Red Hat Bugzilla – Bug 1185425
RHEL7 - shadow-utils: usermod account lock/unlock behavior differs on passwd lock/unlock
Last modified: 2016-11-03 23:40:26 EDT
Description of problem: * passwd -l has different behavior than usermod -L * The first command pushes two '!' characters in front of user password on /etc/shadow file, and the second puts only one. * While those are different commands, this could lead to some confusion, in this case: - Lock the user with passwd -l user - Try to unlock the user with usermod -U user * The latter removes only one '!' character, and this way the user still gets locked. You have to run usermod -U twice to unlock a user locked by passwd -l command, so it will remove both '!'. Version-Release number of selected component (if applicable): shadow-utils-4.1.5.1-13.el7.x86_64 passwd-0.79-4.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Lock the user with passwd -l user 2. Try to unlock the user with usermod -U user Actual results: The target user will still be locked. Expected results: Account should be unlocked. Additional info: * This behavior is also seen in RHEL6. * passwd locked, passwd unlocked: OK * passwd locked, usermod unlocked: FAIL * usermod locked, usermod unlocked: OK * usermod locked, passwd unlocked: OK
I'm prone to say that the passwd behavior is the desired one. Check /etc/shadow contents; every disabled account has *two* exclamation marks, reflecting passwd behavior. IMO, usermod has to be fixed.
Yes, this should be probably fixed in usermod at least in a way that the unlocking works. Whether it should also prepend double ! is debatable.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2322.html