Tag Info

New answers tagged

4

usermod is a tool for modifying the local /etc/passwd database. It cannot be used to modify accounts delivered through Active Directory. id on the other hand looks up any user account regardless of its source. (Actually this is controlled with the passwd setting in nsswitch.conf but if you have integrated AD you'll be using multiple sources.) As mentioned ...


1

You should first initialize the passwd of your user : $passwd system-user then return two times in order to create a blank passwd. You can verify that there's no passwd in the file /etc/shadows (the second field should be empty). But yes, this account will not be protected even with no $HOME neither shell. All users with a sudo account will be able to ...


2

The account will be setup without login possibilities as there is no valid password assigned to the account, and that is different from no password. You can check this by doing sudo grep -f system-user /etc/shadow. The second field (between the first and second colon (:)) will be a '*' and no hash of any password you can provide will match against that. ...


0

A few pedantic notes: Users often have poor passphrase. Users can change passphrases. User can store their keys in multiple places. Users are likely to use ssh agent so they can unlock the key once, say on their laptop.


0

Sorry I misunderstood your question at first. If you just need to alter a user to have no password, you can just run sudo passwd -d <name of user> Alternatively, if you only plan on logging in to the password-less user using su, just run it like this: `sudo su <user>` You will have to enter your password for sudo, as per usual, unless you ...


5

An email thread: http://www.sudo.ws/pipermail/sudo-users/2002-September/001225.html http://www.sudo.ws/pipermail/sudo-users/2002-September/001226.html .. points out that sudo -u nobody [cmd ...] can be used: (Combined with the trick of How to append to a file as sudo) echo "Hello World" | sudo -u nobody tee -a /tmp/logfile.log


1

I found a solution to this problem: The actual user ID was stored in environment variable $ORIG_USER. This works in our environment; YMMV.


0

The Fedora Project has a list of best practices. Basically, the idea is that if a package requires a specific group, user/group management should be handled by the rpm install script using useradd or groupadd and should use getent to determine if the user or group it needs already exists. This allows administrators the flexibility to manage system ...


0

I realize this is an old question, but I came here trying to find how to create groups in an rpm spec file. Hopefully, the following will be helpful. To check if if a group exists and see which users are part of it, use getent group root for group "root" for example. I also found the following helpful as a standard way to add groups in an rpm spec file: ...


3

Don't try making the login name longer, you'll probably find loads of places it breaks. Note that you don't have a problem with the number of possible login names (you only get UID_MAX-UID_MIN uids anyway, which is 59,000 on my system). The problem is just with how descriptive they are, but fortunately there's another field intended to be descriptive: the ...


0

I was looking for something like this (bash): hash=$(sudo cat /etc/shadow |grep "^$USER:" |cut -d: -f2) cmphash=$(mkpasswd -m sha-512 -S "$(echo "$hash" | cut -d '$' -f3)") cmp <(echo "$hash") <(echo "$cmphash") && echo "Correct password!" This works but harcodes the hash method which somehow identified by the number in echo "$hash" | cut ...


3

Most modern Unix systems use PAM to handle authentication. The pam_unix module is the one that does password authentication against /etc/password and /etc/shadow. However, you shouldn't reinvent the wheel. Asking for the user's password and running as root is a basic configuration of sudo, the de facto standard way to elevate privileges. Note that properly ...


3

Just call useradd and pass it the arguments you want. To create a system user, passs the -r option. If you don't want a home directory, pick something like /none and pass the -M option. If you want to be able to use su to run commands as that user, the user needs to have a valid shell. useradd -r -d /none -M -U -s /bin/sh I don't recommend modifying the ...


0

Simply adding an entry to /etc/passwd seems to do the job and work. I guess useradd is more robust as it does a couple of additional things without doing needless stuff like setting up a user directory. (It's a little weird though, that for such a small thing it needs to take 200ms and open and close /etc/passwd about 900 times as it strace shows.)


0

Simply create the user as usual, don't give it any password. Rm -rf the /home/thatuser directory, and edit /etc/passwd to set the shell for that user to /bin/false. You could model the /etc/passwd entry after other system users you may see in there. Just make sure you understand the /etc/passwd entry and google it if you need to. Of course also make sure ...


0

You have to remove the user from the group plugdev


3

About your actual question, see taliezin's answer (and accept that one ;) About your other problem: Search for the string 8sh9JBUR0VYeQ on the disk to figure out the disk block(s) it resides in. Then dd that disk block(s) into a file, replace that string with a known password hash (the old crypt() one - same length) and write the disk block(s) back to the ...


13

The accounts with passwords are the accounts with a glob of base64 gibberish in the second field: root:8sh9JBUR0VYeQ:0:0:Super-User,,,,,,,:/:/bin/ksh lp:VvHUV8idZH1uM:9:9:Print Spooler Owner:/var/spool/lp:/bin/sh This computer appears to be using the traditional, DES-based crypt(3) password hash. This hash is quite weak by modern standards; if you can't ...


0

The permission udiskctl using is based on a polkit policy, look here for an example: https://wiki.archlinux.org/index.php/Udisks#Configuration Check what you current polkit policy states (in the arch example it grants the permission to the storage group). Either remove the user from the appropriate groups or modify the policy.


19

You have to check man passwd: If the encrypted password is set to an asterisk (*), the user will be unable to login using login(1), but may still login using rlogin(1), run existing processes and initiate new ones through rsh(1), cron(8), at(1), or mail filters, etc. Trying to lock an account by simply changing the ...


8

This means that it is disabled for direct login. It is a user that is used for running services or to be used for rlogin. Check https://en.wikipedia.org/wiki/Passwd#Password_file



Top 50 recent answers are included