Bug 811

Summary: locked /etc/shadow password prefix on linux
Product: Portable OpenSSH Reporter: Roumen Petrov <bugtrack>
Component: sshdAssignee: OpenSSH Bugzilla mailing list <openssh-bugs>
Status: CLOSED FIXED    
Severity: enhancement    
Priority: P2    
Version: 3.8p1   
Hardware: All   
OS: Linux   
Bug Depends on:    
Bug Blocks: 821    
Attachments:
Description Flags
Use single "!" for LOCKED_PASSWD_PREFIX on Linuxes djm: ok+

Description Roumen Petrov 2004-03-08 23:31:16 AEDT 
Current prefix for locked password is set to '!!'
This might is RedHat specific.
Slakware and SuSE use:
'!' - account(password) can be unlocked
'*' - account(password) always remain locked
Comment 1 Darren Tucker 2004-03-08 23:48:21 AEDT 
What does the "lock account" command (ie passwd -l or equivalent) do?
Comment 2 Roumen Petrov 2004-03-09 17:23:52 AEDT 
passwd -l/-u : add/remove symbol '!' before password string
passwd -S : report locked password when first symbol is '!' or '*'
tested on some slackware and suse versions

about '*' prefix.
let account password contain '*' - passwd -S report locked
after passwd -l : password is '!*' - passwd -S report locked
after passwd -u : password is '*'  - passwd -S report locked
again after passwd -u : no changes in account state

I dont have information for other distro.
Comment 3 Darren Tucker 2004-03-30 13:28:50 AEST 
I think we should just change LOCKED_PASSWD_PREFIX to "!" for all Linuxes, which
will also work for Redhat.

Debian, Slackware and SuSE all use the upstream "shadow" package
(ftp://ftp.pld.org.pl/software/shadow) which does this to lock accounts:
    strcpy (newpw, "!");
    strcat (newpw, cp);
Comment 4 Darren Tucker 2004-03-30 13:30:55 AEST 
Created attachment 577 [details]
Use single "!" for LOCKED_PASSWD_PREFIX on Linuxes

OK for 3.8.1p1?
Comment 5 Damien Miller 2004-03-30 13:44:43 AEST 
Comment on attachment 577 [details]
Use single "!" for LOCKED_PASSWD_PREFIX on Linuxes

Fine by me
Comment 6 Darren Tucker 2004-03-30 14:04:49 AEST 
Patch applied, thanks for the report.
Comment 7 Roumen Petrov 2004-03-30 17:49:17 AEST 
I agree with single '!' in prefix.
Prefix '*' is only for always locked (usualy "system") accounts and might we can
skip that case.
Comment 8 Damien Miller 2010-04-16 15:51:12 AEST 
Mass move of bugs RESOLVED->CLOSED following the release of openssh-5.5p1