/etc/passwd, /etc/shadow, /etc/group · Linux

Linux identity is stored in three text files: /etc/passwd, /etc/shadow, and /etc/group. Editing them directly is fragile and almost always wrong — but reading them, auditing them, and understanding them is mandatory for a sysadmin.

/etc/passwd

The classic password database. One line per user, seven colon- separated fields:

root:x:0:0:root:/root:/bin/bash
alice:x:1000:1000:Alice Smith,,,:/home/alice:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

Field	Meaning
1	Login name
2	Password placeholder (`x` — actual hash in /etc/shadow)
3	UID (user ID number)
4	Primary GID
5	GECOS field (real name, office, phone — comma-separated)
6	Home directory
7	Login shell (or `/usr/sbin/nologin` / `/bin/false` for non-login accounts)

Read-only / Safegetent passwd— getent reads the Name Service Switch configuration — /etc/passwd on most hosts, but LDAP, SSSD, or another nsswitch source on centrally-managed hosts. Always use getent instead of reading /etc/passwd directly, because centrally-managed hosts do not have local entries.

$ getent passwd root alice www-data nobody

root:x:0:0:root:/root:/bin/bash
alice:x:1000:1000:Alice Smith:/home/alice:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

Illustrative output

/etc/shadow

The hardened counterpart to /etc/passwd. One line per user, nine colon-separated fields:

root:$y$j9T$...$...:19550:0:99999:7:::
alice:$y$j9T$...$...:19550:0:99999:7:::

Field	Meaning
1	Login name (mirrors /etc/passwd)
2	Hashed password, or `*` / `!` / `!!` to disable login
3	Date of last password change (days since 1970-01-01)
4	Minimum days between changes (0 = no minimum)
5	Maximum days between changes (99999 = effectively never)
6	Warning days before expiry
7	Account-inactive days after expiry
8	Account expiration date (days since epoch)
9	Reserved (currently unused)

Read-only / Safepermissions— /etc/passwd is world-readable because many tools need to map UIDs. /etc/shadow is root:shadow mode 0640 — readable only by root or the shadow group. /etc/group is world-readable too (0644 root:root), and must be: every process resolves group names and supplementary group memberships through NSS, so restricting it breaks group resolution for every unprivileged user on the host — ls prints numeric GIDs, id is incomplete, and permission checks that depend on a named group start failing. Only /etc/gshadow, which holds group password hashes and the group administrator list, gets the restricted root:shadow 0640 treatment.

$ ls -l /etc/passwd /etc/shadow /etc/group /etc/gshadow

-rw-r--r-- 1 root root    3010 Aug  9 11:11 /etc/passwd
-rw-r----- 1 root shadow  1840 Aug  9 11:11 /etc/shadow
-rw-r--r-- 1 root root    1024 Aug  9 11:11 /etc/group
-rw-r----- 1 root shadow   850 Aug  9 11:11 /etc/gshadow

Illustrative output

/etc/group and /etc/gshadow

/etc/group lists every group and its members. Same one-line-per- group format as /etc/passwd:

root:x:0:
sudo:x:27:alice
adm:x:4:syslog,alice

Fields: group name, password placeholder, GID, comma-separated member list. The members list includes only users whose primary GID is NOT this group; users with this as their primary GID are listed by the lookup automatically.

/etc/gshadow (mode 0640, root:shadow) holds the group password hash and the list of group administrators. It is rarely used in modern systems — group membership is managed directly.

What the fields mean in production

UID ranges:

Range	Convention	Use
0	root	The single root account
1-999	System accounts	Daemons, services. Should have `/usr/sbin/nologin` or `/bin/false` as shell.
1000-60000	User accounts	Interactive humans, depending on `UID_MIN`/`UID_MAX` in /etc/login.defs
65534	nobody	Default for unbound UIDs (NFS, container UID mapping)

Audit commands

Read-only / Safeaudit UID 0— List every account with UID 0. Should be exactly 'root'.

$ awk -F: '$3 == 0 { print $1 }' /etc/passwd

root

Illustrative output

Read-only / Safeaudit system accounts— List system accounts with their UID and login shell. Every system account should have a non-interactive shell (nologin / false / sync only).

$ awk -F: '$3 &lt; 1000 &amp;&amp; $3 &gt; 0 { print $1, $3, $7 }' /etc/passwd | sort -k2 -n

daemon 1 /usr/sbin/nologin
adm 3 /usr/sbin/nologin
sys 2 /usr/sbin/nologin
...

Illustrative output

Read-only / Safeaudit login shells— List accounts with an interactive shell. Only humans should appear here. Anything else is a misconfiguration or a backdoor.

$ awk -F: '$7 !~ /(nologin|false|sync|halt|shutdown)/ { print $1, $7 }' /etc/passwd | head

root /bin/bash
alice /bin/bash

Illustrative output

/etc/passwd

/etc/shadow

/etc/group and /etc/gshadow

What the fields mean in production

Audit commands

Knowledge check