8.4. User and Group Databases
The list of users is usually stored in the /etc/passwd
file, while the /etc/shadow
file stores hashed passwords. Both are text files, in a relatively simple format, which can be read and modified with a text editor. Each user is listed there on a line with several fields separated with a colon (“:
”).
8.4.1. User List: /etc/passwd
Here is the list of fields in the /etc/passwd
file:
login, for example rhertzog
;
password
: this is a password encrypted by a one-way function (crypt
), relying on DES
, MD5
, SHA-256
or SHA-512
. The special value “x
” indicates that the encrypted password is stored in /etc/shadow
;
uid
: unique number identifying each user;
gid
: unique number for the user's main group (Debian creates a specific group for each user by default);
GECOS
: data field usually containing the user's full name;
login directory, assigned to the user for storage of their personal files (the environment variable $HOME
generally points here);
program to execute upon login. This is usually a command interpreter (shell), giving the user free rein. If you specify /bin/false
(which does nothing and returns control immediately), the user cannot login.
8.4.2. The Hidden and Encrypted Password File: /etc/shadow
The /etc/shadow
file contains the following fields:
One can expire passwords using this file or set the time until the account is disabled after the password has expired.
8.4.3. Modifying an Existing Account or Password
The following commands allow modification of the information stored in specific fields of the user databases: passwd
permits a regular user to change their password, which in turn, updates the /etc/shadow
file (chpasswd
allows administrators to update passwords for a list of users in batch mode); chfn
(CHange Full Name), reserved for the super-user (root), modifies the GECOS
field. chsh
(CHange SHell) allows the user to change their login shell; however, available choices will be limited to those listed in /etc/shells
; the administrator, on the other hand, is not bound by this restriction and can set the shell to any program of their choosing.
Finally, the chage
(CHange AGE) command allows the administrator to change the password expiration settings (the -l user
option will list the current settings). You can also force the expiration of a password using the passwd -e user
command, which will require the user to change their password the next time they log in.
Besides these tools the usermod
command allows to modify all the details mentioned above.
8.4.4. Disabling an Account
You may find yourself needing to “disable an account” (lock out a user), as a disciplinary measure, for the purposes of an investigation, or simply in the event of a prolonged or definitive absence of a user. A disabled account means the user cannot login or gain access to the machine. The account remains intact on the machine and no files or data are deleted; it is simply inaccessible. This is accomplished by using the command passwd -l user
(lock). Re-enabling the account is done in similar fashion, with the -u
option (unlock). This, however, only prevents password-based logins by the user. The user might still be able to access the system using an SSH key (if configured). To prevent even this possibility you have to expire the account as well using either chage -E 1user
or usermod -e 1 user
(giving a value of -1
in either of these commands will reset the expiration date to never
). To (temporarily) disable all user accounts just create the file /etc/nologin
.
You can disable a user account not only by locking it as described above, but also by changing its default login shell (chsh -s shell user
). With the latter changed to /usr/sbin/nologin
, a user gets a polite message informing that a login is not possible, while /bin/false
just exits while returning false
. There is no switch to restore the previous shell. You have to get and keep that information before you change the setting. These shells are often used for system users which do not require any login availability.
8.4.5. Group List: /etc/group
Groups are listed in the /etc/group
file, a simple textual database in a format similar to that of the /etc/passwd
file, with the following fields:
group name;
gid
: unique group identification number;
list of members: list of names of users who are members of the group, separated by commas.
The addgroup
and delgroup
commands add or delete a group, respectively. The groupmod
command modifies a group's information (its gid
or identifier). The command gpasswd group
changes the password for the group, while the gpasswd -r group
command deletes it.