Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I need to add new users who are only supposed to be usable through SSH. When adding a user, they get added to the shadow file with an exclamation mark (!) instead of an asterisk (*), so they are "disabled" and sshd does not allow them to be used.
Is there a way to add a user without a password that is enabled by default?
I have tried using busybox' adduser command and it adds them with a !. Similarly, Gentoo's default useradd command will add them with a !.
Looks like I can specify the encrypted password to add the user with
useradd -p '*' testuser
It wasn't working previously because I forgot that the shell tried to expand the asterisk when I was missing the single quotes.
It looks like I could also use
usermod -p '*' testuser
on an existing user to set the password to an asterisk as well.
On alpine and other busybox based distributions where adduser behaves like this, you can create an account with a random password that you don't keep.
Do this by generating the password from /dev/urandom and turning it into text with base64, then echoing it twice, piping it into the adduser command (without the -D flag) so it enters and confirms the password during user creation.
pw="$(head -c 20 /dev/urandom | base64 | head -c 10)"
( echo "$pw"; echo "$pw" ) | adduser foo
Another option would be to replace the ! with a * in the /etc/shadow file after user creation.
adduser -D foo
sed -i -e "s/^foo:!:/foo:*:/" /etc/shadow
~/.ssh/authorized_keys file. This way they can log in using their private key by using ssh -i /path/to/private_key_file. This site seems to explain it well: devopsmyway.com/…
ssh then disable the password (or change the password to a very hard password with urandom). A 10 byte hard password is not terribly hard, though.
Jul 8, 2021 at 19:55
adduser <username> --disabled-password- just make sure to also use the--homeand--shelloptions if they need a home directory and login shell asadduserdoesn't create them by default.!from the shadow file? Can the user log in without a password?*though, so it seems to be working now.