Passwd - Revision history

Jsummers at 14:00, 14 May 2017

2017-05-14T14:00:00Z

Jsummers: /* Links */

2017-05-10T13:41:34Z

‎Links

Jsummers: /* Password field */

2017-05-10T13:33:06Z

‎Password field

Jsummers: /* Software */

2017-05-06T19:35:21Z

‎Software

Jsummers at 12:55, 5 May 2017

2017-05-05T12:55:23Z

Jsummers at 16:58, 2 May 2017

2017-05-02T16:58:25Z

Jsummers at 16:01, 2 May 2017

2017-05-02T16:01:02Z

Jsummers: Created page with "{{FormatInfo |name=passwd |formattype=electronic |subcat=Security }} This article describes the format of the traditional Unix `/etc/passwd` file, and related files..."

2017-05-02T15:59:22Z

Created page with "{{FormatInfo |name=passwd |formattype=electronic |subcat=Security }} This article describes the format of the traditional Unix <code>/etc/passwd</code> file, and related files..."

New page

{{FormatInfo
|name=passwd
|formattype=electronic
|subcat=Security
}}
This article describes the format of the traditional Unix <code>/etc/passwd</code> file, and related files, including <code>/etc/shadow</code>, <code>/etc/group</code>, and <code>/etc/gshadow</code>. These files contain information about user accounts. They use text-based formats with colon-separated fields, with one line per user or group.

Note that on modern systems, this is not the only way to manage users. Other methods, such as [[LDAP]] or Winbind, may be used as well. The methods to use are usually configured in the <code>/etc/nsswitch.conf</code> file.

The name of the <code>passwd</code> file has become a misnomer, as (hashed) passwords are now rarely stored in it. If hashed passwords are stored locally, they will be in the <code>shadow</code> file instead.

== Password field ==
The password field in the <code>passwd</code> or <code>shadow</code> file originally consisted of a single-block [[DES]] hash of the user's password. As such, it was limited to 8 7-bit characters.

That turned out to be way too insecure. Modern systems use a different format, which begins with a dollar sign:
$<algorithm-id>$<salt>$<hashed password>

== GECOS ==
The so-called ''GECOS'' field in the <code>passwd</code> file contains several comma-separated subfields. The subfields include the user's full name, and other information such as phone numbers.

The name ''GECOS'' is a nonsensical accident of history. It originally stood for something like ''General Electric Comprehensive Operating Supervisor'' (there is conflicting information about whether the ''S'' stood for ''Supervisor'', or ''System'').

== Software ==
* Many standard utility programs are related to reading and writing these files, including <code>passwd</code>, <code>usermod</code>, <code>vipw</code>, and <code>getent</code>.
* Programmatically, to look up user information, the <code>getpwent</code> family of C library functions may be used. (But password-related functions should probably be done via PAM instead, i.e. with [https://linux.die.net/man/3/pam_authenticate pam_authenticate] and related functions.)

== Links ==
* [[Wikipedia: Passwd]]
** [[Wikipedia: Passwd#Password file]]
** [[Wikipedia: Passwd#Shadow file]]
* [[Wikipedia: Gecos field]]
* [https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.security/passwords_etc_passwd_file.htm IBM Knowledge Center: Using the /etc/passwd file]
* [http://www.linfo.org/etc_passwd.html LINFO: The /etc/passwd File]

[[Category:File formats with a distinctive filename]]

@@ Line 45: / Line 45: @@
 == Software ==
-* Many standard utility programs are related to reading and writing these files, including <code>[https://linux.die.net/man/1/passwd passwd]</code>, <code>[https://linux.die.net/man/8/usermod usermod]</code>, <code>[https://linux.die.net/man/8/vipw vipw]</code>, and <code>[https://linux.die.net/man/1/getent getent]</code>.
+* Many standard utility programs are related to reading and writing these files, including <code>{{Manpage|1|passwd|passwd}}</code>, <code>{{Manpage|8|usermod|usermod}}</code>, <code>{{Manpage|8|vipw|vipw}}</code>, and <code>{{Manpage|1|getent|getent}}</code>.
-* Programmatically, to look up user information, the <code>[https://linux.die.net/man/3/getpwent getpwent]</code> family of C library functions may be used. (But password-related functions should probably be done via [[PAM configuration file|PAM]] instead, i.e. with <code>[https://linux.die.net/man/3/pam_authenticate pam_authenticate]</code> and related functions.)
+* Programmatically, to look up user information, the <code>{{Manpage|3|getpwent|getpwent}}</code> family of C library functions may be used. (But password-related functions should probably be done via [[PAM configuration file|PAM]] instead, i.e. with <code>{{Manpage|3|pam_authenticate|pam_authenticate}}</code> and related functions.)
 == Links ==
@@ Line 56: / Line 56: @@
 * [https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.security/passwords_etc_passwd_file.htm IBM Knowledge Center: Using the /etc/passwd file]
 * [http://www.linfo.org/etc_passwd.html LINFO: The /etc/passwd File]
-* [https://linux.die.net/man/5/passwd passwd(5) - Linux man page]
+* {{Manpage|5|passwd}}
-* [https://linux.die.net/man/5/shadow shadow(5) - Linux man page]
+* {{Manpage|5|shadow}}
-* [https://linux.die.net/man/5/group group(5) - Linux man page]
+* {{Manpage|5|group}}
-* [https://linux.die.net/man/3/crypt crypt(3) - Linux man page]
+* {{Manpage|3|crypt}}
 [[Category:File formats with a distinctive filename]]
 {{DISPLAYTITLE:passwd}}

@@ Line 22: / Line 22: @@
 The original ''crypt'' format is not very secure. Modern systems often use a different format, which begins with a dollar sign:
   $&lt;algorithm-id>$&lt;salt>$&lt;hashed password>
 == GECOS ==

@@ Line 30: / Line 30: @@
 == Software ==
 * Many standard utility programs are related to reading and writing these files, including <code>[https://linux.die.net/man/1/passwd passwd]</code>, <code>[https://linux.die.net/man/8/usermod usermod]</code>, <code>[https://linux.die.net/man/8/vipw vipw]</code>, and <code>[https://linux.die.net/man/1/getent getent]</code>.
-* Programmatically, to look up user information, the <code>[https://linux.die.net/man/3/getpwent getpwent]</code> family of C library functions may be used. (But password-related functions should probably be done via PAM instead, i.e. with <code>[https://linux.die.net/man/3/pam_authenticate pam_authenticate]</code> and related functions.)
+* Programmatically, to look up user information, the <code>[https://linux.die.net/man/3/getpwent getpwent]</code> family of C library functions may be used. (But password-related functions should probably be done via [[PAM configuration file|PAM]] instead, i.e. with <code>[https://linux.die.net/man/3/pam_authenticate pam_authenticate]</code> and related functions.)
 == Links ==

@@ Line 11: / Line 11: @@
 == Password field ==
-The password field in the <code>passwd</code> or <code>shadow</code> file originally consisted of a single-block [[DES]] hash of the user's password. As such, it was limited to 8 7-bit characters.
+=== crypt ===
-That turned out to be way too insecure. Modern systems use a different format, which begins with a dollar sign:
+A crypted password is stored as 13 ASCII characters, encoded with a form of [[Base64]]. The first two characters encode a 12-bit salt, and the rest encode the hashed password.
   $&lt;algorithm-id>$&lt;salt>$&lt;hashed password>
@@ Line 35: / Line 42: @@
 * [https://linux.die.net/man/5/shadow shadow(5) - Linux man page]
 * [https://linux.die.net/man/5/group group(5) - Linux man page]
 [[Category:File formats with a distinctive filename]]
 {{DISPLAYTITLE:passwd}}

← Older revision		Revision as of 16:01, 2 May 2017
Line 34:		Line 34:

	[[Category:File formats with a distinctive filename]]		[[Category:File formats with a distinctive filename]]
		+	{{DISPLAYTITLE:passwd}}

@@ Line 52: / Line 52: @@
 ** [[Wikipedia: Passwd#Password file]]
 ** [[Wikipedia: Passwd#Shadow file]]
 * [[Wikipedia: Gecos field]]
 * [https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.security/passwords_etc_passwd_file.htm IBM Knowledge Center: Using the /etc/passwd file]