/etc/passwd, /etc/group and /etc/shadow

A database made of text

Unix keeps its user database in plain text files, one record per line, fields separated by colons. There is no daemon to query and no binary format: cat is enough to read them and any editor can change them. Three files matter: /etc/passwd for users, /etc/group for groups and /etc/shadow for the password hashes. Everything id, ls -l and su know about names comes from here.

/etc/passwd: seven fields

~% cat /etc/passwd
root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:65534:65534:nobody:/home:/bin/false

Most of these lines are system accounts: daemon, bin, www-data exist so that services can own files and run without root privileges. Their shell is /bin/false, a program that exits immediately, so nobody can log in as them. nobody, UID 65534, is the deliberately powerless account. Real people usually start at UID 1000.

/etc/group: four fields

Each line is name:password:GID:members. The members field is a comma-separated list of users who have this group as a *supplementary* group; users whose primary GID points here are not repeated. In the VM, wheel:x:10:root says root is a member of wheel, the traditional group allowed to become root. Group passwords are an obsolete feature, hence the x nobody uses.

/etc/shadow: the hashes

/etc/passwd must be world-readable, because ls -l needs to turn UIDs into names for everyone. Password hashes used to sit in field 2, where anybody could copy them and crack them offline. The fix was to move them to /etc/shadow, readable only by root, and leave an x behind. A shadow line has nine fields: name, hash, date of last change (days since 1970), minimum and maximum age, warning period, inactivity, expiry and a spare. The hash field tells you the state of the account at a glance: a string starting with $1$, $5$ or $6$ is a real hash (MD5, SHA-256, SHA-512); ! or * means locked, no password will ever match; an empty field means no password is required at all. Look at root in this VM: root::10933:0:99999:7::: — no password, which is why the console drops you straight into a shell.

Reading them with the usual tools

~% grep '^root:' /etc/passwd
root:x:0:0:root:/root:/bin/sh
~% cut -d: -f1 /etc/passwd | head -3
root
daemon
bin
~% awk -F: '$3 >= 1000 {print $1, $6}' /etc/passwd
nobody /home
~% awk -F: '$7 == "/bin/sh"' /etc/passwd
root:x:0:0:root:/root:/bin/sh