1

From https://unix.stackexchange.com/a/314732/674

In contrast to user accounts, service accounts often don't have a "proper" login shell, i.e. they have /usr/sbin/nologin as login shell (or, back in the old days, /bin/false). Moreover, service accounts are typically locked, i.e. it is not possible to login (for traditional /etc/passwd and /etc/shadow this can be achieved by setting the password hash to arbitrary values such as * or x).

It seems to give several ways to prevent a user from login.

  • the shell field of /etc/passwd: nologin, /bin/false, /bin/true,/dev/null`;

  • the password field of /etc/shadow: * or x

What are the differences between their purposes? Do they all achieve the same purpose?

Thanks.

Improve this question
1
  • If the purpose is to prevent the user from logging in then yes, they all achieve the same purpose.
    – jesse_b
    Jan 2, 2019 at 22:32

2 Answers 2

Reset to default
3

They are somewhat different. A user with a “bad” password hash may still log in if something allows him to log in without a password, for example with SSH and an authorized key. But that’s impossible without a valid shell.

On the other hand, there are some situations were a user may be granted some access without a shell (I’m thinking about an IMAP or SMTP server). Then, a user with a “good” password hash may use the service, even is he has no valid login shell.

Improve this answer
2
  • Thanks. " a user with a “good” password hash may use the service, even is he has no valid login shell." How does it use the service?
    – Tim
    Jan 3, 2019 at 12:32
  • @Tim With another computer and a dedicated client software, such as Thunderbird for IMAP or SMTP services.
    – user2233709
    Jan 4, 2019 at 0:38
1

Just because there are multiple ways to do things, does not mean there was a real purpose as to why. There are some minor differences between system users and normal users.

/usr/sbin/nologin is a simple "shell" that was designed to deny access by exiting immediately. Any program can be run as a shell (as long as it is listed in /etc/shells), and if the program simply exits right away then the user will have no access to the system. This is why something like /bin/false also works.

Using an asterisk for a password in the shadow file is just how linux represents a locked account password. If you run passwd -l username as root, it will lock the account using this method.

Another method is to expire the account by setting the expire date to 1. This can be done by running this:

usermod -L -e 1 username
Improve this answer
5
  • 1
    Note for any program to be used as a shell, it must be listed in /etc/shells
    – ivanivan
    Jan 3, 2019 at 0:15
  • @ivanivan updated post to inlude this, thanks
    – Jeff A
    Jan 3, 2019 at 0:18
  • You do not need to list a shell in /etc/shells for it to be used. Some applications may look in there and not present it as an option, but /usr/local/bin/foobarbaz can be used as a login shell without it being listed. Indeed, there are use cases where you don't want it; eg some FTP servers will only permit access if the login shell is listed, so putting nologin in /etc/shells may prevent ssh access but permit FTP access!
    – Stephen Harris
    Jan 3, 2019 at 0:24
  • Note that * in the crypt field means "no valid password". An ! means locked; from man 5 shadow... A password field which starts with a exclamation mark means that the password is locked. The remaining characters on the line represent the password field before the password was locked
    – Stephen Harris
    Jan 3, 2019 at 0:26
  • @StephenHarris I guess I should've specified - shell must be in /etc/shells if you change to it using chsh. If the root user is simply editing /etc/passwd then you are correct, doesn't need to be in the shells file.
    – ivanivan
    Jan 3, 2019 at 1:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .