Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've written a script to add CVS and SVN users on a Linux server (Slackware 14.0). This script creates the user if necessary, and either copies the user's SSH key from an existing shell account or generates a new SSH key.

Just to be clear, the accounts are specifically for SVN or CVS. So the entry in /home/${username}/.ssh/authorized_keys begins with (using CVS as an example):

command="/usr/bin/cvs server",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa ....etc...etc...etc...

Actual shell access will never be allowed for these users - they are purely there to provide access to our source repositories via SSH.

My problem is that when I add a new user, they get an empty password in /etc/shadow by default. It looks like:

paddycvs:!:15679:0:99999:7:::

If I leave the shadow file as is (with the !), SSH authentication fails. To enable SSH, I must first run passwd for the new user and enter something.

I have two issues with doing that. First, it requires user input which I can't allow in this script. Second, it potentially allows the user to login at the physical terminal (if they have physical access, which they might, and know the secret password -- okay, so that's unlikely).

The way I normally prevent users from logging in is to set their shell to /bin/false, but if I do that then SSH doesn't work either!

Does anyone have a suggestion for scripting this? Should I simply use sed or something and replace the relevant line in the shadow file with a preset encrypted secret password string? Or is there a better way?

Cheers =)

share|improve this question

5 Answers 5

up vote 1 down vote accepted

To avoid problems with locking, or messing up your shadow file, you could conceivably use

echo username:some_string | chpasswd

More specifically: you could actually use the * in the password field by doing this:

echo "username:*" | chpasswd -e
share|improve this answer
    
Thank you, that's just what I was looking for. Much cleaner than my hack with sed, and obviously more robust. –  paddy Dec 17 '12 at 1:32

And yet another solution which doesn't involve a pipe is the following (also found in the shadow, resp. shadow-utils package):

usermod -p '*' username
share|improve this answer

Well, I played around a bit more and I found that if I turn the password into * in /etc/shadow, it allows SSH but disables password logins on the TTY. So I'll add this as an answer to my own question.

This has been added to my script after the useradd call:

cp /etc/shadow /etc/shadow.backup
sed -e "s/^\(${username}:\)[^:]*:/\1*:/" /etc/shadow.backup > /etc/shadow

It replaces a specific user's shadow password entry with a *.

share|improve this answer

Newer versions of OpenSSH check /etc/shadow to see if the account is disabled. A disabled account has an !, so changing that to an * will solve the problem.

share|improve this answer

Have you tried

passwd -d username

it deletes the password entry of the particular user from the /etc/shadow file. Basically making the particular user login as empty password.

It can only be enforced as root or sudo user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.