1

Looking into my /etc/shadow file of a fairly new box today (running Arch), I see some passwords as * (disabled) but some others as !*, !! and as !. Presumably that means "disabled", too, but why is the value different?

Is there some convention that I haven't heard of? :-) and if so where would that be documented?

Excerpt:

root:*:14871::::::
dbus:!!:18407::::::
dnsmasq:!*:18499::::::
shepherd:!:18502:0:99999:7:::
3

Synthesizing the Unix & Linux page regarding the /etc/shadow file

  • *: "By convention, accounts that are not intended to be logged in to (e.g. bin, daemon, sshd) only contain a single asterisk in the password field"
  • !: Both "!" and "!!" being present in the password field mean an account is locked.
  • !!: But "!!" in an account entry in shadow means the account of an user has been created, but not yet given a password

The strings *, ! and !! all effectively make that the user cannot login (since an encrypted password will never be 1 or 2 characters).

| improve this answer | |
  • 1
    This isn't just a length restriction. Even if the original hash is present, adding either * or ! will render them unmatchable, since neither character appears in a valid hash for all hash types commonly used in /etc/shadow. In this way, a user's "previous" password can be preserved, and removing the * or ! can return it to service. – Royce Williams Aug 29 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.