Looking into my /etc/shadow file of a fairly new box today (running Arch), I see some passwords as * (disabled) but some others as !*, !! and as !. Presumably that means "disabled", too, but why is the value different?
Is there some convention that I haven't heard of? :-) and if so where would that be documented?
Excerpt:
root:*:14871::::::
dbus:!!:18407::::::
dnsmasq:!*:18499::::::
shepherd:!:18502:0:99999:7:::
Nothing found at all on the Net: I'm looking up for an automatical synchonization of linux to samba (NOT Samba to Linux) passwords. I wrote a cgi web form that changes this password directly in the shadow file, using a crypted password (for security reasons I do not want to allow the passwords being stored in cleartext in the logfiles). Not using LDAP. All would be fine if the user logs in for a first time using ssh, but I have users that only use windows, so I cannot ask i.ex. a secretary to do that.
Basically, what I yet did is this: vi /etc/pam.d/common-password
password required pam_smbpass.so nullok use_authtok use_first_pass
I yet found the following sites, but still struggeling around...
-http://uranus.chrysocome.net/linux/smbfs/pam_smbpass.html
here some code of my perl cgi script:
# Crypt the password here so that it cannot be read in any logflie
my $cryptedShadowString = `echo "$new_passwd1"|openssl passwd -1 -stdin`;
chomp($cryptedShadowString);
(...)
open($result, '-|') || exec $SUDO, $EXECUTINGSCRIPT, $login, $old_passwd, $cryptedShadowString, $cryptedShadowString;
This will send the encrypted password to another perl script that writes it directly into the shadow file. (All the stuff is shibboleth protected, so I don't care about hackers coming from around the world).
I tried something like that in the execution script, but unfortunately it is not the solution:
# Do a first login to chat the new password to the samba password file:
sleep 2; # sleep a bit, for the next command:
system(" ( echo '') | exec '/bin/su' $login");
Someone can help me? Thx.
How are passwords generated that are used by Ubuntu 10.04? I know that they use SHA 512 as hashing algorithm, but I figure that there is some sort of salting done. I need to generate such a password myself. How can I do that? Is there a command line tool for that?
On a webserver there is a MySQL-service running, providing databases for the users of the server. Each user has it's own DB and it's own password and the right so INSERT/SELECT/UPDATE/DROP tables in it's own DB, but nothing more.
However, i want to give the user the privilege to UPDATE his own password. I've read "12.4.1.3. GRANT Syntax" from the MySQL 5.1 documentation. But i didn't found a way to grant the user the privilege to change his password, without granting full UPDATE-access to the mysql.user-table.
Maybe there is also a way to synchronize the passwords in /etc/shadow along with the passwords in mysql.user, so, each time when the user changes his password in Linux, the MySQL-password is also altered.
Regards Macs
On my Ubuntu 9.10 system, there's a shadow system group. There does not appear to be any user assigned to this group at all. The only files that I can find belonging to this group are /etc/shadow and /etc/gshadow.
I'm aware that the purpose of these files is to store the passwords separately, out of reach from regular users who still might want to access passwd for other reasons.
But what is the purpose of the shadow group?
The reason I'm curious about this, is because I'm thinking about configuring nsswitch.conf to store it elsewhere, and would like to know if anything is actually trying to access the shadow database using shadow group credentials.