Quantcast
Channel: Active questions tagged password - Ask Ubuntu
Viewing all articles
Browse latest Browse all 333

Why exactly usermod -p command is not recommended?

$
0
0

For only academic purposes I am doing a research about the usermod command working with the -p or --password option:

Through man usermod exists:

-p, --password PASSWORDThe encrypted password, as returned by crypt(3).Note: This option is not recommended because the password(or encrypted password) will be visible by users listing theprocesses.The password will be written in the local /etc/passwd or /etc/shadow file.This might differ from the password database configured in your PAM configuration.You should make sure the password respects the system's password policy.

I know that the following two commands are the same

sudo usermod -p  rodimus_prime  rodimusprime-disabledloginsudo usermod -p 'rodimus_prime' rodimusprime-disabledlogin

Is reflected as:

sudo cat /etc/shadow | grep primerodimusprime-disabledlogin:rodimus_prime:19838:0:99999:7:::

Theoretically it is a plain password but it is not correct, is expected from the beginning an encrypted password instead. Therefore the correct approach would be:

sudo usermod --password $(openssl passwd    <plainpasswordtext>) rodimusprime-disabledloginsudo usermod --password $(openssl passwd -1 <plainpasswordtext>) rodimusprime-disabledlogin

Now, the reason of this question, the following note

Note: This option is not recommended because the password(or encrypted password) will be visible by users listing theprocesses.

If is executed the sudo cat /etc/shadow | grep usernamepattern command then is listed each user according the matched pattern with his respective encrypted password. It as expected. Therefore according with the mentioned special note: even if is visible the password: Is it encrypted, right? So:

Question

  • Why exactly usermod -p command is not recommended?

Viewing all articles
Browse latest Browse all 333

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>