I accidentally enabled(set) my root password (by default it is locked), and now I want to "undo" it. I used both commands
sudo usermod -p '!' root
and
sudo passwd -dl root
in that order.
How do I check if root's account is locked?
You can use the passwd
command:
# passwd -S
root P 11/04/2014 -1 -1 -1 -1
# passwd -l root
passwd: password expiry information changed.
# passwd -S
root L 11/04/2014 -1 -1 -1 -1
# passwd -d root
passwd: password expiry information changed.
# passwd -S
root NP 11/04/2014 -1 -1 -1 -1
From man 1 passwd
:
-S, --status
Display account status information. The status information consists
of 7 fields. The first field is the user's login name. The second
field indicates if the user account has a locked password (L), has
no password (NP), or has a usable password (P). The third field
gives the date of the last password change. The next four fields
are the minimum age, maximum age, warning period, and inactivity
period for the password. These ages are expressed in days.
The data shown is stored in /etc/shadow
, the file which holds the encrypted passwords.
For example, after each of the above passwd
commands, the states were:
1:root:$6$............long hash...............::::::
1:root:!$6$........same long hash.............:16478::::::
1:root::16478::::::
One possibility is to look into /etc/passwd by entering
grep root /etc/passwd
It should show a line starting like root:x: ......
where the x indicates that encrypted passwords are stored in the shadow file. If this is the case, we look into it by running
sudo grep root /etc/shadow
(shadow file needs sudo to be opened!) You should get a line beginning like the following as a result root:!: ......
where the !
or a *
signalize that the account is disabled. Any other value (not beginning with ! or *) after root:
would indicate a working password.
By default when you install Ubuntu you should not know root password. It exists, but user should not know it. An admin, of course, could choose to alter the password with sudo passwd
but generally it should not be necessary, unless you know what you're doing and why you're doing it.
A file that contains information on all user passwords is /etc/shadow
and each entry in that file is encrypted. So unless an attacker gained access to your system and stole this file, he or she should not be able to enter root at all. There's always a possibility, of course, hence I suggest you disable any remote access features : telnet (not enabled by default ) , ssh, remote desktop, etc. Get yourself nmap
tool and scan your system with sudo nmap localhost
to see what ports may be open on your system. Also, get yourself a firewall; ubuntu comes with ufw firewall, which is simple to use and does the job well enough.
Among other methods, you could test root account with sudo -i
In the /etc/sudoers
file , you should have a line like this : sudo -i
. If you can't log in as root, you do not see the # as prompt, then the account is locked
Defaults env_reset,timestamp_timeout=30
timestamp_timeout will tell sudo to ask for password after 30 seconds again, so that you aren't logged in with root privileges all the time. It's one of the ways of securing your system.
An adverse side effect of changing root password is that if you forget password or another user on your system forgets the password, you won't have access to root. I'm not aware of any instances, but there's always possibility to mess up the system, because some of the processes run as root, and if you lock root account there is a possibility those might not work correctly or at all.
I strongly recommend you read through man sudoers
, man passwd,
man shadow`.
Best of luck and hope this helps !
for i in $(cat /etc/passwd | awk -F ':' '{print $1}'); do echo "##############" "$i" "############";chage -l $i; echo "##################################"; done | nl | less
Easy.
Hit Ctrl+Alt+F1. This will bring to a separate terminal. Try to login as root by typing root
as your login and providing the password.
If the root account is enabled, the login will work. If the root account is disabled, the login will fail.
To get back to your GUI, hit Ctrl+Alt+F7.
su
will do.