RE: Lock Account

Miguel said ...

If you want to disable a user temporaly you can add an asterisk (*) before the corresponding entry
of that
user in the /etc/passwd file:

before:

 miguel:x:500:500:miguel gonzalez:/home/miguel:/bin/bash

 *miguel:x:500:500:miguel gonzalez:/home/miguel:/bin/bash

 HTH  Miguel

... this is a very dangerous MYTH. It does not disable the account (there is no comment structure for the passwd file), all it does is change the name of it. So, although the user can no longer log into to the "miguel" account, they could log into one called "*miguel". It is true that in this particular case, the system seems to be using a shadow password file and the corresponding shadow entry has not been renamed, hence the login would fail, but in the general case this may not be true - it depends on your system. Another drawback to this method is that now all the files that were previously owned by "miguel" are now owned by "*miguel", potentially creating confusion.

Depending on the password management system on your system, there are betters ways to disable accounts. On a traditional unix system using 13 character password hashes, an effective way is to insert the "*" onto the front of the hashed passwd making it 14 characters and containing an invalid character. No login will succeed but all other services function as normal

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Rick Parsons

Bristol, England Received on Fri Feb 21 12:27:24 2003