On one of my machines it's root::somenumber[...]::: with somenumber[...] being the same as for my actual account (after what appears to be the encrypted passphrase) and the "logcheck" account (after :*:). On another machine it's root :!:somenumber[...]::: with somenumber[...] being the same for all accounts until the most recently added ones starting with postfix:*:.

I didn't enter a root password during installation for both of these machines. However I accidentally set it for one of them and had to remove it again using the passwd -d root command. I'm running Debian 9.1 with KDE.

What exactly should be in there if I wish for my root account to be locked (I use the sudo command)? Are those file contents fine?

And related to this would also be this question: how can I view a history of changes to the shadow file including info on which user changed what and when.


From: man 5 shadow:

A password field which starts with a exclamation mark means that the password is locked. The remaining characters on the line represent the password field before the password was locked.

Without anything, it means you don't have any password for that account.

This field may be empty, in which case no passwords are required to authenticate as the specified login name. However, some applications which read the /etc/shadow file may decide not to permit any access at all if the password field is empty.

The *:

If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by other means).

We use it when we don't want to lock an account but don't permit it to login, say for users that are in charge of some kind of service and login is not necessary for them but they're not locked down.

Finally the number you are asking for is: "date of last password change" for that account.

  • Okay. However I thought that absolutely no applications can authenticate as root when I removed its password? (via this question here) I locked it in addition now. So the rest of the file's contents are fine? Why are those numbers repeated for many accounts? – mYnDstrEAm Aug 6 '17 at 20:28
  • Updated the answer ... – Ravexina Aug 6 '17 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.