what should /etc/shadow look like?

**deadflowr** · February 25th, 2013

The ! symbol means the account is locked. In this instance locked and disable are synonymous.
When you lock a password, you ultimately disable it, as if you want to unlock it, you'll need to create a new one.
Or use the -u(unlock flag), in which case the old password will be re-enabled. But if, as it is in this case, you never set a password, then unlocking it would be moot, as you never knew what is/was.

**lou21** · February 25th, 2013

So the information I saw somewhere else (from google I have to admit) that the ! in the password field indicates a key based logon is possible is wrong then?

Good news. Thank you all and sorry that the original wording of the question was poor.

**lou21** · February 25th, 2013

Originally Posted by matt_symes

Hi

You have not been hacked, as i have not. the x's i added.

Code:

matthew-S206:/home/matthew/fxp % sudo grep root /etc/shadow
root:!:xxxx:x:xxxx:7:::
matthew-S206:/home/matthew/fxp %

Kind regards

Cool. It's good to see that my file is still in the default settings (as it should be). Thank you very much!

**bodhi.zazen** · February 26th, 2013

The discussion here is for the most part spot on.

The ! and * symbols prevent root from logging in via a password.

You can obtain root access via several other means, however. This might include booting a live CD, booting to recovery mode, using sudo, logging in via ssh (keys) or kerberos. This list is incomplete , but hopefully you get the idea.

See https://help.ubuntu.com/community/RootSudo

**lou21** · February 27th, 2013

Originally Posted by bodhi.zazen

The discussion here is for the most part spot on.

The ! and * symbols prevent root from logging in via a password.

You can obtain root access via several other means, however. This might include booting a live CD, booting to recovery mode, using sudo, logging in via ssh (keys) or kerberos. This list is incomplete , but hopefully you get the idea.

See https://help.ubuntu.com/community/RootSudo

So that means that IF a remote desktop service of some type is installed and IF a shh key exists then a remote root logon would be possible?

**schragge** · February 27th, 2013

From the manual page for shadow(5)

Refer to crypt(3) for details on how this string is interpreted.

If the password field contains some string that is not a valid
result of crypt(3), for instance ! or *, the user will not be able
to use a unix password to log in (but the user may log in the
system by other means).

This field may be empty, in which case no passwords are required to
authenticate as the specified login name. However, some
applications which read the /etc/shadow file may decide not to
permit any access at all if the password field is empty.

A password field which starts with a exclamation mark means that
the password is locked. The remaining characters on the line
represent the password field before the password was locked.

In short, you can use any character outside the [a-zA-Z0-9./] set to lock password in /etc/shadow. By convention, passwd -l uses ! for it, and passwd -u strips the ! prefix from locked password.

**schragge** · February 27th, 2013

Originally Posted by lou21

So that means that IF a remote desktop service of some type is installed and IF a shh key exists then a remote root logon would be possible?

The access for root over ssh can be disabled in the configuration file /etc/ssh/sshd_config. From the manual page for sshd_config(5)

PermitRootLogin
Specifies whether root can log in using ssh(1). The argument
must be “yes”, “without-password”, “forced-commands-only” or
“no”. The default is “yes”.

If this option is set to “without-password” password authentica-
tion is disabled for root.

If this option is set to “forced-commands-only” root login with
public key authentication will be allowed, but only if the
command option has been specified (which may be useful for taking
remote backups even if root login is normally not allowed). All
other authentication methods are disabled for root.

If this option is set to “no” root is not allowed to log in.

**bodhi.zazen** · February 27th, 2013

Originally Posted by lou21

So that means that IF a remote desktop service of some type is installed and IF a shh key exists then a remote root logon would be possible?

Depending on how ssh and your VNC is configured, yes. I listed other protocols in my post.

As indicated by schragge, you configure each service (ssh, kerberos, VNC, etc) to allow/restrict users, including root.