Expired vs. Disabled password

llbb · 06-28-2010, 12:31 PM

I want to know what the difference between expired account (filed 8 of shadow file) and disabled account using filed 7 of shadow filed.
For example, I have Samba configured like a domain controller. I noticed that when the account is disabled in Linux I could login using the samba user, but when the account expired in Linux I couldn´t login with the Samba user.

frieza · 06-28-2010, 12:54 PM

best guess would be that 'disabled' sets your shell to /usr/sbin/nologin (or /usr/sbin/nologin or /sbin/nolgoin depending on your distribution), disalowing shell access to the linux box whereas expired disables all access

llbb · 06-29-2010, 10:54 AM

Thanks. So, the field 7 of shadow file disables an account (set the shell to sbin/nologin) and the field 8 expires an account (disables all access)? That´s correct?
Why if the account "expires o disables" with the field 7 or 8 sets, I cant´t access to Samba, but if I have an ! o * in the password account (account disabled) I can access?
Thank you!