24

An install document I'm following instructs to add a user like so: 

sudo adduser --disabled-login --gecos 'GitLab' git

The --disabled-login flag is absent from most man pages I have searched.

I've made two users, one with the --disabled-login (foo), and one without (git).

As far as I can tell the --disabled-login flag does nothing. I can still su to both users, and both use /bin/bash as their login shell.

The only difference I can see is getent passwd has extra commas before the home folder on the user that has login's disabled. There is no documentation that I can find to indicate what this would mean. 

root@gitlab:~# getent passwd git
git:x:998:998:GitLab:/home/git:/bin/bash  

root@gitlab:~# getent passwd foo
foo:x:1001:1002:GitLab,,,:/home/foo:/bin/bash

UPDATE #1

I've found another difference, one user has a * as their password, the other has !:

root@gitlab:~# getent shadow git
git:*:15998::::::
root@gitlab:~# getent shadow foo
foo:!:15998:0:99999:7:::

What exactly does --disabled-login do on Ubuntu?

slm
  • 369,824
spuder
  • 18,053
  • For the record, the extra commas separate the fields within the "gecos" field: full name, room number, work phone, home phone. I don't know why they would be present in one version and not the other though. You can find documentation on this in the manpage of the chfn tool. – Random832 Oct 21 '13 at 02:47
  • That makes sense. I accidentally chose 'y' when prompted to enter in that information when I added one of the users. The other user was added through puppet. – spuder Oct 21 '13 at 04:16

3 Answers3

22

The explanation is not well documented.

--disabled-login sets the password to !

Password values

NP or null = The account has no password
*  = The account is deactivated & locked
!  = The login is deactivated, user will be unable to login
!!  = The password has expired

Examples

root@gitlab:~# getent shadow vagrant
vagrant:$6$abcdefghijklmnopqrstuvwxyz/:15805:0:99999:7:::

root@gitlab:~# getent shadow foo
foo:!:15998:0:99999:7:::

root@gitlab:~# getent shadow git
git:*:15998::::::

wikipedia briefly covers this. It appears that * and ! effectively do the same thing; prevent the user from logging in (but not from su'ing from a different user)

spuder
  • 18,053
6

It's partially discussed here in the shadow man page.

excerpt

$ man shadow
...
...
encrypted password
     Refer to crypt(3) for details on how this string is interpreted.

     If the password field contains some string that is not a valid result of 
     crypt(3), for instance ! or *, the user will not be able to use a unix
     password to log in (but the user may log in the system by other means).

     This field may be empty, in which case no passwords are required to 
     authenticate as the specified login name. However, some applications which
     read the /etc/shadow file may decide not to permit any access at all if the
     password field is empty.

     A password field which starts with a exclamation mark means that the 
     password is locked. The remaining characters on the line represent the 
     password field before the password was locked.

Depending on your version of the man page for adduser it's referenced there.

excerpt adduser man page

--disabled-login
       Do  not  run passwd to set the password.  The user won't be able
       to use her account until the password is set.

--disabled-password
       Like --disabled-login, but logins are still possible (for  exam-
       ple using SSH RSA keys) but not using password authentication.
slm
  • 369,824
-1

A more technical explanation of what happens can be found in the code itself - the best and most comprehensive documentation (that good even the compiler understands it)!

For disabled-password, $ask_passwd and $disabled_login are set to false, resulting in a syscall to usermod -p * $username, effectively disabling the password, setting it (not the password, but the hash) to *.

For disabled-login, $disabled_login is set to true instead, resulting in no password being set at all, keeping it at ! (also effectively disabling it).

The code can be found eg. here, and information on locking accounts on the usermod man.

darthn
  • 1
  • Reading the Perl code, it seems as if the password hash is set to * only if $disabled_login is zero, i.e. if the --disabled-login option has not been used (the opposite of what you are saying). It is then later set to the hashed password. If --disable-login is used, the call to usermod -p * is not made and the password hash is left as the default !. This is basically what the accepted answer says, but without referring to the code. – Kusalananda Dec 31 '22 at 18:43
  • Thank you very much for the comment @Kusalananda, i mixed it up because i was looking for the disabled-password option.. I've adjusted my answer. – darthn Jan 02 '23 at 02:35