passwd-lock tips — authorized account-lock literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run passwd -l / passwd -u on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any lock — never lock production accounts without change control.
3. Record short factual notes; quote short Evidence (login, lock/unlock action — never hashes).
4. Optional: password change → passwd-tips.
5. Optional: usermod -L/-U → usermod-tips (related but distinct lever).
6. Optional: PAM fail counts → faillock-tips; aging → chage-tips.
7. Prefer disposable lab accounts for lock drills.
8. Stop at literacy — no attack or unauthorized mass-lock cookbooks.

Allowed framing

• Classroom labs reviewing passwd -l / passwd -u on authorized disposable accounts.
• Binding short factual notes as Evidence (lock/unlock intent — no shadow hashes).
• Documenting expected vs observed login refusal for authorized inventory notes.
• Comparing passwd-lock ↔ usermod -L / faillock / chage peer tip pages under one binder.
• Testing unlock (-u) restoration when the syllabus authorizes that drill.

Scope we will not cover

• No crack/pirate/keygen via passwd locks.
• No intentional unauthorized mass-locks against foreign hosts.
• No secret-theft or shadow-hash dumping against hosts you do not own.
• No cookbooks that lock shared/production accounts without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with shadow-utils / passwd installed.
2. Create a throwaway account via useradd-tips and set a lab password via passwd-tips before any lock drill.
3. With authorization, lock (passwd -l) then unlock (passwd -u); quote observed login refusal/restore as Evidence (no hashes).
4. Optional: compare with usermod-tips -L/-U and faillock-tips.
5. Stop at literacy — no attack or unauthorized lock cookbooks.

Practical notes for authorized labs

• passwd -l typically prefixes the password hash with ! — never paste that hash into binders; quote "locked" as a label only.
• usermod -L is a related lever — keep Evidence labels distinct from this page's passwd -l drills.
• Lock ≠ expire (chage) ≠ PAM fail-lock (faillock) — keep the three levers separate in notes.
• Prefer disposable lab accounts; never experiment on shared production UIDs.
• Never commit shadow dumps to git — even for labs.
• Label lab-only locks clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host account locks → refuse.
• Unauthorized mass-lock cookbooks → refuse.
• Sharing unredacted shadow hashes → refuse.

For legal, authorized and educational use only.

FAQ

Sources