Which user can view etc shadow file?

Traditionally, the /etc/passwd file is used to keep track of every registered user that has access to a system.

The /etc/passwd file is a colon-separated file that contains the following information:

• User name
• Encrypted password
• User ID number (UID)
• User's group ID number (GID)
• Full name of the user (GECOS)
• User home directory
• Login shell

root:!:0:0::/:/usr/bin/ksh
daemon:!:1:1::/etc:
bin:!:2:2::/bin:
sys:!:3:3::/usr/sys: 
adm:!:4:4::/var/adm:
uucp:!:5:5::/usr/lib/uucp: 
guest:!:100:100::/home/guest:
nobody:!:4294967294:4294967294::/:
lpd:!:9:4294967294::/:
lp:*:11:11::/var/spool/lp:/bin/false 
invscout:*:200:1::/var/adm/invscout:/usr/bin/ksh
nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico
paul:!:201:1::/home/paul:/usr/bin/ksh
jdoe:*:202:1:John Doe:/home/jdoe:/usr/bin/ksh 

AIX® does not store encrypted passwords in the /etc/passwd file in the way that UNIX systems do, but in the /etc/security/passwd file by default, which is only readable by the root user. The password field in the /etc/passwd file is used by AIX to signify whether a password exists or whether the account is blocked.

Note: When the login shell is null, login is successful and the resulting login shell is Bourne shell for ssh. When accessed via su the login shell is sh, which is a hard link to ksh.

The /etc/passwd file is owned by the root user and must be readable by all the users, but only the root user has writable permissions, which are shown as -rw-r--r--. If a user ID has a password, then the password field will have an ! (exclamation point). If the user ID does not have a password, then the password field will have an * (asterisk). The encrypted passwords are stored in the /etc/security/passwd file. The following example contains the last four entries in the /etc/security/passwd file based on the entries from the /etc/passwd file shown previously.

guest:
        password = *
                                         
nobody: 
        password = * 
                                         
lpd: 
        password = * 

paul: 
        password = eacVScDKri4s6 
        lastupdate = 1026394230 
        flags = ADMCHG                   

The user ID jdoe does not have an entry in the /etc/security/passwd file because it does not have a password set in the /etc/passwd file.

The consistency of the /etc/passwd file can be checked using the pwdck command. The pwdck command verifies the correctness of the password information in the user database files by checking the definitions for all of the users or for specified users.

The /etc/passwd file stores vital information (described below) about users such as username, home directory, etc.

Since this file contains vital information for all users, it has reading permissions and it is not necessary to have privileges to see it.

You can read the /etc/passwd file by using the less command followed by the path as shown below.

less /etc/passwd

Let’s take the first two lines to explain the structure of the /etc/passwd file in the following table:

The first two rows contain the same data shown in the first two lines of the /etc/passwd in the image above. It is important to note that each item is separated by two dots; you can consider the two dots as columns.

The meaning of each column is:

• USER: The first field shows the username.
• AUTHENTICATION: The second field shows the password status, if an x, the password is stored in the /etc/shadow file, if an
• UID: The third field shows the user ID.
• GID: The fourth field shows the group ID.
• GECOS: This field stores user information such as full name, phone number, and email.
• HOME: This field contains the path to the home directory.
• SHELL: Finally, the last field shows the shell for the user.

The x in the second field indicates the password is encrypted and stored in the /etc/shadow file. This file is protected by permissions and can only be read by privileged users. If instead of an X you see an asterix (*) or exclamation mark (!), it means that the password is blank and the user does not need a password to login.

The user ID 0 is reserved for the root user. IDs bigger than 500 can be assigned to users. Below 500 IDs are reserved for the system.

In the following figure you can see the linuxhintuser line including some GECOS information such as full name (Linux Hint) and phone numbers:

Years ago, passwords were stored in the /etc/passwd file. this was changed. Passwords are now stored in the /etc/shadow file which needs privileges.

The /etc/passwd file is accessible to every user because it holds information users need to interact with the system, for example, to login.

How to edit the /etc/passwd file

The /etc/passwd can be edited using the vipw command. This command is also useful to edit /etc/shadow (When used with the -s flag) and /etc/group files.

To edit the /etc/passwd file, run the vipw command and when asked, select the text editor of your preference. In my case I’m selecting nano as shown below.

sudo vipw

As you can see in the following figure, after running the vipw command, the /etc/passwd file will be opened with a text editor. You can then edit all fields.

In the example below I will edit the linuxhintuser information (Last line). As you can see, the full name is Linux Hint, phone numbers are 342342 and 234234.

As shown in the example below, I edited the full name, replacing the full name (linuxhintuser) with “New Full Name” and editing phone numbers.

Once you are done editing the file, close and save changes.

After closing and saving the file, you will be warned about possible changes you may need to reproduce in the /etc/shadow file. This is not necessary if you don’t edit the password.

You can check the /etc/passwd file using the less or cat commands and you will see changes were properly applied.

Additional functions for the vipw command can be implemented using flags:

• -g: The -g flag is used to edit the /etc/group file containing information about user groups.
• -s: This flag is used to edit both the /etc/shadow and /etc/gshadow files.
• -p: The -p flag is used to edit the passwd database.
• -h: This flag is used to display the help menu.

As you can see in the content above, the /etc/passwd is linked to other files like /etc/shadow and /etc/group, both of which are described below.

The /etc/shadow file

As said previously, formerly Linux/Unix passwords were stored in the /etc/passwd file, which was dangerous since every user has access to it. A user with access to the encrypted password can easily break it by using one of the online databases or through brute force.

To solve this exposure, the /etc/shadow file was implemented to store user encrypted passwords without reading permissions or without super user privileges.

You can see the /etc/shadow file by using cat or less commands as root or with sudo as shown previously.

less /etc/shadow

As you can see in the screenshot below, there are 9 columns (Defined by two dots each). Each field contains the first information:

• 1: Username.
• 2: Encrypted password.
• 3: Last password change in days, counting from Jan, 1970.
• 4: Minimum days a user can keep a password before changing it.
• 5: Maximum days a user can keep a password before changing it (If 99999, then no limit)
• 6: In this field the root can define when a user will be requested to change the password.
• 7: This field shows when an account will be inactive after password expiration.
• 8: Password expiration date (Counting from 1 Jan, 1970).
• 9: The last field is reserved without containing useful information.

As you can see, the /etc/shadow file only contains password related information.

To change a password within this file, you need to execute the passwd command followed by the username whose password you want to replace, as shown in the figure below where the linuxhintuser password is updated.

sudo passwd linuxhintuser

As you can see above, the password was successfully changed.

The /etc/group file

The /etc/group file stores information on groups. This file, like both /etc/passwd and /etc/shadow, also can be edited with the vipw command.

You can read the /etc/group file using the less command as done before.

less /etc/group

The file looks like the following screenshot, containing 4 columns with group related information, where the first field is group name, the second field is password related, the third is the GID (Group ID) and the fourth shows the group users.

I also would recommend studying the usermode command, some examples are available at https://linuxhint.com/sudo_linux/, also related to user administration. This command is also recommended by the passwd command man page.

Conclusion

As you can see, any user can view the passwd file easily. The /etc/passwd file is the first defense against unauthorized accesses. All files are imperative to get information on users and administer them properly. The way to edit those files vipw is explained in this document. All steps are valid for all Linux distributions, since these files are universal for Linux systems, and even for some Unix. Always remember you can read the main page for additional information.

Thank you for reading this tutorial explaining how to view and how to understand the /etc/passwd file. Keep following us for additional Linux tutorials.

Who can access etc passwd?

Why does etc shadow have permissions?