On Sun, Dec 28, 2025 at 10:45:31AM +0100, Jochen Sprickerhof wrote: > * Chris Hofstaedtler <[email protected]> [2025-12-28 10:00]: > > I think turning shadow passwords -off- when uninstalling passwd is a > > no-go. > > Agreed. > > > > just enable shadow by default is the better solution here. > > > > Well, but where. base-passwd? > > I think that would make sense. base-passwd would need to: > > sed -i 's/\*/+/' passwd.master group.master > > And also ship a shadow.master and gshadow.master or generate it with > something like: > > sed 's/\([^:]*\):.*/\1:*::/' passwd.master > shadow.master > sed 's/\([^:]*\):.*/\1:*::/' group.master > gshadow.master > > I would assume that represents most of the Debian systems anyhow so it makes > sense to ship it by default. > > > Also not so useful if there is no > > chance of having *passwords* at all (because there are no tools > > to write a password without `passwd`). > > Not sure I understand, can you explain?
My point is: on a system without "passwd" installed, there are no actual passwords to "shadow" (protect), and thus you don't need shadow passwords at all. But if for base-passwd it is easy to make sure all systems start out as shadow-enabled, that would also seem good. At least it would reduce the number of states a Debian system can be in. @Colin: what do you think about this? Would you be willing to include this in base-passwd? (For context: currently installing passwd turns on shadow passwords, and that leaves the password database lockfile around.) > > Maybe `shadowconfig on` should just delete the lock file? Didn't > > investigate yet if this is feasible. > > Probably also a good idea but that would be libc as shadowconfig is using > pwconv which is calling lckpwdf() and that is creating the lock file. Maybe > it should clean it up upon ulckpwdf(). I think that might not be race-free to do in general? For the shadowconfig case, I'd feel okay to rm the file afterwards, under the assumption it will happen only once very early in the life of a Debian system, as part of a dpkg install scenario. > Feel free to clone and reassign if you agree. Lets discuss here a bit more. Chris
