19

As far as I know, the 2nd field of /etc/shadow is the encrypted password of the user. But some user e.g. daemon user have * in the field, in my environment(Ubuntu 12.04) root have ! in the field.

I assume ! means like "all password is invalid, you can not login with this user.". But I couldn't find the document for it.

What does mean * and ! in shadow file?

22

'!' and '!!' mean essentially the same thing, but different tools use one or the other, passwd -l for instance, uses a pair of exclamation points. usermod -L on the other hand only uses one.

Usually, accounts with '*' never had a password (as in, have always been disabled for login). This is different to an account with no password hash entry at all, in which case no password is needed (and often won't even be prompted for) which is nearly always BAD!.

If it's an invalid hash (which all of '*', '!', and '!!' are) it effectively locks the account and prevents logins to that account. Often this is furthered by setting the account's shell to something like /bin/false or /sbin/nologin in the /etc/passwd file

You'll often find that if a user's account is locked after previously having a valid password set, that password hash has exclamation marks prefixed to it, this is so when the account is unlocked the password resumes working again.

  • Thanks for your detailed explanation. This is very helpful! – ironsand Jul 25 '13 at 4:01
  • 2
    no problem. One thing i forgot to mention (but did imply) is to be careful of locking account with passwd and trying to unlock it with usermod. It'll only remove the first '!', which won't work. – Sirex Jul 25 '13 at 4:56
  • 2
    The answer is not 100% correct. From my experience if you have an asterisk * in that column, you can still login perfectly fine using public key authentication. Whereas a ! really blocks all logins for that user. – Michael Härtl Feb 17 '17 at 19:16
  • 2
    that depends on the setting of the "usepam" in the sshd config file. arlimus.github.io/articles/usepam – Sirex Feb 18 '17 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.