I tried setting users.users.root.hashedPassword = "*"; similar to sudo passwd -d root or

user { 'root':
  password => '*',
  require  => Package[ruby-shadow],

in Puppet, but after sudo nixos-rebuild switch I'm still able to su - with the old password.


You need to set the mutableUsers to false and the user password.

users = {

 #normal users declaration here

  mutableUsers = false;

  extraUsers = {

    root = {
      hashedPassword = "*";
     user = {
      hashedPassword = "user-password";

The manpage : man configuration.nix

       Specifies the hashed password for the user. The options
       hashedPassword, password and passwordFile controls what password is
       set for the user.  hashedPassword overrides both password and
       passwordFile.  password overrides passwordFile. If none of these
       three options are set, no password is assigned to the user, and the
       user will not be able to do password logins. If the option
       users.mutableUsers is true, the password defined in one of the
       three options will only be set when the user is created for the
       first time. After that, you are free to change the password with
       the ordinary user management commands. If users.mutableUsers is
       false, you cannot change user passwords, they will always be set
       according to the password options.

You can set a label to test the new generation (labled noroot):

nixos-rebuild switch -p noroot -I nixos-config=/etc/nixos/configuration.nix
  • 1
    Hold on, does mutableUsers = false mean I'd have to hardcode everybody's passwords (hashed or not) in my configuration? If so this is not an option. – l0b0 Jul 23 '19 at 23:08
  • That doesn't answer my question. Is it possible to configure only the root user's password and still have other users with a custom password? – l0b0 Jul 25 '19 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.