Birmingham mumbai

[
 51 
]
You should notice right away that the 
root
 user account doesn't have a password 
hash at all. Instead, there's an asterisk where the password hash would've been. In 
practice, placing an asterisk or exclamation point here is one way to lock an account. 
Even easier, you can use the 
passwd -l
 command to lock an account without having 
to edit a file. But either way, we can still switch to the 
root
 account (which I'll show 
you how to do later on in this chapter). Entering an asterisk or exclamation mark 
in the second field creates the restriction that we can't directly log in as that user 
from the shell or over the network. We have to log in to the system as a normal user 
account first, and then we can still switch to that user if we want to.
With the discussion of password hashes out of the way, there are a few more fields 
within 
/etc/shadow
 entries that we should probably understand. Here's a contrived 
example line.
mulder:$6$TPxx8Z.:16809:0:99999:7:::
Continuing on with the third column, we can see the number of days since the Unix 
epoch that the password was last changed. For those that don't know, the Unix 
epoch is January 1, 1970. Therefore, we can read that column as the password having 
last been changed 16,809 days after the Unix epoch.
Personally, I like to use the following command to show more easily when the 
password was last changed:
sudo passwd -S
This will result in an output that looks something like the following:
Figure 2.8: Checking the date of the last password change for a user
By executing this command, you can view information about any account on your 
system. The first column is obviously the username. The second has to do with the 
status of the password, which in this case is 
L
, which refers to the fact that the user 
has a password that is locked. It would show 
P
 if the password was set and usable, or 
NP
 if the user didn't have a password at all. 

---

Managing Users and Permissions