Change:
} ]; <ins> warnings = builtins.filter (x: x != null) ( flip mapAttrsToList cfg.users (name: user: # This regex matches a subset of the Modular Crypto Format (MCF)[1] # informal standard. Since this depends largely on the OS or the # specific implementation of crypt(3) we only support the (sane) # schemes implemented by glibc and BSDs. In particular the original # DES hash is excluded since, having no structure, it would validate # common mistakes like typing the plaintext password. # # [1]: https://en.wikipedia.org/wiki/Crypt_(C) let sep = "$"; base64 = "[a-zA-Z0-9./]+"; id = "[a-z0-9-]+"; value = "[a-zA-Z0-9/+.-]+"; options = "${id}(=${value})?(,${id}=${value})*"; scheme  = "${id}(${sep}${options})?"; content = "${base64}${sep}${base64}"; mcf = "^${sep}${scheme}${sep}${content}$"; in if (user.hashedPassword != null && builtins.match mcf user.hashedPassword == null) then '' The password hash of user "${name}" may be invalid. You must set a valid hash or the user will be locked out of his account. Please check the value of option `users.users."${name}".hashedPassword`. '' else null )); </ins> }; }

Discussion:
NixOS: 16.03pre73316. (Emu) Nix: 1.10 If you put a colon (:) in your hashedPassword entry, such as "Still not giving it away :P" (to show your config to your friend), forget about it, rebuild, you end up corrupting the /etc/shadow file, as apparently NixOS just sets the password field (second field, with field separator ":"), so you end up accumulating ":P"s in /etc/shadow. Now that is just your mistake having a laugh at you.... True story, took me some time to figure it out
It should rather check that the value is a valid hash. But this is documented in the description of the user module, I don't really see the need for a check here.
the more the computer knows and can check, the less humans have to read (unless the computer tells them to). I for one would love the computer to catch my dumb mistakes :smile:
Hehe ok, this would result in the user being unable to login so a check is actually a good idea. But there are a million other options that also break stuff if you pass garbage. ;)
To be honest, my problem is not that I was unable to log in, but that I was unable to revert by switching back to an earlier configuration, which the checking for ":" would prevent.
Can we label this as good first bug? cc
This command should validate hashes: . I'm not sure how to implement it though.
"works" in the sense the build fails when an hash is invalid but produce no meaningful error. Also it scatters the hashes in the nix store so it should be changed shomehow but I don't know any other way.
Thank you for your contributions. This has been automatically marked as stale because it has had no activity for 180 days. If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity. Here are suggestions that might help resolve this more quickly: for maintainers and people that previously touched the related code and @ mention them in a comment. on the .

on the on .
Yes, still an issue. I have an oper PR at if anyone wants to give it a try.