An install document I'm following instructs to add a user like so:

sudo adduser --disabled-login --gecos 'GitLab' git

The --disabled-login flag is absent from most man pages I have searched.

I've made two users, one with the --disabled-login (foo), and one without (git).

As far as I can tell the --disabled-login flag does nothing. I can still su to both users, and both use /bin/bash as their login shell.

The only difference I can see is getent passwd has extra commas before the home folder on the user that has login's disabled. There is no documentation that I can find to indicate what this would mean.

root@gitlab:~# getent passwd git

root@gitlab:~# getent passwd foo


I've found another difference, one user has a * as their password, the other has !:

root@gitlab:~# getent shadow git
root@gitlab:~# getent shadow foo

What exactly does --disabled-login do on Ubuntu?

  • For the record, the extra commas separate the fields within the "gecos" field: full name, room number, work phone, home phone. I don't know why they would be present in one version and not the other though. You can find documentation on this in the manpage of the chfn tool. – Random832 Oct 21 '13 at 2:47
  • That makes sense. I accidentally chose 'y' when prompted to enter in that information when I added one of the users. The other user was added through puppet. – spuder Oct 21 '13 at 4:16

The explanation is not well documented.

--disabled-login sets the password to !

Password values

NP or null = The account has no password
*  = The account is deactivated & locked
!  = The login is deactivated, user will be unable to login
!!  = The password has expired


root@gitlab:~# getent shadow vagrant

root@gitlab:~# getent shadow foo

root@gitlab:~# getent shadow git

wikipedia briefly covers this. It appears that * and ! effectively do the same thing; prevent the user from logging in (but not from su'ing from a different user)

| improve this answer | |

It's partially discussed here in the shadow man page.


$ man shadow
encrypted password
     Refer to crypt(3) for details on how this string is interpreted.

     If the password field contains some string that is not a valid result of 
     crypt(3), for instance ! or *, the user will not be able to use a unix
     password to log in (but the user may log in the system by other means).

     This field may be empty, in which case no passwords are required to 
     authenticate as the specified login name. However, some applications which
     read the /etc/shadow file may decide not to permit any access at all if the
     password field is empty.

     A password field which starts with a exclamation mark means that the 
     password is locked. The remaining characters on the line represent the 
     password field before the password was locked.

Depending on your version of the man page for adduser it's referenced there.

excerpt adduser man page

       Do  not  run passwd to set the password.  The user won't be able
       to use her account until the password is set.

       Like --disabled-login, but logins are still possible (for  exam-
       ple using SSH RSA keys) but not using password authentication.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.