5

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value.

I have added a separate administrator user. This user has an authorized key for SSH, no password access, and passwordless sudo.

I would like to remove any trace of the root password and lock the root user.

This can be done with passwd -d root && passwd -l root. However, this leaves a window between the two operations for bad behavior. How can you take both actions in one step?

This is more of an academic question than a practical one. My solution is sed -e -i -e 's/^root:\([^:]*\)\(.*\)$/root:!!\2/' /etc/shadow, but it feels like there should be a less error-prone, idempotent operation.

  • 2
    I indeed find a bit strange that passwd interprets the -d flag applied on a locked account as "delete the password and unlock the account". The only documented behavior of this flag is to remove the passwords, not unlock the accounts... – WhiteWinterWolf May 27 '15 at 18:51
  • 1
    From the passwd manpages on a debian flavored machine >-l, --lock > Lock the password of the named account. This option disables a > password by changing it to a value which matches no possible > encrypted value (it adds a ´!´ at the beginning of the password). > > Note that this does not disable the account. The user may still be > able to login using another authentication token (e.g. an SSH key). > To disable the account, administrators should use usermod > So the way you lock an account is to make its password hash have a !. – LvB May 27 '15 at 19:28
  • Its logcal that deleting the password than also unlocks the account, it also deletes the lock after all. – LvB May 27 '15 at 19:31
  • Why do you need to remove the root password? What value does that provide above locking the account? – emory May 27 '15 at 20:46
4

You may want to try:

usermod -p '!!' root

usermod with the -p parameters takes the raw value to bet set as encrypted password in the /etc/shadow files.

The traditional usage of this parameter is to give to usermod an already encrypted password, but it accepts also the '!!' flagging the account as locked.

In the end, this command will remove the current password and leave only the exclamation marks setting the root account as locked in the passwd way¹, all in one move using a safe and standard command, thus fulfilling the request.


¹: According to this discussion, there is no established standard on the way to lock an account. So usermod -L uses only a single exclamation mark (!) in front of the hashed password to lock it, while passwd -l uses two (!!).

1

To delete and lock an account with passwd(1) in one command, simply specify both -d and -l in the same invocation:

passwd -dl root

  • As embarrassingly obvious as this answer was, I nonetheless must credit this answer on AskUbuntu for bringing it to my attention. – Stuart P. Bentley Sep 27 '18 at 23:48
  • 2
    This does not work with passwd 0.79, in use on RHEL 7 systems. I do not know what minimum version of passwd is required for this functionality. – ToBeReplaced Sep 28 '18 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.