Page MenuHomePhabricator

Documentation improvement: avoid potentially problematic manual edits to /etc/shadow
Closed, ResolvedPublic

Description

Issue: Manual edits to /etc/shadow can be problematic if mangled
Version:current/master/whatever secure.phabricator.com is running
Reproduction steps:
https://secure.phabricator.com/book/phabricator/article/diffusion_hosting/#additional-ssh-user-conf contains the following advisement...

/etc/shadow: Open /etc/shadow and find the line for the vcs-user account.

The second field (which is the password field) must not be set to !!. This value will prevent login. If it is set to !!, edit it and set it to NP ("no password") instead.

Recommended resolution:
Change verbiage to the following...

The second field (which is the password field) must not be set to !!. This value will prevent login. If it is set to !!, run 'usermod -p NP vcs-user' to block only password logins.

Event Timeline

epriestley@orbital ~ $ usermod
-bash: usermod: command not found

That said, this is reasonable to suggest on systems where it is available.

@epriestley would

The second field (which is the password field) must not be set to !!. This value will prevent login. If it is set to !!, run 'usermod -p NP vcs-user' to block only password logins. If usermod is not available on your system you will need to set the password field value for vcs-user to 'NP' by manually editing /etc/shadow.

be acceptable?

Absolutely. Thanks very much.