Our RedHat Linux box keeps a '*' in the password field to indicate that the
password is located in the shadow file.
>From what I've seen, vendors typically use 'x' or '*' to indicate either an
impossible match or a shadow password. I think the "overloaded" meaning isn't
too bad since one can consider it to mean that the password is shadowed and, if
upon checking the shadow file (if it exists), the record can't be found or the
shadow itself is impossible, then the system can decide that this user isn't
loginable.
Noel
[EMAIL PROTECTED] on 05/24/2000 03:54:11 PM
Please respond to [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
cc: (bcc: Noel L Yap)
Subject: Re: CVSROOT/passwd enhancements
When I first studied Unix a few years ago, I read that one should use an
asterisk to denote an impossible (i.e. unusable) password because
asterisks are not in the set of ciphertext characters used by the Unix
password encryption scheme.
On our Red Hat Linux and Solaris systems, "x" is used in the password
file to indicate that the password is located in the shadow file.
Also, "NP" is often used to denote an impossible password.
--Avi
Larry Jones wrote:
>
> Tony Cleveland writes:
> >
> > Aside from any technical issues, doesn't a "*" in the password field of the
> > password file typically indicate a locked account?
>
> It's what's traditionally used in /etc/passwd when shadow passwords are
> in use; this usage seems analogous -- "the password is not here, it is
> stored elsewhere". It *does* have the convenient property of being an
> impossible password string, so if the "somewhere else" doesn't exist or
> doesn't contain a password for this particular user, the account is
> automatically disabled. Most people I know use "x" (which is also an
> impossible password string) for intentionally disabled accounts.
This communication is for informational purposes only. It is not intended as
an offer or solicitation for the purchase or sale of any financial instrument
or as an official confirmation of any transaction. All market prices, data
and other information are not warranted as to completeness or accuracy and
are subject to change without notice. Any comments or statements made herein
do not necessarily reflect those of J.P. Morgan & Co. Incorporated, its
subsidiaries and affiliates.
