Page MenuHomePhabricator

Documentation improvement: avoid potentially problematic manual edits to /etc/shadow
Closed, ResolvedPublic

Description

Issue: Manual edits to /etc/shadow can be problematic if mangled
Version:current/master/whatever secure.phabricator.com is running
Reproduction steps:
https://secure.phabricator.com/book/phabricator/article/diffusion_hosting/#additional-ssh-user-conf contains the following advisement...

/etc/shadow: Open /etc/shadow and find the line for the vcs-user account.

The second field (which is the password field) must not be set to !!. This value will prevent login. If it is set to !!, edit it and set it to NP ("no password") instead.

Recommended resolution:
Change verbiage to the following...

The second field (which is the password field) must not be set to !!. This value will prevent login. If it is set to !!, run 'usermod -p NP vcs-user' to block only password logins.

Revisions and Commits

Restricted Differential Revision

Event Timeline

epriestley@orbital ~ $ usermod
-bash: usermod: command not found

That said, this is reasonable to suggest on systems where it is available.

@epriestley would

The second field (which is the password field) must not be set to !!. This value will prevent login. If it is set to !!, run 'usermod -p NP vcs-user' to block only password logins. If usermod is not available on your system you will need to set the password field value for vcs-user to 'NP' by manually editing /etc/shadow.

be acceptable?

epriestley added a revision: Restricted Differential Revision.Apr 10 2017, 7:22 PM

Does the language in D17648 look OK?

Absolutely. Thanks very much.

epriestley closed this task as Resolved by committing Restricted Diffusion Commit.Apr 10 2017, 9:15 PM
epriestley added a commit: Restricted Diffusion Commit.