12

sync is one of the user account created by Debian itself. I'm wondering why Debian sets its login shell to /bin/sync instead of /bin/false. How does Debian use this user account?

21

This is documented in /usr/share/doc/base-passwd/users-and-groups.txt.gz:

sync

The shell of user sync is /bin/sync. Thus, if its password is set to something easy to guess (such as ""), anyone can sync the system at the console even if they have no account on the system.

This is really a historical artifact, I wouldn't expect a sync user to be set up in this way nowadays. In the past it would be useful to have such a user so that people with physical access to a console (e.g. in a server room or a lab full of workstations, as you'd find in universities) could reduce the risk of data loss when shutting down a system (to recover from a rogue process or simply to use the workstation, if it had been left locked by its previous user). Unix systems before Debian tended to have a sync user and a shutdown user with which you could actually shut a system down properly without knowing the root password. (On our Sun SPARCstations we'd just STOPA boot...)

It's worth noting, as Peter Cordes mentioned, that other mechanisms are available on many systems to ensure safe shutdowns or reboots from a console without being able to authenticate as root: ACPI events triggered by pressing the power switch (which lead to a clean shutdown), or CtrlAltDel (which leads to a clean reboot). AltSysRq can be used as a last resort to sync, kill, unmount and reboot, but it's not a clean reboot. As mentioned by JdeBP, having a sync user is a very old idea, dating back at least to the early 1980s.

  • 4
    Users aren't expected to do anything. Admins are able to set the system up in this way, if they want to. The historical context is relevant here: back when the sync user was added, the Alt+SysRq combos didn't exist, and a Linux system was more likely to be a server somewhere or a shared system in a lab, than a single-user laptop or desktop. It was useful to provide a way people with access to the console could safely prepare a system for an unclean shutdown, so they could reboot systems without having root access while reducing the risk of data loss. – Stephen Kitt Dec 5 '16 at 14:10
  • 2
    Worth pointing out that instead of having a shutdown account, default installs of some (many?) Linux distros are set up such that ctrl+alt+f1 (to get to a text console in case the current VT is running a graphical login screen) followed by ctrl+alt+del triggers a shutdown -r now or equivalent. So physical access = ability to trigger a clean reboot, even without SysRQ. – Peter Cordes Dec 5 '16 at 17:05
  • 1
    @PeterCordes note "Unix systems before Debian" — this is pre-1993 ;-). But yes, on current systems there are often other ways of doing things without using sync or shutdown users. (To be extra-nit-picky, many Linux distros have the DM on VT1 nowadays. Some don't even have any text VTs any more!) – Stephen Kitt Dec 5 '16 at 17:11
  • 1
    back when the sync user was added ... Linux as an idea didn't exist. This convention goes back to the early 1980s, at least. – JdeBP Dec 5 '16 at 17:12
  • 1
    @FedericoPoloni in the past, shutdown didn't sync, you had to do both manually. – Stephen Kitt Dec 5 '16 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.