3

I want to get the password hash of the sys user in Debian (but the password is preferred). I heard that all password hashes are stored in the /etc/shadow file, but there isn't a password hash for the sys user.

How to get it?

P.S. I have root access.

1
  • 2
    This sounds like an XY problem to me. The sys user on Debian is a system user that (AFAIK) exists at this point just for legacy reasons, and thus is not supposed to have a usable login (and if you really need to run something as them, you can just use sudo -u sys /bin/bash to get a shell running as that user, but you should never need to do that). Commented Jun 6, 2022 at 12:14

1 Answer 1

13

On a usual desktop installation, what you see in /etc/shadow is what you get, and the system users generally don't have passwords set. They're not used for interactive logins, so they don't need passwords.

E.g. on the system I looked at, /etc/shadow has this line for sys:

sys:*:19101:0:99999:7:::

That * is where the password hash would be if the user had a password. But * is an invalid password hash, no password will produce it, so there is no password the user could log in with.

Note that if the password hash field was empty, it might allow login without entering a password. With the Linux PAM libraries, this is controlled by the nullok setting to pam_unix.so (man page):

nullok
The default action of this module is to not permit the user access to a service if their official password is blank. The nullok argument overrides this default.

(if it's enabled, and the password is empty, the module doesn't even ask for the password but accepts the login directly.)

If you really wanted, you could set a password for the system in the usual way, but I would suggest reconsidering what you're doing; there's probably a better way. Also note that they may not have a usable shell set either, e.g. on the system I looked, the sys user's shell is set to /usr/sbin/nologin.

8
  • No, when I tried empty password, I got "Login Invalid"
    – Vad Sim
    Commented Jun 5, 2022 at 8:38
  • 4
    @VadSim If the user does not have a hash in /etc/shadow, that means that the user does not have a password. It does not mean that the password is the empty string.
    – Kusalananda
    Commented Jun 5, 2022 at 9:09
  • As @Kusalananda says: No password is not equal to the empty string as password. Having users with the empty string as password would be a massive security hole. Commented Jun 5, 2022 at 9:30
  • @Henriksupportsthecommunity, in some systems, an empty password hash means login without giving a password is allowed.
    – ilkkachu
    Commented Jun 5, 2022 at 9:37
  • 1
    @VadSim My comment does not answer the question, and what I said is now already well encapsulated by ikkachu's answer.
    – Kusalananda
    Commented Jun 5, 2022 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .