Arch Linux

skywarp

Member

Registered: 2009-11-14

Posts: 23

shadow and gshadow have x in password field

I tried doing some research to find out what an 'x' in the password field of the shadow and the gshadow files means and couldn't find an answer that I'm sure about. I know an 'x' in the passwd and groups files means that the Shadow Suite is being used and the 'x' acts as a place holder. Why would the shadow files have an 'x' in the password field though? It seems to only be for system accounts, so maybe it means that some other authentication method is being used besides passwords. I can't find any mention of it in the man files. The man files and Google search both indicate that the only thing that should in the password field should be an encrypted password, an '!', an '!!', or an '*'. I tried looking through the source code for the Shadow Suite a little bit too, but couldn't find an answer. Any ideas?

karol

Archivist

Registered: 2009-05-06

Posts: 25,440

Re: shadow and gshadow have x in password field

Similar thread https://bbs.archlinux.org/viewtopic.php?id=34349

Last edited by karol (2011-04-24 19:04:41)

skywarp

Member

Registered: 2009-11-14

Posts: 23

Re: shadow and gshadow have x in password field

The question posed in that post was never answered correctly. The answer posted referred to an 'x' being in the password field of the /etc/passwd file not the /etc/shadow file. My question and the question posed in the post you referenced is why is there an 'x' in the password field of the /etc/shadow file.

karol

Archivist

Registered: 2009-05-06

Posts: 25,440

Re: shadow and gshadow have x in password field

The question posed in that post was never answered correctly.

Yes, I know. Actually at first I answered the same way to your question and only later removed it 'P

The answer posted referred to an 'x' being in the password field of the /etc/passwd file not the /etc/shadow file. My question and the question posed in the post you referenced is why is there an 'x' in the password field of the /etc/shadow file.

According to a  Random Internet Post (tm), shadow file shouldn't have a 'x'. That's all I "know".

skywarp

Member

Registered: 2009-11-14

Posts: 23

Re: shadow and gshadow have x in password field

According to a  Random Internet Post (tm), shadow file shouldn't have a 'x'. That's all I "know".

That's the answer I keep coming across too, but I'm left wondering if I should be changing the 'x' to an '!'. I didn't put them in the /etc/shadow file. Does your /etc/shadow file have an 'x' in the password field for various system accounts?

karol

Archivist

Registered: 2009-05-06

Posts: 25,440

Re: shadow and gshadow have x in password field

[karol@black ~]$ sudo grep ':x:' /etc/shadow
bin:x:14871::::::
daemon:x:14871::::::
mail:x:14871::::::
ftp:x:14871::::::
http:x:14871::::::
nobody:x:14871::::::
[karol@black ~]$ sudo grep ':x:' /etc/gshadow
rfkill:x::
network:x::
video:x::
floppy:x::
storage:x::
scanner:x::
power:x::
dbus:x::
avahi:x::
aurbuild:x::

loafer

Member

From: the pub

Registered: 2009-04-14

Posts: 1,772

Re: shadow and gshadow have x in password field

The x only seems to appear in shadow when the shell is /bin/false in passwd.

edit: I'm not sure if there's any need to worry about gshadow as groups don't tend to have passwords.

edit:  They are the ones included in the filesystem package (root isn't there in the examples above because we set a password for root):

root::14871::::::
bin:x:14871::::::
daemon:x:14871::::::
mail:x:14871::::::
ftp:x:14871::::::
http:x:14871::::::
nobody:x:14871::::::

I'm pretty sure this isn't a problem.  The field containing x is for the encrypted passwords and since "x" won't match a real password is there a problem here?

Last edited by loafer (2011-04-24 22:05:06)

---

All men have stood for freedom...
For freedom is the man that will turn the world upside down.
Gerrard Winstanley.

rowdog

Member

From: East Texas

Registered: 2009-08-19

Posts: 118

Re: shadow and gshadow have x in password field

man 5 shadow

If the password field contains some string that is not a valid
result of crypt(3), for instance ! or *, the user will not be able
to use a unix password to log in (but the user may log in the
system by other means).

x is not a valid result of crypt.

skywarp

Member

Registered: 2009-11-14

Posts: 23

Re: shadow and gshadow have x in password field

The x only seems to appear in shadow when the shell is /bin/false in passwd.

edit: I'm not sure if there's any need to worry about gshadow as groups don't tend to have passwords.

edit:  They are the ones included in the filesystem package (root isn't there in the examples above because we set a password for root):

root::14871::::::
bin:x:14871::::::
daemon:x:14871::::::
mail:x:14871::::::
ftp:x:14871::::::
http:x:14871::::::
nobody:x:14871::::::

I'm pretty sure this isn't a problem.  The field containing x is for the encrypted passwords and since "x" won't match a real password is there a problem here?

That is a good observation. I didn't catch the pattern with /bin/false. I didn't think anything was broken because I recently ran updates and the gshadow.pacnew file has x's in it too. I was just curious because I like to know why things are the way they are instead of just accepting it for the way it is.

x is not a valid result of crypt.

That was what lead me down this road. Thanks for all responses!!