Understanding /etc/passwd File Format

Understanding /etc/passwd file fields

The /etc/passwd contains one entry per line for each user (user account) of the system. All fields are separated by a colon (:) symbol. Total of seven fields as follows. Generally, /etc/passwd file entry looks as follows:

(Fig.01: /etc/passwd file format – click to enlarge)

/etc/passwd file format

From the above image:

1. Username: It is used when user logs in. It should be between 1 and 32 characters in length.
2. Password: An x character indicates that encrypted password is stored in /etc/shadow file. Please note that you need to use the passwd command to computes the hash of a password typed at the CLI or to store/update the hash of the password in /etc/shadow file.
3. User ID (UID): Each user must be assigned a user ID (UID). UID 0 (zero) is reserved for root and UIDs 1-99 are reserved for other predefined accounts. Further UID 100-999 are reserved by system for administrative and system accounts/groups.
4. Group ID (GID): The primary group ID (stored in /etc/group file)
5. User ID Info (GECOS): The comment field. It allow you to add extra information about the users such as user’s full name, phone number etc. This field use by finger command.
6. Home directory: The absolute path to the directory the user will be in when they log in. If this directory does not exists then users directory becomes /
7. Command/shell: The absolute path of a command or shell (/bin/bash). Typically, this is a shell. Please note that it does not have to be a shell. For example, sysadmin can use the nologin shell, which acts as a replacement shell for the user accounts. If shell set to /sbin/nologin and the user tries to log in to the Linux system directly, the /sbin/nologin shell closes the connection.

I hope you understood /etc/passwd file format to keep track of every registered user that has access to a system. Therefore, knowing the structure is essential for security reasons. Now, let us see some common examples of commands.

Task: See Linux User List

/etc/passwd is only used for local users. To see list of all users, simply use the cat command or more/less command:
$ cat /etc/passwd
The following is an example of an /etc/passwd file from Linux system powered by Alpine Linux:

root:x:0:0:root:/root:/bin/ash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/mail:/sbin/nologin
news:x:9:13:news:/usr/lib/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
man:x:13:15:man:/usr/man:/sbin/nologin
postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
games:x:35:35:games:/usr/games:/sbin/nologin
cyrus:x:85:12::/usr/cyrus:/sbin/nologin
vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
guest:x:405:100:guest:/dev/null:/sbin/nologin
nobody:x:65534:65534:nobody:/:/sbin/nologin
nginx:x:100:101:nginx:/var/lib/nginx:/sbin/nologin
vnstat:x:101:102:vnstat:/var/lib/vnstat:/bin/false
redis:x:102:103:redis:/var/lib/redis:/bin/false

To search for a username called tom, use the grep command:
$ grep tom /etc/passwd
OR
$ grep -w '^tom' /etc/passwd
Sample outputs:

tom:x:1000:1000:Vivek Gite:/home/vivek:/bin/bash

Using the /etc/passwd file

Want to find out multiple users? Try the egrep command as follows:
$ egrep -w '^(tom|jerry|fox)' /etc/passwd
## OR pass the '-E' ##
$ grep -E -w '^(root|vivek|www-data)' /etc/passwd
Of course, one can get entries from /etc/passwd using the getent command too. For example:
$ getent passwd
$ getent passwd {user1} {user2}
$ getent passwd vivek
$ getent passwd vivek root

The /etc/passwd file keeps track of every user that has access to a system, and we can query it using the getent or grep command.

How to see /etc/passwd file permission

The permission on the /etc/passwd file should be read only to users (-rw-r--r-- OR 0644) and the owner must be root:
$ ls -l /etc/passwd
Sample outputs:

-rw-r--r-- 1 root root 2659 Sep 17 01:46 /etc/passwd

Use the stat command to see details about the file:
$ stat /etc/passwd
Outputs:

  File: /etc/passwd
  Size: 3445      	Blocks: 8          IO Block: 4096   regular file
Device: fd02h/64770d	Inode: 25954390    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2021-05-24 01:34:01.794296901 +0530
Modify: 2021-05-08 00:33:40.430038177 +0530
Change: 2021-05-08 00:33:40.434038185 +0530
 Birth: -

Reading /etc/passwd file

You can read /etc/passwd file using the while loop and IFS separator as follows:

#!/bin/bash
# seven fields from /etc/passwd stored in $f1,f2...,$f7
# 
while IFS=: read -r f1 f2 f3 f4 f5 f6 f7
do 
 echo "User $f1 use $f7 shell and stores files in $f6 directory."
done < /etc/passwd

Your password hashes is in the /etc/shadow file

So far, so good, right? But, where are my encrypted hashed passwords? Good question. Your encrypted password hashes are in the /etc/shadow file. There was no significant problem with this general read permission in the good old days. Everybody could read the encrypted passwords, but the hardware was too slow to crack a well-chosen password, and the basic assumption used to be that of a friendly user community. Therefore, we use /etc/shadow files on Linux and other Unix-like operating systems for security reasons.

How do I know am I using shadow files for passwords on my machine?

Almost all modern Linux and UNIX-like operating systems use shadow password suites. If your /etc/passwd files has asterisks (*) instead of encrypted (more like hash) passwords, then it is safe to assume that the encrypted passwords hashes are in /etc/shadow file. Please note that this file is only readable by the superuser only. Verify file permissions using the ls command or stat command:
$ ls -l /etc/shadow
$ stat /etc/shadow

Common commands that uses /etc/passwd files

Here is a list of commands that manipulate /etc/passwd file. Hence read the man pages using the man command or help command:

• passwd command
• su command
• sulogin command
• getent command
• login command
• pwck command
• pwunconv command
• chpasswd command
• chsh command
• chfn command
• useradd command
• userdel command
• id command

Conclusion

Please note that there are three main types of user account: the superuser, system users, and regular users. For example:

• root – The superuser (admin user).
• nginx – The system user used by Nginx web server.
• vivek – Regular user account.

A Linux user must have a primary group and may be a member of one or more supplementary groups as defined in the /etc/group.
The /etc/passwd file stores all user names and accounts on the Linux or Unix-like system. In other words, user account information is in the /etc/passwd file. Hence, you can confirm and read the documentation by reading the following man pages with the help of the man command:
$ man 5 passwd