If the second field of the /etc/shadow file is set to !!, does it mean that the account is disabled? Or does it mean that the account is active with no password assigned?
Add a comment
|
2 Answers
If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by other means e.g .key based login).
crypt() is the password encryption function. It is based on the Data Encryption Standard algorithm with variations intended (among other things) to discourage use of hardware implementations of a key search key is a user's typed password. Salt is a two-character string chosen from the set [a–zA–Z0–9./]. Following are some status exception values.
- "NP" or "!" or null - No password, the account is locked, no user can log in.
- "LK" or "*" - the account is Locked, user will be unable to log-in
- "!!" - is a Red Hat convention that means a password has never been set before. It is treated the same as "!"
Sources: man shadow and man 3 crypt, Shadow File from Wikipedia and Red Hat.
answered Dec 6, 2011 at 5:54
-
This information contradicts what actually says in (my version of)
man shadow. There it says that * or ! would mean a locked account..And for that matter that field can contain anything you want that is not a valid resolut ofcryptfunction. So you can actually write in plain english ":this account is disabled:". If the 2nd field is empty, ie :: that means there's no password/any password will work.– MxxCommented Oct 26, 2012 at 18:25
That would mean an account disabled for password based login. An account with an empty password will have an empty field.
-
No, an account with
!!in the password field of/etc/shadowcan still log in. Just not with a password. A common case is an account that only allows ssh logins with a key pair. Commented Dec 7, 2011 at 0:01 -