PTS_CREATEUSER(1)

💖 PTS_CREATEUSER 💖 (that's the pts_createuser page from the AFS Command Reference bestie, section 1 of the manual, okurrr)

---

✨ NAME ✨

pts_createuser — makes a brand new user entry or machine entry in the Protection Database. that's it, that's the whole job, and she does it flawlessly 💅

---

🌸 SYNOPSIS 🌸

pts createuser -name <user name>+ [-id <user id>+]
    [-cell <cell name>] [-noauth] [-localauth] [-force]
    [-help] [-auth] [-encrypt] [-config <config directory>]

pts createu -na <user name>+ [-i <user id>+]
    [-c <cell name>] [-no] [-l] [-f] [-h]
    [-a] [-e] [-co <config directory>]

pts cu -na <user name>+ [-i <user id>+]
    [-c <cell name>] [-no] [-l] [-f] [-h]
    [-a] [-e] [-co <config directory>]

three whole aliases so you can be lazy in whichever direction you prefer, no judgement 🫶

---

🦋 DESCRIPTION 🦋

okay so. pts createuser creates an entry in the Protection Database for each user or machine you name with the -name argument. not just the first one — each one. she's an overachiever, we love that for her.

For a user entry, the name you give becomes that user's AFS username — the one you type when you authenticate with the AFS Authentication Server. iconic.

For a machine entry, the name is the machine's IP address, or a wildcard notation that stands for a whole range of consecutive IP addresses (basically a group of machines hanging out on the same network). Now, plot twist: you literally cannot authenticate as a machine. nope. but a group that a machine entry belongs to can show up on a directory's access control list (ACL), which grants the listed permissions to any user who happens to be logged on to that machine. so the machine is like. a backstage pass for everyone using it. 💀

AFS user IDs (AFS UIDs) are positive integers, and by default the Protection Server hands out an AFS UID that is one greater than the current value of the "max user id" counter in the Protection Database, then bumps the counter up by one for each user. Want a specific AFS UID? use the -id argument, bestie. And here's the tea: if any of the AFS UIDs you specify is greater than the current value of the "max user id" counter, the counter gets reset to that value. It's totally fine to specify an AFS UID smaller than the current counter value, but the creation operation fails if an existing user or machine entry already has it. so like. pick a free one. 🙈 To display or set the value of the "max user id" counter, use the pts listmax or pts setmax command, respectively.

The person who issues the pts createuser command gets recorded as the entry's creator, and the group system:administrators becomes its owner. cute little paper trail, we stan accountability ✨

---

😭 CAUTIONS 😭

⚠️ The Protection Server reserves several AFS UIDs — including 0 (zero) and 32766 (anonymous) — for internal use, and it will straight up return an error if your -id argument has a reserved value. do not try it. she will not be nice about it.

---

💅 OPTIONS 💅

• -name <user name>+ — names either a username for a user entry, or an IP address (complete or wildcarded) for a machine entry. let's break it down:
  • A username can include up to 63 numbers and lowercase letters, but honestly? keep it shorter than eight characters, because so many application programs just cannot handle longer names. also, best to skip shell metacharacters and other punctuation marks. In particular, the colon (":") and at-sign ("@") characters are not acceptable. The period is generally used only in special administrative names, to separate the username and an instance, like in the example "pat.admin".
  • A machine identifier is its IP address in dotted decimal notation (for example, 192.12.108.240), or a wildcard notation that represents a set of IP addresses (a group of machines on the same network). here are the acceptable wildcard formats — the letters "W", "X", "Y" and "Z" each represent an actual number from the range 1 through 255:
    • W.X.Y.Z represents a single machine, for example 192.12.108.240.
    • W.X.Y.0 matches all machines whose IP addresses start with the first three numbers. For example, 192.12.108.0 matches both 192.12.108.119 and 192.12.108.120, but does not match 192.12.105.144.
    • W.X.0.0 matches all machines whose IP addresses start with the first two numbers. For example, the address 192.12.0.0 matches both 192.12.106.23 and 192.12.108.120, but does not match 192.5.30.95.
    • W.0.0.0 matches all machines whose IP addresses start with the first number in the specified address. For example, the address 192.0.0.0 matches both 192.5.30.95 and 192.12.108.120, but does not match 138.255.63.52.

Do not define a machine entry with the name 0.0.0.0 to match every machine. The system:anyuser group is equivalent. do not be that girl. 🚫

• -id <user id>+ — specifies an AFS UID for each user or machine entry, instead of letting the Protection Server assign it. give it a positive integer.

If you use this argument while -name names multiple new entries, it's best to provide an equivalent number of AFS UIDs. The first UID goes to the first entry, the second to the second entry, and so on. If there are fewer UIDs than entries, the Protection Server assigns UIDs to the unmatched entries based on the "max user id" counter. If there are more UIDs than entries, the excess UIDs are just ignored (they're not getting an invite, sorry 💀). And if any of the UIDs is greater than the current value of the "max user id" counter, the counter is reset to that value.

• -auth — use the calling user's tokens to communicate with the Protection Server. For more details, see pts(1).
• -cell <cell name> — names the cell in which to run the command. For more details, see pts(1).
• -config <config directory> — use an alternate config directory. For more details, see pts(1).
• -encrypt — encrypts any communication with the Protection Server. For more details, see pts(1).
• -force — lets the command keep going as far as possible when errors or other problems show up, instead of halting execution at the first error. she's resilient. she's in her healing era. 💪
• -help — prints the online help for this command. all other valid options are ignored (they're just background characters).
• -localauth — constructs a server ticket using a key from the local /etc/openafs/server/KeyFile file. Do not combine this flag with the -cell or -noauth options. For more details, see pts(1).
• -noauth — assigns the unprivileged identity anonymous to the issuer. For more details, see pts(1).

---

🌈 OUTPUT 🌈

The command generates the following string to confirm creation of each user:

User <name> has id <id>

certified girlboss behaviour honestly 👑

---

⭐ EXAMPLES ⭐

The following example creates a Protection Database entry for the user "johnson".

% pts createuser -name johnson

The following example creates three wildcarded machine entries in the Example Corporation cell. The three entries encompass all of the machines on the company's networks without including machines on other networks:

% pts createuser -name 138.255.0.0 192.12.105.0 192.12.106.0

---

🔥 PRIVILEGE REQUIRED 🔥

The issuer must belong to the system:administrators group. no group, no entry, that's the rules bestie 🎀

---

🎀 SEE ALSO 🎀

pts(1), pts_listmax(1), pts_setmax(1)

---

💜 COPYRIGHT 💜

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.

---

and that's the whole page 🫶 this was OpenAFS, dated 2026-07-27, for the pts_createuser(1) page — go forth and create some entries, you absolute legend 💖✨🌸