/etc Files

/etc/passwd

The /etc/passwd/ file stores information about all users of the system. You can view the output of this file using the commands below:

cat /etc/passwd
johndoe:x:1000:1000:john,,,:/home/john:/bin/bash

The output above has been abbreviated to our specific user. But we will dive into what the output contains. Each item in the output is separated by a colon and has a specific definition.

• johndoe: Username

• x: Indicates that the encrypted password is stored in /etc/shadow

• 1000: Is the ID of the user

• 1000: Is the primary group ID. Stored in /etc/group

• john,,,: User ID Info, basically a comment field to add extra info to the user.

• /home/john: Home directory

• /bin/bash: The users command shell. In this cash we're using bash.

Quick Tip

You can quickly find a user in this file using the grep command:

grep 'johndoe' /etc/passwd
johndoe:x:1000:1000:john,,,:/home/john:/bin/bash

/etc/shadow

The /etc/shadow file contains the user encrypted password as displayed in /etc/passwd/. Only the super user has access to this file so we have to use the sudo command to view it.

sudo cat /etc/shadow
johndoe:$6$XrkwokawAokwFAWOKwrk4AWOKFwa9KLMXZVokwAS:18535:0:99999:7:::

The output above is described below:

• johndoe: The username

• $6$Xrkwok..: The encrypted password

• 18535: The date the user was created in epoch time

• 0: Ability to change password

• 99999: Maximum password age. Unlimited in this case.

• 7: Number of days before password expiration notification is sent