0

I need to add new users who are only supposed to be usable through SSH. When adding a user, they get added to the shadow file with an exclamation mark (!) instead of an asterisk (*), so they are "disabled" and sshd does not allow them to be used.

Is there a way to add a user without a password that is enabled by default?

I have tried using busybox' adduser command and it adds them with a !. Similarly, Gentoo's default useradd command will add them with a !.

4
  • 3
    adduser <username> --disabled-password - just make sure to also use the --home and --shell options if they need a home directory and login shell as adduser doesn't create them by default.
    – rst-2cv
    Commented Oct 9, 2019 at 13:25
  • @ResetACK Looks like my system (Gentoo-based) doesn't have the adduser command, and busybox' adduser doesn't use --disabled-password. On my Ubuntu VM it added it correctly though.
    – user
    Commented Oct 9, 2019 at 13:41
  • You might be SOL then :) what happens if you remove the ! from the shadow file? Can the user log in without a password?
    – rst-2cv
    Commented Oct 9, 2019 at 13:47
  • 1
    @ResetACK Yes, manually editing the shadow file will make the account usable, but I'm trying to avoid that since automating will increase the amount of times I can screw something up. I figured out what I was doing wrong with the * though, so it seems to be working now.
    – user
    Commented Oct 9, 2019 at 13:49

2 Answers 2

1

Looks like I can specify the encrypted password to add the user with

useradd -p '*' testuser

It wasn't working previously because I forgot that the shell tried to expand the asterisk when I was missing the single quotes.

It looks like I could also use

usermod -p '*' testuser

on an existing user to set the password to an asterisk as well.

0

On alpine and other busybox based distributions where adduser behaves like this, you can create an account with a random password that you don't keep.

Do this by generating the password from /dev/urandom and turning it into text with base64, then echoing it twice, piping it into the adduser command (without the -D flag) so it enters and confirms the password during user creation.

pw="$(head -c 20 /dev/urandom | base64 | head -c 10)"
( echo "$pw"; echo "$pw" ) | adduser foo

Another option would be to replace the ! with a * in the /etc/shadow file after user creation.

adduser -D foo
sed -i -e "s/^foo:!:/foo:*:/" /etc/shadow
4
  • But how will you setup ssh to signon to a user with an unknown password? Commented Jul 8, 2021 at 12:46
  • They must have a public key in their ~/.ssh/authorized_keys file. This way they can log in using their private key by using ssh -i /path/to/private_key_file. This site seems to explain it well: devopsmyway.com/…
    – Kilna
    Commented Jul 8, 2021 at 16:08
  • I think you need to create the user with a password, setup ssh then disable the password (or change the password to a very hard password with urandom). A 10 byte hard password is not terribly hard, though. Commented Jul 8, 2021 at 19:55
  • 64^10 you'd have to guess out of ~1,000,000,000,000,000,000 possible combinations, if you could make 1,000 guesses per second it would take ~32 million years to cover the possible password space. If you had a cluster gnawing at this that gave you a million guesses per second, and the poor busybox SSH server could actually keep up, you'd still be in the thousands of years. :D
    – Kilna
    Commented Jul 8, 2021 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .