I need to add new users who are only supposed to be usable through SSH. When adding a user, they get added to the shadow file with an exclamation mark (!) instead of an asterisk (*), so they are "disabled" and sshd does not allow them to be used.

Is there a way to add a user without a password that is enabled by default?

I have tried using busybox' adduser command and it adds them with a !. Similarly, Gentoo's default useradd command will add them with a !.

  • 3
    adduser <username> --disabled-password - just make sure to also use the --home and --shell options if they need a home directory and login shell as adduser doesn't create them by default.
    – rst-2cv
    Commented Oct 9, 2019 at 13:25
  • @ResetACK Looks like my system (Gentoo-based) doesn't have the adduser command, and busybox' adduser doesn't use --disabled-password. On my Ubuntu VM it added it correctly though.
    – user
    Commented Oct 9, 2019 at 13:41
  • You might be SOL then :) what happens if you remove the ! from the shadow file? Can the user log in without a password?
    – rst-2cv
    Commented Oct 9, 2019 at 13:47
  • 1
    @ResetACK Yes, manually editing the shadow file will make the account usable, but I'm trying to avoid that since automating will increase the amount of times I can screw something up. I figured out what I was doing wrong with the * though, so it seems to be working now.
    – user
    Commented Oct 9, 2019 at 13:49

2 Answers 2


Looks like I can specify the encrypted password to add the user with

useradd -p '*' testuser

It wasn't working previously because I forgot that the shell tried to expand the asterisk when I was missing the single quotes.

It looks like I could also use

usermod -p '*' testuser

on an existing user to set the password to an asterisk as well.


On alpine and other busybox based distributions where adduser behaves like this, you can create an account with a random password that you don't keep.

Do this by generating the password from /dev/urandom and turning it into text with base64, then echoing it twice, piping it into the adduser command (without the -D flag) so it enters and confirms the password during user creation.

pw="$(head -c 20 /dev/urandom | base64 | head -c 10)"
( echo "$pw"; echo "$pw" ) | adduser foo

Another option would be to replace the ! with a * in the /etc/shadow file after user creation.

adduser -D foo
sed -i -e "s/^foo:!:/foo:*:/" /etc/shadow
  • But how will you setup ssh to signon to a user with an unknown password? Commented Jul 8, 2021 at 12:46
  • They must have a public key in their ~/.ssh/authorized_keys file. This way they can log in using their private key by using ssh -i /path/to/private_key_file. This site seems to explain it well: devopsmyway.com/…
    – Kilna
    Commented Jul 8, 2021 at 16:08
  • I think you need to create the user with a password, setup ssh then disable the password (or change the password to a very hard password with urandom). A 10 byte hard password is not terribly hard, though. Commented Jul 8, 2021 at 19:55
  • 64^10 you'd have to guess out of ~1,000,000,000,000,000,000 possible combinations, if you could make 1,000 guesses per second it would take ~32 million years to cover the possible password space. If you had a cluster gnawing at this that gave you a million guesses per second, and the poor busybox SSH server could actually keep up, you'd still be in the thousands of years. :D
    – Kilna
    Commented Jul 8, 2021 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .