24

A sample /etc/group file contains the following entries:

root:*:0:
adm:!:4:logcheck
antoine:x:1000:

The man pages I've read (Debian & OSX) says the second field is to store a group password. As they are rarely used, an asterisk * or a x is usually placed in it rather than leaving it blank.

The shadow man page also says that this second field should store the result of the crypt function. And if an invalid result is stored (such as * or !) it means the password cannot be used as authentication method.

Does that hold true for the group file as well? Why do I end up with 3 different characters in my group file all having the same meaning? Can I safely change all to *?

Improve this question
2
  • What would you accomplish by changing them all to *?
    – jordanm
    Aug 28, 2012 at 15:00
  • I'm only seeing the ! being used for a single group on a single server out of 10+ I currently manage. For the simplicity of some checking scripts, always having the same char there would clear up things. Well, if it actually means the same, of course.
    – Lætitia
    Aug 28, 2012 at 15:04

1 Answer 1

Reset to default
33

You are thinking that the !, * or x has a special meaning here, and are therefore worrying that there might be some distinction among them.

The fact is that these characters are chosen simply because they stand out, at least to Western eyes. These characters connote a missing value, or an exception case, or a warning. You could put boogabooga here and have exactly the same effect.

This is because of the way passwords are handled on Unix type systems. When the system receives a password entry, it hashes it and compares it to the stored hash. Therefore, all that matters here is that you use some character or sequence of characters that cannot possibly be a valid password hash. (It also mustn't include a colon, for obvious reasons.)

Though there is no difference between these characters from the core OS's perspective, there are some conventions:

  • When the Linux pwconv(8) program sees x, it takes that to mean "I have already moved this public password hash to the shadow password file."

    That's not an important case in practice because the days of converting to (or, heaven help you, from) shadow passwords are behind us now.

  • If you use usermod -L or passwd -l to lock a user, ! has special meaning in /etc/shadow because that's the convention for "break this hash so it doesn't match any more."

    Adding any other character to the stored hash would break it just as well. Violating this convention merely prevents usermod -U or passwd -u from unlocking the user's login. Just as equally true, since you locked it by hand by adding a bogus character, you can unlock it by hand by removing it.

    All that is just trivia with respect to this question, however. There is no groupmod -L or gpasswd -l, hence no ! convention in /etc/group.

    More trivia: if you are going to lock user accounts by hand, you should stay away from the [A-Za-z0-9/\] set, since those are legal characters for the hash. That's one reason usermod uses ! here instead of x.

I don't see anything wrong with normalizing all your /etc/group password fields, if that makes you feel better. By doing so, you are already saying you're happy hacking these files by hand, so you're probably not the sort to be using the tools that care about the distinctions anyway. Regardless, the change isn't going to have an effect on day-to-day system operation.

Improve this answer
4
  • Thanks for your very complete answer. Currently writing scripts to check users and groups on my servers, I also wanted to know if any other char or char sequence could be found in that field. From your answer, and the not so trivial details, I have a far better view on this. Thanks again!
    – Lætitia
    Aug 28, 2012 at 18:38
  • 1
    For scripting, you should probably be calling getpwent(3) and friends. Perl has wrappers for these in its standard library, as should any other Unix sysadmin focused scripting language. If you're using a language without such wrappers, this would be a good excuse to trade up. :)
    – Warren Young
    Aug 28, 2012 at 19:06
  • If you are still reading things that are almost six years old... Thank you for the answer, I see some of the historical reasons people use things like x and * to mark an "unused" password field. Just curious though... the man page says that the field may very well be left empty (what in the database field may be called NULL - especially in Oracle which defines NULL and empty string to be the same). So, back to /etc/group: why use x or ! or *, instead of just leaving the field empty? Two consecutive colons stand out just as well as any of these characters. Not important - just curious
    – user196998
    Mar 31, 2018 at 23:40
  • 1
    @mathguy: An empty password field means "no password," not the same thing as a password field containing a character that can never match a real password. Since most Unix systems don't use group passwords, it's a distinction without a difference there, but you wouldn't want to develop a habit that will get you into trouble, such as with most Linux systems' /etc/shadow. Also, I reject the notion that a double colon is just as clear. Quick, how many empty fields are here: ::::::? Now how many: :x:*:!:x:*:? Same number of colons, but different answers, I trust.
    – Warren Young
    Apr 2, 2018 at 1:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .