Passwd
(Created page with "{{FormatInfo |name=passwd |formattype=electronic |subcat=Security }} This article describes the format of the traditional Unix <code>/etc/passwd</code> file, and related files...") |
|||
| Line 34: | Line 34: | ||
[[Category:File formats with a distinctive filename]] | [[Category:File formats with a distinctive filename]] | ||
| + | {{DISPLAYTITLE:passwd}} | ||
Revision as of 16:01, 2 May 2017
This article describes the format of the traditional Unix /etc/passwd file, and related files, including /etc/shadow, /etc/group, and /etc/gshadow. These files contain information about user accounts. They use text-based formats with colon-separated fields, with one line per user or group.
Note that on modern systems, this is not the only way to manage users. Other methods, such as LDAP or Winbind, may be used as well. The methods to use are usually configured in the /etc/nsswitch.conf file.
The name of the passwd file has become a misnomer, as (hashed) passwords are now rarely stored in it. If hashed passwords are stored locally, they will be in the shadow file instead.
Contents |
Password field
The password field in the passwd or shadow file originally consisted of a single-block DES hash of the user's password. As such, it was limited to 8 7-bit characters.
That turned out to be way too insecure. Modern systems use a different format, which begins with a dollar sign:
$<algorithm-id>$<salt>$<hashed password>
GECOS
The so-called GECOS field in the passwd file contains several comma-separated subfields. The subfields include the user's full name, and other information such as phone numbers.
The name GECOS is a nonsensical accident of history. It originally stood for something like General Electric Comprehensive Operating Supervisor (there is conflicting information about whether the S stood for Supervisor, or System).
Software
- Many standard utility programs are related to reading and writing these files, including
passwd,usermod,vipw, andgetent. - Programmatically, to look up user information, the
getpwentfamily of C library functions may be used. (But password-related functions should probably be done via PAM instead, i.e. with pam_authenticate and related functions.)
