Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

An install document I'm following instructs to add a user like so:

sudo adduser --disabled-login --gecos 'GitLab' git

The --disabled-login flag is absent from most man pages I have searched.

I've made two users, one with the --disabled-login (foo), and one without (git).

As far as I can tell the --disabled-login flag does nothing. I can still su to both users, and both use /bin/bash as their login shell.

The only difference I can see is getent passwd has extra commas before the home folder on the user that has login's disabled. There is no documentation that I can find to indicate what this would mean.

root@gitlab:~# getent passwd git
git:x:998:998:GitLab:/home/git:/bin/bash  

root@gitlab:~# getent passwd foo
foo:x:1001:1002:GitLab,,,:/home/foo:/bin/bash

UPDATE #1

I've found another difference, one user has a * as their password, the other has !:

root@gitlab:~# getent shadow git
git:*:15998::::::
root@gitlab:~# getent shadow foo
foo:!:15998:0:99999:7:::

What exactly does --disabled-login do on Ubuntu?

share|improve this question
    
For the record, the extra commas separate the fields within the "gecos" field: full name, room number, work phone, home phone. I don't know why they would be present in one version and not the other though. You can find documentation on this in the manpage of the chfn tool. –  Random832 Oct 21 '13 at 2:47
    
That makes sense. I accidentally chose 'y' when prompted to enter in that information when I added one of the users. The other user was added through puppet. –  spuder Oct 21 '13 at 4:16

2 Answers 2

up vote 5 down vote accepted

The explanation is not well documented.

--disabled-login sets the password to !

Password values

NP or null = The account has no password
*  = The account is deactivated & locked
!  = The login is deactivated, user will be unable to login
!!  = The password has expired

Examples

root@gitlab:~# getent shadow vagrant
vagrant:$6$abcdefghijklmnopqrstuvwxyz/:15805:0:99999:7:::

root@gitlab:~# getent shadow foo
foo:!:15998:0:99999:7:::

root@gitlab:~# getent shadow git
git:*:15998::::::

wikipedia briefly covers this. It appears that * and ! effectively do the same thing; prevent the user from logging in (but not from su'ing from a different user)

share|improve this answer

It's partially discussed here in the shadow man page.

excerpt

$ man shadow
...
...
encrypted password
     Refer to crypt(3) for details on how this string is interpreted.

     If the password field contains some string that is not a valid result of 
     crypt(3), for instance ! or *, the user will not be able to use a unix
     password to log in (but the user may log in the system by other means).

     This field may be empty, in which case no passwords are required to 
     authenticate as the specified login name. However, some applications which
     read the /etc/shadow file may decide not to permit any access at all if the
     password field is empty.

     A password field which starts with a exclamation mark means that the 
     password is locked. The remaining characters on the line represent the 
     password field before the password was locked.

Depending on your version of the man page for adduser it's referenced there.

excerpt adduser man page

--disabled-login
       Do  not  run passwd to set the password.  The user won't be able
       to use her account until the password is set.

--disabled-password
       Like --disabled-login, but logins are still possible (for  exam-
       ple using SSH RSA keys) but not using password authentication.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.