Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If the second field of the /etc/shadow file is set to !!, does it mean that the account is disabled? Or does it mean that the account is active with no password assigned?

share|improve this question

migrated from stackoverflow.com Dec 6 '11 at 4:40

This question came from our site for professional and enthusiast programmers.

2 Answers 2

If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by other means e.g .key based login).

crypt() is the password encryption function. It is based on the Data Encryption Standard algorithm with variations intended (among other things) to discourage use of hardware implementations of a key search key is a user's typed password. Salt is a two-character string chosen from the set [a–zA–Z0–9./]. Following are some status exception values.

  • "NP" or "!" or null - No password, the account is locked, no user can log in.
  • "LK" or "*" - the account is Locked, user will be unable to log-in
  • "!!" - is a Red Hat convention that means a password has never been set before. It is treated the same as "!"

Sources: man shadow and man 3 crypt, Shadow File from Wikipedia and Red Hat.

share|improve this answer
    
This information contradicts what actually says in (my version of) man shadow. There is says that * or ! would mean a locked account..And for that matter that field can contain anything you want that is not a valid resolut of crypt function. So you can actually write in plain english ":this account is disabled:". If the 2nd field is empty, ie :: that means there's no password/any password will work. –  Mxx Oct 26 '12 at 18:25

That would mean an account disabled for password based login. An account with an empty password will have an empty field.

share|improve this answer
    
No, an account with !! in the password field of /etc/shadow can still log in. Just not with a password. A common case is an account that only allows ssh logins with a key pair. –  Gilles Dec 7 '11 at 0:01
    
Good catch @Gilles , updated answer. –  jman Dec 7 '11 at 1:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.