Is it possible to change passwords temporarily?

Question

I have a Linux system with several users. I don't know their passwords, nor do I want to know them.

I have to do a batch copy of some of their directories over SSH, with their account and password.

My idea was to make a backup of /etc/shadow, then alter it with new passwords for each user (one that I know, like "tmppass"), do my backups, then replace the /etc/shadow file with the old one.

Will that work? If so, how do I generate the password/s? (The passwords are like $1$xxxxxx/xxxxx).

if you are root (you likely would need to be to modify `/etc/shadow`), you can just change the passwords with the `passwd` command (no need to modify the file). Backing up the shadow file, changing the passwords, doing the copying, and restoring the shadow file *might* work. — Wilf, Jul 31 '14 at 09:59
I'm root, but I want to revert to old passwords, so if I use `passwd`, there's no way to put their old password back without asking them to change it. — user79264, Jul 31 '14 at 10:22
Do you have to change the password? If you first become root, you can then use `su - username` and "become" any other user - without being asked for password. I myself used that trick; and wrote a script that went through a list of the user on my system, "became" them, and then ran a little script as each of them. — Baard Kopperud, Jul 31 '14 at 11:07

score 4 · Answer 1 · answered Jul 31 '14 at 10:36

4

Just backup the /etc/shadow file, and change the users passwords with passwd:

Backup the shadow file:
```
sudo cp /etc/shadow /etc/shadow.bak
```
Change the password of the user you want to access (e.g. testuser):
```
sudo passwd testuser
```
When done, restore the /etc/shadow file from the backup:
```
sudo mv /etc/shadow.bak /etc/shadow
```
Note that all passwords should be reset to the passwords they were when they were backed up.

Works on Fedora 19

N.B. Not what you asked, but it would be much easier to access those users with:

sudo -u testuser bash

This only require authentication with sudo, not as that user.

answered Jul 31 '14 at 10:36

Wilf

2,337
2
22
39

But I guess `passwd` will ask for the current password. – Thushi Jul 31 '14 at 10:51
With `sudo`, it will ask for `sudo` password, not the user's password. `passwd testuser` won't work, and `passwd` will change the password for the current user. – Wilf Jul 31 '14 at 11:00
2

+1 for the NB. Changing the users' password is not needed for root as it can directly log in as the users without their password. – lgeorget Jul 31 '14 at 11:07
This trick works if you only have to temporarily authenticate as a specific user. Useful in some situations where you want to "peek" on something for security reasons :) – Eduardo B. Feb 26 '18 at 06:58

score 1 · Answer 2 · answered Jul 31 '14 at 23:42

While this is possible, it is very rarely the right way to do something. I strongly suspect that you are at best making your life overly complicated and at worst doing something unsafe when you could do the safe thing at no extra cost.

SSH lets clients authenticate with a key instead of a password. This is especially useful for automated use: create a key pair, store the private key in a file with no passphrase, and use it to connect to the remote host (where you have added the public key to the authorization list beforehand). Be careful with a passwordless private key file since its possession allows logging into the account; you can put restrictions on the commands that can be executed with a key and on the IP address that it's accepted from to reduce the impact of a leaked key file.

I can't think of a good reason not to use keys in the scenario you describe.

Is it possible to change passwords temporarily?

2 Answers2