/etc/passwd

/etc/passwd stores local account records in a colon-separated text format. It maps login names to numeric UIDs and records a primary GID, descriptive field, home path, and login program.

Local Records versus Resolved Accounts

Display the local file with a read-only command:

$ cat /etc/passwd

This is not necessarily every account known to the system. The Name Service Switch (NSS) can resolve accounts from files, directory services, system databases, or other configured sources. Use getent to query the resolved passwd database:

$ getent passwd
$ getent passwd root

The first command can disclose account names and metadata, so review output before sharing it publicly.

Reading the Seven Fields

A local record commonly looks like this:

root:x:0:0:root:/root:/bin/bash

The seven colon-separated fields are:

1. Login name: The human-readable account name, such as root.
2. Password field: Usually x on a shadow-password system, indicating protected password data is stored separately.
3. UID: The numeric user identity. UID 0 has traditional superuser treatment.
4. Primary GID: The numeric ID of the account's primary group.
5. GECOS/comment: Descriptive account information, often internally comma-separated.
6. Home directory: The path used as the account's home setting; it may be absent on disk.
7. Login shell/program: The program requested for applicable login sessions, such as /bin/bash or a non-login program.

The kernel does not require UID values to be unique across malformed or deliberately duplicated records, but accounts that share a UID are indistinguishable for many ownership and permission decisions. Administrators should normally keep account UIDs unique.

Interpreting the Password Placeholder

On typical shadow-password systems, x in field 2 directs password-aware tools to protected data in /etc/shadow. Values such as * or ! are not valid password hashes and generally prevent authentication with a Unix password through that entry.

That does not prove the account cannot authenticate by every method. SSH keys, certificates, tokens, or service-specific mechanisms may be independent. Likewise, an empty password field has security-sensitive behavior that depends on the authentication stack; do not create or “fix” it manually.

Recognizing Service Accounts

Many records represent services rather than people. Separate service identities help confine files and processes to the authority required by one daemon. Their home paths can be nonstandard or nonexistent, and their login program may be /usr/sbin/nologin, /bin/false, or another restricted program.

Do not infer account purpose from UID range alone without checking the distribution's policy. Allocation ranges vary, and centrally managed accounts may follow different conventions.

Modifying Account Records Safely

Prefer account-management tools such as useradd, usermod, and userdel because they coordinate related records and apply system defaults. Their exact behavior is distribution-configurable, so review options before changing an account.

If a local passwd database truly requires manual repair, use vipw rather than an ordinary editor. It applies locking intended to avoid concurrent edits. Validate databases with tools such as pwck and maintain a recovery session before changing authentication files remotely.

To practice user and group records in a controlled environment, try these hands-on labs:

1. Manage Linux User Accounts with useradd, usermod, and userdel - Practice the complete lifecycle of user administration, from creating and securing new accounts to modifying and deleting them.
2. Manage Linux Groups with groupadd, usermod, and groupdel - Gain hands-on experience with core command-line utilities for group administration, including creating new groups and modifying user memberships.

Summary

You can now interpret local passwd records without mistaking them for the complete identity database.

1. Query NSS-resolved accounts with getent passwd.
2. Read the seven colon-separated passwd fields.
3. Locate the UID and primary GID fields.
4. Interpret password placeholders without overclaiming login state.
5. Use account tools or vipw instead of an ordinary editor.