23

As far as I know, the 2nd field of /etc/shadow is the encrypted password of the user. But some user e.g. daemon user have * in the field, in my environment(Ubuntu 12.04) root have ! in the field.

I assume ! means like "all password is invalid, you can not login with this user.". But I couldn't find the document for it.

What does mean * and ! in shadow file?

1 Answer 1

28

'!' and '!!' mean essentially the same thing, but different tools use one or the other, passwd -l for instance, uses a pair of exclamation points. usermod -L on the other hand only uses one.

Usually, accounts with '*' never had a password (as in, have always been disabled for login). This is different to an account with no password hash entry at all, in which case no password is needed (and often won't even be prompted for) which is nearly always BAD!.

If it's an invalid hash (which all of '*', '!', and '!!' are) it effectively locks the account and prevents logins to that account. Often this is furthered by setting the account's shell to something like /bin/false or /sbin/nologin in the /etc/passwd file

You'll often find that if a user's account is locked after previously having a valid password set, that password hash has exclamation marks prefixed to it, this is so when the account is unlocked the password resumes working again.

4
  • Thanks for your detailed explanation. This is very helpful!
    – ironsand
    Jul 25, 2013 at 4:01
  • 2
    no problem. One thing i forgot to mention (but did imply) is to be careful of locking account with passwd and trying to unlock it with usermod. It'll only remove the first '!', which won't work.
    – Sirex
    Jul 25, 2013 at 4:56
  • 2
    The answer is not 100% correct. From my experience if you have an asterisk * in that column, you can still login perfectly fine using public key authentication. Whereas a ! really blocks all logins for that user. Feb 17, 2017 at 19:16
  • 2
    that depends on the setting of the "usepam" in the sshd config file. arlimus.github.io/articles/usepam
    – Sirex
    Feb 18, 2017 at 0:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .