root su to disabled account - no longer works in 11.2?

glogic · May 15, 2010, 12:34am

The title says it all. In 11.2 I’m finding that I can’t su to a disabled account from root. It asks me for a password, which there is none. Is this a new feature? How can I disable said feature?

Thanks!!
SUSE newb

ken_yap · May 15, 2010, 1:05am

If it did before it was probably something that was felt to be an oversight which has been corrected. su to an account without a valid shell will also fail. You will have to enable the account before su.

Monex · May 15, 2010, 11:53am

Hi,

ken_yap is points out the right thing. But you can go around by using sudo -u <user> -s.

Hope this helps

DenverD · May 16, 2010, 12:03pm

sorry, i do not understand “disabled account”…

how does one disable an account?

i know how to add and delete users [adduser/userdel] but on my system
man userdisable
returns: No manual entry for userdisable

ken_yap · May 16, 2010, 12:37pm

man 1 passwd, see -l, lock password.

DenverD · May 16, 2010, 1:29pm

ken yap wrote:
> man 1 passwd, see -l, lock password.

ok thanks…but, are you assuming by using “disabled account” the OP
meant “root su to locked password account - no longer works …”?

ah, maybe if the OP had used the correct terminology s/he would have
seen the answer in the question: When i try to switch user to a locked
password account, why will it not accept the locked password as valid?

glogic · May 17, 2010, 4:16pm

hi all,

sorry for any confusion. what i meant by disabled is creating a user without a password, thereby disabling the account. there is no password.

Monex: that helps a ton thank you!

ken_yap: what i find strange is that with every other distro i’ve used, and every release (including sles) i’ve been able to su to a disabled account from root. it’d be great to read some documentation to see the reasoning behind the change.

thanks again!!

ken_yap · May 17, 2010, 4:20pm

Maybe it’s a recent change and other distros haven’t caught up yet. SLES is conservative so that’s no surprise.

ken_yap · May 17, 2010, 4:26pm

No, a locked password will not be accepted. Reason is locking the password involves adding a character to the hash that is never valid. usually !. The only difference between a locked password and a disabled password is that the locked password is reversible by removing the invalid character, whereas a disabled password was never a valid password in the first place. Either way the effect is the same, the account cannot be entered.

However, root, who is supposed to be all powerful should be able to enter the account, without supplying the password. It seems that even this power has been disabled, but can be worked around.