class nodo::subsystem::media::groups { group { 'incoming': ensure => 'present', } user::manage { "incoming": password => '*', ensure => present, shell => '/bin/false', require => Group['incoming'], } }