Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I found some entries in a shadow file whose meaning I don't understand.

user:UP:::::::
user1:NP:::::::

What does UP and NP mean? In addition to those 2, the same shadow file has the normal hashed entry and the LK that indicates a locked account.

The machine is a Solaris 10 VM.

share|improve this question
add comment

3 Answers 3

up vote 5 down vote accepted

NP in the password field of /etc/shadow indicates that that the account cannot be logged into with a password but can be logged into with other authentication methods, such as su down from root or cron jobs. NP means that password authentication will always fail, but other login methods may succeed. You can set an account in this state with passwd -N. This differs from *LK* (reported as LK by passwd -s), which disables all logins to the account regardless of the authentication method.

Confusingly, when passwd -s sees NP in /etc/shadow, it reports NL, whereas NP in the passwd -l report indicates that the account is open to all winds: users will be authenticated without even getting a password prompt (this is indicated by an empty password field in /etc/shadow).

UP is a documented code in the passwd -s output on Solaris 11 (not on Solaris 11 Express). It means that “this account has not yet been activated by the administrator and cannot be used.” If I understand the documentation correctly, its effect is similar to NP; the intent is that the system administrator will run passwd later to set a password (i.e. it's the first stage in the process where the admin creates the account for a future user, then later has the user type a password when they first come on-site). The documentation doesn't indicate whether passwd -s reports UP when it finds that in /etc/shadow; while this is plausible, the confusion around NP invites caution.

Usually, anything in the password field of /etc/shadow (or other password database) that isn't an empty string is treated as a hashed password, and leads to a denied authentication if it doesn't match any of the valid hashed password formats. This is the case with normal password authentication on OpenSolaris, I can't speak for other versions but would be somewhat surprised if this wasn't the case.

Note that if there are several entries for the same user, I think only the first one is taken into account. (At least that's the case under Linux, and I have no reason to believe that Solaris would be different in this respect.)

share|improve this answer
add comment

Interesting question, google says,

The NP in the /etc/shadow file stands for No Password. It has the effect of not allowing someone to log into it, but su/sudo always works. Not sure how that differs from LK

share|improve this answer
    
Thanks, hopefully someone else will have a better idea of what it means. –  Terry Chia Oct 27 '12 at 12:06
add comment

NP differs from LK in that:

  • NP allows other authentication forms to work (e.g. ssh keys)
  • NP allows cron jobs to run (the account is not disabled)

  • LK prevents other forms of authentication (but su from root works because it bypasses authentication)

  • LK prevents cron jobs from running
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.