How do I encrypt a new user's password using the useradd command?

Question

I would like to create an encrypted login password for a new user while using the useradd command in the CLI. I know that using option -p will allow me to create a password, but using this option does not encrypt the password. I also know that I can create an encrypted password using the passwd [username] command separately after the new user has been created through useradd, but like I said, I would like to know how to create an encrypted password through the useradd command.

Answer 1

You could use Perl:

perl -e "print crypt(\"foo\", \"\$6\$$(</dev/urandom tr -dc 'a-zA-Z0-9' | head -c 32)\$\")"

Or Python with the crypt module:

python -c "import crypt; print crypt.crypt(\"foo\", \"\$6\$$(</dev/urandom tr -dc 'a-zA-Z0-9' | head -c 32)\$\")"

• foo: the password to encrypt
• $6: the encryption type, in this case SHA-512
• $(</dev/urandom tr -dc 'a-zA-Z0-9' | head -c 32): the encryption salt, in this case a random 32 character string.

In conjunction with useradd:

useradd [...] -p"$(perl -e "print crypt(\"foo\", \"\$6\$$(</dev/urandom tr -dc 'a-zA-Z0-9' | head -c 32)\$\")")" [...]

Or:

useradd [...] -p"$(python -c "import crypt; print crypt.crypt(\"foo\", \"\$6\$$(</dev/urandom tr -dc 'a-zA-Z0-9' | head -c 32)\$\")")" [...]

Answer 2

You could skip the whole administrator-created-password user administration hassle by creating the userid, then using passwd --expire on it. From man passwd:

   -e, --expire
       Immediately expire an account's password. This in effect can force
       a user to change his/her password at the user's next login.

Answer 3

Since passwd does not support --stdin in Ubuntu you could try this:

perl -e "print crypt('password','sa');"

see https://administratosphere.wordpress.com/2011/06/16/generating-passwords-using-crypt3/

Answer 4

You can use "useradd -p ENCRYPTED-passwd", you need the whole password, including the definition of encryption type, and you need to escape any and all $'s, other than that it seems to works fine.

Simply create a random, disposable user, set their password to what you want to use, then copy their password from the shadow file, copy everything from the first to the second ":" in the shadow file, and use that after the -p.

Answer 5

The following worked for me w/Ubuntu 18.04 LTS:

echo 'your_password' > /tmp/pw.txt
pw="$(makepasswd --crypt-md5 --clearfrom=/tmp/pw.txt)"
sudo useradd -p "${pw}" your_username
rm -f /tmp/pw.txt

This may first require installing makepasswd using (on Ubuntu or Debian; google for other distros):

sudo apt install makepasswd