User & Group Database Files

The Linux user database (/etc/passwd)

Th Linux User account (except password related information) are stored in a configuration file, /etc/passwd.

A sample /etc/passwd configuration file is copied below.

[root@localhost ~]# cat /etc/passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
sabayon:x:86:86:Sabayon user:/home/sabayon:/sbin/nologin
tintin:x:500:500::/home/tintin:/bin/bash

Each column in /etc/passwd, delimited by a colon and it is explained in detail below.

Column	Field	Description
1	Username	User login id
2	Password	The password. You should see either an x, an asterisk (*), or an encrypted password. An x points to /etc/shadow for the actual password. An asterisk means the account is disabled.
3	User ID	The unique numeric user ID (UID) for that user. By default, Red Hat starts normal user IDs at 500.
4	Group ID	The numeric group ID (GID) associated with that user. By default, RHEL creates a new group for every new user, and the number matches the UID.
5	User info	You can enter any information of your choice in this field. Standard options include the user's full name, telephone number, e-mail address, or physical location. Also known as GECOS field.
6	Home Directory	Users home directory. RHEL places new home directories in /home/username.
7	Login Shell	Users login shell. Default Linux shell is bash shell.

The Linux password database (/etc/shadow)

Traditional Unix systems store user account information, including one-way encrypted passwords, in user database file "/etc/passwd". This file is world-readable and hence storing password in this file is not secure.

Another method of storing account information is the shadow password format. This method stores account information in the /etc/passwd file, but the password is stored as a single "x" character (ie. not actually stored in this file). A second file, called "/etc/shadow", contains encrypted password and other information related with password. The "/etc/shadow" file is readable only by the root account.

The following are the advantages shadow passwords over the traditional way of storing passwords on UNIX-based systems.

• Improves system security by moving encrypted password hashes from the world-readable /etc/passwd file to /etc/shadow, which is readable only by the root user.

• Stores information about password aging.

• Allows the use the /etc/login.defs file to enforce security policies.

A sample /etc/shadow configuration file is copied below.

[root@localhost ~]# cat /etc/shadow

root:$1$CQoPk7Zh$370xDLmeGD9m4aF/ciIlC.:14425:0:99999:7:::
bin:*:14425:0:99999:7:::
daemon:*:14425:0:99999:7:::
adm:*:14425:0:99999:7:::
lp:*:14425:0:99999:7:::
sync:*:14425:0:99999:7:::
shutdown:*:14425:0:99999:7:::
halt:*:14425:0:99999:7:::
mail:*:14425:0:99999:7:::
news:*:14425:0:99999:7:::
uucp:*:14425:0:99999:7:::
operator:*:14425:0:99999:7:::
games:*:14425:0:99999:7:::
gopher:*:14425:0:99999:7:::
ftp:*:14425:0:99999:7:::
nobody:*:14425:0:99999:7:::
rpm:!!:14425:0:99999:7:::
dbus:!!:14425:0:99999:7:::
avahi:!!:14425:0:99999:7:::
mailnull:!!:14425:0:99999:7:::
smmsp:!!:14425:0:99999:7:::
nscd:!!:14425:0:99999:7:::
vcsa:!!:14425:0:99999:7:::
haldaemon:!!:14425:0:99999:7:::
rpc:!!:14425:0:99999:7:::
rpcuser:!!:14425:0:99999:7:::
nfsnobody:!!:14425:0:99999:7:::
sshd:!!:14425:0:99999:7:::
pcap:!!:14425:0:99999:7:::
ntp:!!:14425:0:99999:7:::
gdm:!!:14425:0:99999:7:::
xfs:!!:14425:0:99999:7:::
sabayon:!!:14425:0:99999:7:::
tintin:$1$wKAP1RyH$JeCAcEGhSGVlD0J7.AMg.0:14396:2:5:7:30::

Column	Field	Description
1	Username	Username
2	Password	Encrypted password; requires an x in the second column of /etc/passwd
3	Password history	Date of the last password change, in number of days after January 1, 1970 (Unix epoch)
4	mindays	Minimum number of days that you must keep a password (-m)
5	maxdays	Maximum number of days after which a password must be changed (-M)
6	warndays	Number of days before password expiration when a warning is given (-W)
7	inactive	Number of days after password expiration when an account is made inactive (-I)
8	disabled	The number of days since January 1, 1970 (Unix epoch) that an account has been disabled (-E)
9	Reserved	Currently not in use

Linux Group Database (/etc/group) file

RedHat Enterprise Linux group database is /etc/group file. It stores group information or defines the user groups in the Linux machine. The Linux group configuration file /etc/group

defines the groups to which the Linux users belong. A sample /etc/group file is shown below.

[root@localhost ~]# cat /etc/group
root:x:0:root
bin:x:1:root,bin,daemon
daemon:x:2:root,bin,daemon
sys:x:3:root,bin,adm
adm:x:4:root,adm,daemon
tty:x:5:
disk:x:6:root
lp:x:7:daemon,lp
mem:x:8:
kmem:x:9:
wheel:x:10:root
mail:x:12:mail
news:x:13:news
uucp:x:14:uucp
man:x:15:
games:x:20:
gopher:x:30:
dip:x:40:
ftp:x:50:
lock:x:54:
nobody:x:99:
users:x:100:
rpm:x:37:
dbus:x:81:
utmp:x:22:
utempter:x:35:
avahi:x:70:
mailnull:x:47:
smmsp:x:51:
nscd:x:28:
floppy:x:19:
vcsa:x:69:
haldaemon:x:68:
rpc:x:32:
rpcuser:x:29:
nfsnobody:x:65534:
sshd:x:74:
pcap:x:77:
ntp:x:38:
slocate:x:21:
gdm:x:42:
xfs:x:43:
sabayon:x:86:
tintin:x:500:
engineering:x:501:tintin

The following table explains in detail, the different columns which are delimited by a ":" character in Linux group database file, /etc/group.

Column	Field	Description
1	Group name	It is the name of Linux group. If you run ls -l command, you will see this name printed in the group field.
2	Password	Generally password is not used; hence it is empty/blank. It can store encrypted password. An “x” in this field means the password is encrypted and kept in another file.
3	Group ID (GID)	The group id. By default, Red Hat Linux starts normal group IDs at 500.
4	Group List	Comma separated list of user names of users who are members of the Linux group.