Break in through disabled root account

[CharlesA]

Oh, I remember it now...

In earlier versions the --lock option also marked the account as expired.
They changed this behavior in passwd 1:4.1.1-3. You can check out the changelog:

less +/"shadow \(1:4.1.1-3\)" /usr/share/doc/passwd/changelog.Debian.gz

So, in Ubuntu 8.10 (I think) and in earlier releases the --lock option disables an account by changing the password to a value which matches no possible encrypted value, and by setting the account expiry field to 1.

I see.

Thanks for the info.