0

When you install software on linux often users and groups get automatically created.

I am wondering if during this user creation a "default" or "random" password will be set and if not if you still will be able to login through the console (assumption is that a shell entry got created in /etc/password and it is not set to nologin). Normally when you call "adduser" you have to provide a password. How does this work for automatic created users through software installations?

1
  • You question is full of ideas about users passwords authentication, etc. However I can not see what the question is. For the simple is it possible to login with out a password, then the simple answer is yes (an example is ssh with a key). Feb 25, 2021 at 20:38

2 Answers 2

2

If you mean "system users", ones for some particular service, like sshd, postfix or www-data (just to pick some), they usually have their password set to something like * in /etc/shadow. It's not empty, but it's also not a valid password hash, so can't be used to authenticate against.

(The way password-based authentication works is that the password given by the user is hashed in the same way the stored password was, and the hashes are then compared to see if they're equal. An invalid hash can't be produced by any password given at login, so the login can never succeed.)

If the password field was actually empty, it would be different, as an empty field marks that no password is required. (Of course the empty string is also not a valid hash, but a special case.) However, at least sshd disallows logins with an empty password anyway (by default, it's configurable with PermitEmptyPasswords).

That said, whatever is in the password field usually only matters for password authentication. SSH keys in particular usually ignore what is in the password field completely. (As stuff like su and sudo can also do, if used by a user with enough privileges.)

The Linux man page shadow(5) describes this behaviour.

0

man adduser helpfully shows the option --disabled-password.

Or use the traditional useradd which does not ask for password at all.

3
  • Thank you, but will this mean you can not login with these accounts through a console automatically?
    – megloff
    Feb 25, 2021 at 19:22
  • You can push ~/.ssh/authorized_keys after account creation.
    – pepoluan
    Feb 25, 2021 at 19:24
  • does this mean I am not able to login via password but via SSH with keys?
    – megloff
    Feb 25, 2021 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.