I noticed something odd today throwing together a quick script to search for locked accounts. RHEL will create a user with a single ! in the password field of shadow , but if you lock an account using passwd -l or usermod it will modify the password field to !!<previous string>. The other linux distros I deal with ( ubuntu , SLES 9,10 ) modify shadow in the more 'standard' way using !<previous string> .

Does anyone have a good explanation for this? It wasn't difficult to work around but if there is a legit reason I'd like to know!

Thanks!

According to Wikipedia:

# salt and hashed password OR a status exception value e.g:

* "NP" or "!" or null - No password, the account has no password.
* "LK" or "*" - the account is Locked, user will be unable to log-in
* "!!" - the password has expired

HTH

Forrest