Basic Linux Security: User Types, /etc/passwd and /etc/shadow

Managing user accounts in Linux is relatively easy. User accounts are stored in a special file called /etc/passwd. Passwords are stored in /etc/shadow and user groups in /etc/group.

Learn much more with our online course on Linux security

User Accounts File /etc/passwd

This file stores data such as user login, password, identifier, group they belong to, username, home directory and shell.

The passwd format is:

Login:senha:UID:GID:comentário:home:shell

Each element that makes up the content of the /etc/passwd file is separated by colons, in the following sequence:

Login: The login is the identification that the user will use in the system. This must be unique, without spaces and usually an abbreviation of the name. Some applications need to have their own user that will define security permissions;

Password: The x represents the user's password. In the early days of Linux, the encrypted password was stored in this field instead of the x. But since several applications and utilities need to access the contents of the passwd file, it needs to have read permissions for everyone. It was soon realized that this was not very secure, and the encrypted password was placed in another special file called shadow with read permissions only for root. If the password contains no characters (empty), the login may be allowed without asking for a password;

User ID (UID): This ID is a unique numeric identifier for each user account. By definition, ID zero (0) is designated for the root user, which enables their powers as system administrator. By convention, IDs from 1 to 99 are used for administrative purposes and user accounts used by system services;

Group ID (GID): This is the numeric ID of the group to which the user belongs. Users can belong to workgroups to facilitate information sharing and system security management. The Group ID - GID must be registered in the group control file /etc/group;

Username or comment: This alphanumeric field accepts spaces and is reserved for the user's name or any other relevant observation;

Home Directory: The home directory is the default directory for the user account. It is in this directory that the account owner has special privileges. In this field of the passwd file, the full path of the home directory should be placed;

Shell: This field designates the shell executable that each user uses. The default is the Bourne Again Shell /bin/bash. Other executables can be used, such as /bin/sh, /bin/tcsh or any other program that will be executed right after the user's logon process. There are special files like /bin/false. This program simply does nothing, preventing the account user from logging into the system interactively. Another possibility is the file /sbin/nologin. This program also does not allow the user to enter the system interactively, but displays a message that can be configured in the file /etc/nologin.txt

User accounts that contain a fake shell like /bin/false or /sbin/nologin are usually used as special accounts, used by programs, for example, to provide limited access to files. For example, the Apache Web server uses the "apache" user account to delimit which files the httpd program may be able to write to.

The root superuser account has special characteristics, such as UserID zero and group zero. This gives the superuser account superpowers and unlimited access to all system resources.

See an example of user accounts in /etc/passwd:

root:x:0:0:root:/root:/bin/bash apache:x:48:48:Apache:/var/www:/sbin/nologinopenvpn:x:219:497:OpenVPN:/etc/openvpn:/sbin/nologinzabbix:x:500:501::/home/zabbix:/bin/bash uira:x:501:501::/home/uira:/bin/bash

Password File /etc/shadow

In the past, Linux kept encrypted passwords in the second field of the /etc/passwd file. Since several programs need access to system accounts, passwords were moved to the /etc/shadow file, which has no read permission for anyone.

Furthermore, if everyone has access to the file with encrypted passwords, a brute force attack can be performed, generating combinations of words, numbers and symbols that are encrypted and compared with the encrypted passwords, until a match is found. That's why the fact that only root has access to /etc/shadow makes this attack more difficult.

$ ls -l passwd shadow-rw-r--r-- 1 root root 1573 out 15 02:12 passwd---------- 1 root root  760 out 15 02:12 shadow

Passwords in Linux are encrypted in a way that makes it impossible to recover them using reverse engineering.

Groups File /etc/group

To facilitate the administration of access permissions to system resources and files, Linux uses the concept of workgroups. Each user belongs to at least one workgroup, defined in /etc/passwd through the Group ID field.

Workgroups and their respective Group IDs are defined in the /etc/group file:

nomedogrupo:senha:GID:listademembros

Each column separated by colons in the file has the following meaning:

Group name: The group name must be unique in the system.

Group password: Like user accounts, groups can also use a password so that a user can join them. Group passwords were encrypted and moved to the /etc/gshadow file. This field currently contains an "x";

Group ID (GID): Each group needs a unique positive integer ID. This ID is referenced in the /etc/passwd file;

Member List: User groups can contain one or more members and a user can be a member of more than one group. This field contains a list of user logins that are part of a group.

Some distributions like Red Hat create a user group for each user created in the system. Other distributions like SUSE use the users group (GID 100) for all users.

See an example of /etc/group:

root:x:0:rootdaemon:x:10:wwwrun,sendmail,squidusers:x:500:uira,carla 

Are you an IT professional, support technician, or developer who has thought about learning Linux for real?

And on top of that, also get an LPI Linux Essentials certification as a bonus?

And even better, with the best Online course for Linux?

[RICH_REVIEWS_SHOW category="CURSO" num="all"]

Do like these people and create your account now.

Here you have everything you need to succeed in the LPI exams

• Practical Shell Lessons
• Flashcards for memorization
• Crossword Puzzles
• 06 virtual servers on Amazon just for you
• Mind Maps
• Video Glossary
• Practice tests for the exams
• Personalized class schedule
• Guided exercises – Real labs
• Class Resources (notes and more)

Want to know if a certification is worth it? Find out why the salaries are good, and why companies are looking for Linux professionals. 

You will understand that the benefits far outweigh the sacrifice.

And if you have already decided, check out our Certification Guide.

And if you want to know where to take the exams, check the city list.

If you want to know the language of the exams, see this post.

Learn much more about Linux in our online course. You can enroll here. If you already have an account, you can access it here.

Liked it? Share