39

I am writing a script to add a large amount of users to a system. Part of this involves setting default passwords for each user. How can I set users' passwords without it prompting me for the password up front?

Unfortunately passwd doesn't seem to take an argument stating the new password to set. I'm using Ubuntu 11.10.

8 Answers 8

52

Try usermod:

usermod --password PASSWORD USERNAME

The only thing is this needs a pre-encrypted password string which you'd have to generate first.

In order to generate the encrypted password you can use openssl. For example:

usermod --password $(echo MY_NEW_PASSWORD | openssl passwd -1 -stdin) USERNAME
5
  • 3
    ...which I can generate using mkpasswd. Excellent, thanks! Nov 18, 2011 at 11:27
  • 20
    You can also use openssl to generate the encrypted password. For example: usermod --password $(echo my_new_password | openssl passwd -1 -stdin) USERNAME
    – Eric Smith
    Jan 16, 2015 at 19:34
  • 4
    Three years too late. I couldn't make the answer @EricSmith, but I did discover a simpler version of the command that did work: usermod --password $(openssl passwd -1 {password}) {username}
    – BoCoKeith
    Nov 29, 2018 at 15:36
  • Does not work on Ubuntu 20 May 1, 2020 at 10:39
  • 3
    Always a good idea to put the PASSWORD in single quotes since it may contains one or more $1,$2... which you don't want to be substitued (i.e. for nothing, falsifying the hash). usermod --password '$HASH' $_user
    – Frank N
    Dec 17, 2020 at 15:49
33

You should look at the chpasswd command (if available in your linux flavor):

echo 'userid:newpasswd' | chpasswd

Or, you can cat a file listing userid:passwd for each account on a separate line.

That's it.

4
  • 2
    this worked for me in Dockerfile
    – Vishrant
    Jan 27, 2019 at 18:58
  • Also works on Ubuntu 20.04 May 1, 2020 at 10:41
  • 1
    I think that should be: echo 'user_name:password' | chpasswd
    – Zendel
    Jan 28, 2022 at 13:35
  • chpasswd is the obvious answer, but it has a major flaw: the OP wants to write a script, so the plaintext passwords will be stored on disk. If you're on an SSD there is no reliable way to delete the script after use. Worse, if you change the script you'll probably leave previous versions on the SSD.
    – EML
    Mar 5, 2022 at 20:30
5

Inspired by Eric Smith's idea, combining openssl passwd and usermod -p command worked. Generate hashed value of password along with salt value.

$ openssl passwd -1  -salt 5RPVAd clear-text-passwd43
$1$5RPVAd$vgsoSANybLDepv2ETcUH7.

Then, copy the encrypted string to usermod. Make sure to wrap it with single quote.

$ usermod -p '$1$5RPVAd$vgsoSANybLDepv2ETcUH7.' root

Check it out in shadow file.

$ grep root /etc/shadow
root:$1$5RPVAd$vgsoSANybLDepv2ETcUH7.:17774:0:99999:7:::
3
echo -e "NEW_PASSWORD\nNEW_PASSWORD" | passwd username
1

Here is a good solution, just one line:

useradd -p $(openssl passwd -1 "$pass") "$user"

I can add others parameters like -m to create the home directoty, etc.

0

You should use password aging, and set the users so that they must change their password on the first login. See this article.

1
  • These intended to be FTP-only accounts, but good advice. ;) Nov 18, 2011 at 22:49
0
(echo user; echo password) | passwd

works for me both in physical host and container, for various OSes (ubuntu xenial,bionic, debian9,10, centos75,76, coreos)

echo user:password | chpasswd

works for some OSes, but some OS such as debian9,10 will show an error can not connect to /var/run/nscd/socket since it use /etc/nsswitch.conf to determine where it store the password.

0

I'm looking to do this myself and to keep it from being something that can be intercepted either via ps (which could be overcome with changing /proc, but that's invasive). For me, it looks like the best way to do this will be using a tmpfs created in ram and hold all the info there as root only, chmod 600 files.

mkdir /mnt/tmp
mount -o size=10M -t tmpfs none /mnt/tmp
<program that opens file in /mnt/tmp/pass, creates lines with user:newpass>

Use the chpass /mnt/tmp/pass command as others suggested

this 50 reputation to answer things annoys me greatly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .