What should be in the /etc/shadow file if I want my root account to be disabled?

Question

On one of my machines it's root::somenumber[...]::: with somenumber[...] being the same as for my actual account (after what appears to be the encrypted passphrase) and the "logcheck" account (after :*:). On another machine it's root :!:somenumber[...]::: with somenumber[...] being the same for all accounts until the most recently added ones starting with postfix:*:.

I didn't enter a root password during installation for both of these machines. However I accidentally set it for one of them and had to remove it again using the passwd -d root command. I'm running Debian 9.1 with KDE.

What exactly should be in there if I wish for my root account to be locked (I use the sudo command)? Are those file contents fine?

^{And related to this would also be this question: how can I view a history of changes to the shadow file including info on which user changed what and when.}

Answer 1

From: man 5 shadow:

A password field which starts with a exclamation mark means that the password is locked. The remaining characters on the line represent the password field before the password was locked.

Without anything, it means you don't have any password for that account.

This field may be empty, in which case no passwords are required to authenticate as the specified login name. However, some applications which read the /etc/shadow file may decide not to permit any access at all if the password field is empty.

The *:

If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by other means).

We use it when we don't want to lock an account but don't permit it to login, say for users that are in charge of some kind of service and login is not necessary for them but they're not locked down.

Finally the number you are asking for is: "date of last password change" for that account.