BASH: Check in /etc/shadow if user password is locked

Question

Objective: Check in /etc/shadow if user password is locked, i.e. if the first character in the 2nd field in /etc/shadow, which contains the user's hashed password, is an exclamation mark ('!')

Desired output: a variable named $disabled containing either 'True' or 'False'

Username is in the $uname varable and I do something like this:

disabled=`cat /etc/shadow |grep $uname |awk -F\: '{print$2}'`
# I now have the password and need one more pipe into the check for the character
# which is where I'm stuck. I would like to do like (in PHP syntax):
| VARIABLE=="!"?"True":"False"`

This is a fragment of a script that will be run by Cron with root permissions, so there is access to all desirable information.

Answer 1

Don't parse the shadow file manually

Parsing such files is fragile if you fail to account for all eventualities (for example, disabled passwords are often encoded as a single *; do other solutions deal with that?).

Additionally, authentication may not happen through shadow (but instead through NIS or ldap or who knows what).There are standard tools that will deal with all this for you. In this case, passwd:

-S, --status Display account status information. The status information consists of 7 fields. The first field is the user's login name. The second field indicates if the user account has a locked password (L), has no password (NP), or has a usable password (P). The third field gives the date of the last password change. The next four fields are the minimum age, maximum age, warning period, and inactivity period for the password. These ages are expressed in days.

So passwd -S | cut -d ' ' -f 2 will yield what you need. A simple if/then will translate it to your desired variable:

if [ "$(passwd -S "$USER" | cut -d ' ' -f 2)" = "P" ]
then
    disabled="False"
else
    disabled="True"
fi

The same applies to locking a user's password; this is preferably done through usermod (--lock option), not editing shadow manually.

Answer 2

Why not just do it all with awk?

awk -F: '/<username>/ {if(substr($2,1,1) == "!"){print "True"} else {print "False"}}' /etc/shadow

Answer 3

U=$user LC_ALL=C awk -F: < /etc/shadow '
  $1 "" == ENVIRON["U"] {
    user_found = 1
    if ($2 ~ /^!/) {
      print "True"
      exit 0
    } else {
      print "False"
      exit 1
    }
  }
  END {
    if (!user_found) {
      print "False"
      print "User "ENVIRON["U"]" not found" > "/dev/stderr"
      exit 2
    }
  }'

$1 "" == ENVIRON["U"] compares the first field with ENVIRON["U"] lexically. Without the "", the fields could end-up being compared numerically if they look like numbers (causing inf to match against INF or Infinity for instance).

Without LC_ALL=C, since some awk implementations use strcoll() for the == lexical comparison, it could end-up checking wrong entries for user names that sort the same.

Answer 4

A user is locked when the passwd field is the string *LK*, but you cannot check this as /etc/shadow is only readable by root for security reasons.

If permissions are not an issue, try this:

while IFS=: read USER PW REST; do 
    if [ "$USER" = "$uname" ]; then 
            if [ "$PW" = "*LK*" ]; then 
                    echo "$uname" Locked 
            fi 
    fi 
done < /etc/shadow 

Edit: Moved IFS=: to make the code simpler