3

I have an account that is only used for remote calls from a WebSphere app server to access a table in a DB2 database. The account is set as /sbin/nologin so I cannot su to it to challenge the password. How can I verify the password?

2 Answers 2

1

I'm most familiar with Linux but I think that for both OS's the effect of the /sbin/nologin shell is similar and only becomes apparent after successful password validation and you can still distinguish, without administrator privileges, if you have the correct password or not.

When you attempt to login with a SSH session and you enter an incorrect password you get a both a permission denied message and a new password prompt to try again, but after the correct password you won't see a new password prompt, but the session will get closed immediately (On my Linux host with a message that the account is currently not available).

$ ssh serverfault@localhost
serverfault@localhost's password:     ***incorrect password***
Permission denied, please try again.
serverfault@localhost's password:     ***incorrect password***
Permission denied, please try again.

ssh serverfault@localhost
serverfault@localhost's password:     ***correct password***
Last failed login: Tue Apr  9 08:32:14 CEST 2019 from localhost on ssh:notty
There were 2 failed login attempts since the last successful login.
This account is currently not available.
Connection to localhost closed.

$ su - serverfault
Password:           ***incorrect password***
su: Authentication failure


$ su - serverfault
Password:
Last failed login: Tue Apr  9 08:32:14 CEST 2019 from localhost on ssh:notty
There were 2 failed login attempts since the last successful login.
This account is currently not available.
0

You know the hashed password. If you have a privileged user you can check and set the password in /etc/shadow directly. A hack, but that is what for example Ansible does to automate changing passwords on Solaris.

Ansible playbook prompting for password and ensuring the user exists with that password:

---

- name: https://serverfault.com/questions/962070/in-solaris-how-can-i-verify-a-user-password-for-an-account-that-is-set-as-sbin
  hosts: solaris

  vars:
    service_user: "app"

  vars_prompt:
  - name: "ServiceUserPasswordHash"
    prompt: "Enter password for user {{service_user}} "
    private: True
    encrypt: "sha256_crypt"
    salt: "{{ 65534 | random(seed=service_user) | string }}"

  tasks:
  - name: Create service user
    become: True
    user:
      name: "{{service_user}}"
      comment: "Service account"
      password: "{{ServiceUserPasswordHash}}"
      update_password: "always"
      shell: "/bin/false"

I couldn't find a nologin shell on OpenIndiana 20181023. /bin/false works, but it won't print anything for the user.

The salt I seeded from the user name. Not very random, but won't change every run.

If you wish to not be prompted for the password but look it up from some secret store, determine the hash with the password_hash filter instead of vars_prompt.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .