Passwd and Shadow Files

A user account consists of a valid username and password, a home

directory, and a default shell. When the user attempts to log in, Linux

examines the passwd file to ensure that these requirements are met. The

passwd file, located in the /etc directory, contains user account

records each consisting of 7 fields separated by colons. Here's an

example of a passwd file:

root:x:0:0:root:/root:/bin/bash

bin:x:1:1:bin:/bin:

james:x:600:600:201-234-5678:/home/james:/bin/bash

Let's parse the last entry and learn what each field means.

* The user's username.

* The second field traditionally stores the user's password in an

encrypted form. However, newer Linux distributions use a

shadowing system (I will discuss shadowing shortly). Such systems

merely store a placeholder in this field and keep the passwords

in a different file.

* UID. This number is attached to the user's processes and thus

enables the sysadmin to associate the currently active processes

to their users. Although you can assign arbitrary UIDs to users,

restricting these numbers to a range (e.g., 600-699) is

advisable. Remember that UID 0 is reserved for root.

* GUID. A user may belong to several groups but has only one native

group. This field stores the native group value.

* The fifth field is called the General Electric Comprehensive

Operating System field (GECOS). Traditionally, it stores the

user's real name. However, you can store any other value in this

field such as the user's telephone number. This field is mostly

used for reporting purposes such as Finger queries. In this

example, the field contains the user's telephone number.

* User's home directory. In this example, the users home directory

is /home/james.

* User's default shell. The default shell is the one that Linux

invokes when the user has logged into the system. Although bash

is the most common shell, other options are available -- namely

ash, csh, ksh, tcsh, and zsh.

Shadowing

Shadowing systems store users' password and associated rules in a

special file called /etc/shadow. When a shadowing system is in use, the

passwd file remains readable but it doesn't contain passwords anymore.

Instead, the password field is filled with a placeholder. A shadow file

looks like this:

root:HDJIKW1.PA:11015:0::7:7::

james:7aNicVa5rg9B:11015:0:-1:7:-1:-1:

A shadow file contains 9 fields separated by colons (the values in

parentheses are taken from the last entry of the above shadow file):

* Username (james)

* Password in an encrypted form (7aNicVa5rg9B)

* Number of days since 1/1/1970 that the password was last modified

(11015)

* Number of days left before the user is allowed to change his

password (0)

* Number of days left before the user is forced to change his

password (-1)

* Number of days in advance that the user is prompted to change his

password (7)

* Number of days left before disabling the account unless the user

changes his password (-1)

* Number of days since 1/1/1970 that the account has been disabled

(-1)

* Reserved

What’s wrong? The new clean desk test
Join the discussion
Be the first to comment on this article. Our Commenting Policies