Yes, password tables can contain comments …
… but not on Illumos, OpenBSD, or Linux; and only in the source form. The people writing on the Gentoo Linux WWW site had not experienced a wide enough range of operating systems.
The file format is not the same across all operating systems. FreeBSD, reading the
/etc/master.passwd file, allows for line comments. The Linux, OpenBSD, and Illumos parsers for their
/etc/master.passwd files do not.
As you can see, the first few lines of the initial FreeBSD
/etc/master.passwd file are comment lines, which are explicitly ignored by the FreeBSD
pw_mkdb program. The OpenBSD
pw_mkdb lacks this, and its default
/etc/master.passwd has no comments.
Of course, once the
pw_mkdb program has compiled the source into the actual database that is used by the library routines that look up things in the system account database, the comments have been filtered out. The actual compiled database format is Berkeley DB, which does not have comments.
The Linux user account database subsystem does not use compiled database files with indexes, unlike the BSDs. Its lookup library routines, parsing the original flat tables, do not allow for comments, though. The same is true for Illumos, and for OpenSolaris before it.
No, user names cannot practically contain # characters.
POSIX specifies that a portable account name can only comprise characters from the so-called Portable Filename Character Set, with an additional restriction on the first character of the name. This set does not contain the
The additional restriction on the first character is important, because it touches upon the reasons that
# will cause problems in account names. Account names are used as arguments to programs, and arguments beginning with
- generally denote option arguments. (Yes, there are ways to avoid account names from being treated as option arguments, but they are not universal nor standardized.)
This is the nub of the problem. Although the actual source form of the table itself allows any character other than the field separator (
␊), record separator (
:), or (on FreeBSD) the end-of-line comment introducer (
#) in the first field of a record, the use of account names in a large number of other contexts places a lot more constraints upon them:
- The C library routines treat these fields as
␀-terminated strings, so they cannot contain the
- Account names are used as command arguments, as mentioned, not least as arguments passed from
getty programs to
login in old-style operating systems. (Illumos is in the family of Unices that got rid of the
getty program back in 1988, of course.) This rules out the
␀ character and initial
- Account names are configured in shell scripts (or approximations thereto) using variable assignments, from settings in
/etc/sysconfig/wibble, so shell metacharacters that would break such scripts are not used. So
#, being a shell metacharacter, is not used.
- Account names are held in environment and shell variables. So characters such as the
␀ character and
= (which causes ambiguity in parsing process environments) are not used.
- Account names are configured in .INI files, so metacharacters for .INI files, including
; are not used.
- … and so on.
So although using
# does not comment things out in the password file on Illumos, its use would cause a fair number of problems elsewhere.
For special account names, use …
… the FreeBSD convention of an initial
_, something like the Debian convention of a
Debian- prefix, or the Daniel J. Bernstein convention of an initial uppercase
For locking out accounts, use …
… the correct field of the record in the first place! It isn't the name field. It is the password field, which on Illumos contains special values for locked and no-login accounts.