43

The second field in the Linux /etc/shadow file represents a password. However, what we have seen is that:

  1. Some of the password fields may have a single exclamation 

    <account>:!:.....

  2. Some of the password fields may have a double exclamation 

    <account>:!!:.....

  3. Some of the password fields may have an asterisk sign

    <account>:*:.....

By some research on internet and through this thread, I can understand that * means password never established, ! means locked.

Can someone explain what does double exclamation (!!) mean? and how is it different from (!)?

Improve this question
  • Which distribution are you using? – muru Dec 28 '15 at 23:08
  • Hi Muru, am new to Unix and trying to create a script which will run on RHEL 6.6 and HP-UX B.11.23 – JavaTec Dec 28 '15 at 23:35
  • 3
    "By convention, accounts that are not intended to be logged in to (e.g. bin, daemon, sshd) only contain a single asterisk in the password field. Note that there is nothing special about ‘*’, it is just one of many characters that cannot occur in a valid encrypted password (see crypt(3))." --OpenBSD man page for passwd(5). I would expect ! or !! to be no different, technically, regarding whether it is a valid passwd file, or regarding logins. However, some tools might have special support. – TOOGAM Dec 29 '15 at 1:45
  • 2
    Don't use the BSDs' doco as references for this. Their accounts database handles things differently and does not even have an /etc/shadow file. Don't put answers into comments, either. ☺ – JdeBP Dec 29 '15 at 8:17
34

Both "!" and "!!" being present in the password field mean an account is locked.

As it can be read in the following document, "!!" in an account entry in shadow means the account of an user has been created, but not yet given a password. Until being given an initial password by a sysadmin, it is locked by default.

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/System_Administration_Guide/s2-redhat-config-users-process.html

Improve this answer
  • 4
    This maybe true on Red Hat systems, but not necessarily elsewhere - on Ubuntu or Arch Linux, a newly-created account with no password still has only !, not !!. – muru Dec 28 '15 at 23:06
  • 2
    True indeed that I have never seen a "!!" in a Debian system. I would guess the OP is using some RH-based system, or SuSE. – Rui F Ribeiro Dec 28 '15 at 23:09
  • Thank you for your quick answers, would the above explanation provided by Rui - hold good for an hp-ux as well? – JavaTec Dec 28 '15 at 23:50
  • 4
    @JavaTec Not necessarily: I think all unices that have a /etc/shadow have the same field but how the password field stores non-password information varies. Check the HP-UX documentation, starting with the shadow man page. – Gilles 'SO- stop being evil' Dec 28 '15 at 23:57
  • 1
    HP-UX did not even have /etc/shadow until relatively recently: before HP-UX 11.11, the options were either classic shadowless /etc/passwd or "Trusted Computing Base", that stored each user's password hashes and other account information in individual files named /tcb/files/auth/<initial>/<username>, readable only by root. In HP-UX 11.11, /etc/shadow was introduced as an optional extra, in 11.23 it was an option in the base OS, and in 11.31 the TCB was finally deprecated. – telcoM Jan 21 '19 at 21:32
8

It may also be worth noting <account>::..... meaning that there is no password required (empty password).

If you are creating an ssh key-only user you could use <account>::0:0:99999:7::: to require that the user set their password (i.e. that they use for sudo) on their first login.

Note: key-only authentication means that a password is NOT an authentication factor.

Improve this answer
  • 10
    Beware of this. An empty field means there is no password, and you just have to press ENTER to login, at least in the console. – Rui F Ribeiro May 4 '17 at 12:28
  • 1
    From man shadow regarding encrypted password field: "This field may be empty, in which case no passwords are required to authenticate as the specified login name." <-- Leaving this field emtpy results in open account and this should indeed be avoided! – Laas Oct 15 '19 at 12:48
  • Note that many SSH implementations block login on null passworded accounts by default: sudo /usr/sbin/sshd -T| grep empty would return: "permitemptypasswords no" – Brian Huntley Nov 4 '19 at 15:58
  • Changed the answer to clarify that I meant key-only login. – coolaj86 Apr 13 '20 at 1:26
  • Another note, why one should never use empty passwords. Think about what happens if you install any software that uses "linux-authentication"? E.g. phpMyAdmin would than allow logins without a password. This can be very dangerous. And key only users should have "!" – K. Frank Nov 3 '20 at 6:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.