Bug 811 - locked /etc/shadow password prefix on linux
Summary: locked /etc/shadow password prefix on linux
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 3.8p1
Hardware: All Linux
: P2 enhancement
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
Depends on:
Blocks: 821
  Show dependency tree / graph
 
Reported: 2004-03-08 23:31 AEDT by Roumen Petrov
Modified: 2010-04-16 15:51 AEST (History)
0 users

See Also:

Attachments
Use single "!" for LOCKED_PASSWD_PREFIX on Linuxes (625 bytes, patch)
2004-03-30 13:30 AEST, Darren Tucker 		djm: ok+
Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Roumen Petrov 2004-03-08 23:31:16 AEDT 
Current prefix for locked password is set to '!!'
This might is RedHat specific.
Slakware and SuSE use:
'!' - account(password) can be unlocked
'*' - account(password) always remain locked
Comment 1 Darren Tucker 2004-03-08 23:48:21 AEDT 
What does the "lock account" command (ie passwd -l or equivalent) do?
Comment 2 Roumen Petrov 2004-03-09 17:23:52 AEDT 
passwd -l/-u : add/remove symbol '!' before password string
passwd -S : report locked password when first symbol is '!' or '*'
tested on some slackware and suse versions

about '*' prefix.
let account password contain '*' - passwd -S report locked
after passwd -l : password is '!*' - passwd -S report locked
after passwd -u : password is '*'  - passwd -S report locked
again after passwd -u : no changes in account state

I dont have information for other distro.
Comment 3 Darren Tucker 2004-03-30 13:28:50 AEST 
I think we should just change LOCKED_PASSWD_PREFIX to "!" for all Linuxes, which
will also work for Redhat.

Debian, Slackware and SuSE all use the upstream "shadow" package
(ftp://ftp.pld.org.pl/software/shadow) which does this to lock accounts:
    strcpy (newpw, "!");
    strcat (newpw, cp);
Comment 4 Darren Tucker 2004-03-30 13:30:55 AEST 
Created attachment 577 [details]
Use single "!" for LOCKED_PASSWD_PREFIX on Linuxes

OK for 3.8.1p1?
Comment 5 Damien Miller 2004-03-30 13:44:43 AEST 
Comment on attachment 577 [details]
Use single "!" for LOCKED_PASSWD_PREFIX on Linuxes

Fine by me
Comment 6 Darren Tucker 2004-03-30 14:04:49 AEST 
Patch applied, thanks for the report.
Comment 7 Roumen Petrov 2004-03-30 17:49:17 AEST 
I agree with single '!' in prefix.
Prefix '*' is only for always locked (usualy "system") accounts and might we can
skip that case.
Comment 8 Damien Miller 2010-04-16 15:51:12 AEST 
Mass move of bugs RESOLVED->CLOSED following the release of openssh-5.5p1