Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
When you install software on linux often users and groups get automatically created.
I am wondering if during this user creation a "default" or "random" password will be set and if not if you still will be able to login through the console (assumption is that a shell entry got created in /etc/password and it is not set to nologin). Normally when you call "adduser" you have to provide a password. How does this work for automatic created users through software installations?
If you mean "system users", ones for some particular service, like sshd, postfix or www-data (just to pick some), they usually have their password set to something like * in /etc/shadow. It's not empty, but it's also not a valid password hash, so can't be used to authenticate against.
(The way password-based authentication works is that the password given by the user is hashed in the same way the stored password was, and the hashes are then compared to see if they're equal. An invalid hash can't be produced by any password given at login, so the login can never succeed.)
If the password field was actually empty, it would be different, as an empty field marks that no password is required. (Of course the empty string is also not a valid hash, but a special case.) However, at least sshd disallows logins with an empty password anyway (by default, it's configurable with PermitEmptyPasswords).
That said, whatever is in the password field usually only matters for password authentication. SSH keys in particular usually ignore what is in the password field completely. (As stuff like su and sudo can also do, if used by a user with enough privileges.)
The Linux man page shadow(5) describes this behaviour.
man adduser helpfully shows the option --disabled-password.
Or use the traditional useradd which does not ask for password at all.
sshwith a key).