Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my SSH servers setup to use only Public Key authentication with password authentication disabled.

When adding users through puppet I would like to disable user passwords.

So far I have came up with this, which seems to work, but I am not sure how secure is this:

user { 'john':
    ensure     => 'present',
    comment    => 'John Smith',
    groups     => ['adm','sudo','wheel','users'],
    home       => '/home/john',
    managehome => true,
    shell      => '/bin/bash',
    password   => '*',

Is using password => '*' definition considered safe for disabling user password?

share|improve this question
up vote 5 down vote accepted

The shadow(5) man pages says

If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by other means).

So yes it is safe to use a *. The ! a the first character of an encrypted password is used by passwd(1) to indicate that a password is locked (passwd -l) and this can be unlocked (passwd -u).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.