Let's assume the following. We have a server which is accessible via SSH. There is an user in /etc/passwd who has a valid login shell (so for example /bin/bash, instead of an invalid one like /bin/false).

This user has an asterisk (*) in the second (password) field of /etc/shadow. Is there some way that this user could login via SSH if he doesn't have a ssh key in his ~/.ssh/ folder?

Or, to rephrase the question somewhat: What would be the reason for many online guides to recommend to disable the login shell, when there is a * in the password field of /etc/shadow?


A * in the location of the hashed password in /etc/shadow effectively disables all password based logins as no user input will ever result in a hash value of *. But the user can still login with his/her ssh keys.

The difference of using * instead of using an exclamation mark ! is that the latter indicates a locked account in PAM, which, depending on your sshd configuration, will disable key based logins too.

The reason to set an invalid shell is simply to prevent interactive login sessions from working (regardless of whether of not a password for the account is set) and will block sudo su - user and similar from working.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.