsp;&nbsp;&nbsp;&nbsp;- debug:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var: users

Regards  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Racke