Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 8 down vote favorite
1

Is there any reason that /etc/passwd should be world-wide readable ? It's not like password hashes that shouldn't be exposed, I just want to know why.

share|improve this question
1  
I think when your shell of choice knows to expand ~user to user's home directory, it's actually looking that up in /etc/passwd, so it's nice to have it readable instead of giving all shells elevated rights. – Ulrich Schwarz Aug 6 '12 at 9:46

2 Answers

up vote 11 down vote accepted

/etc/passwd is sometimes called the user database. That should give us a clue as to why it needs to be readable by everyone. Any utility that inspects file metadata needs to be able to read /etc/passwd (and /etc/group) in order to be able to resolve the numerical IDs used by the kernel and its subsystems to the human-friendly names that we rely on. Tools that need to find your home directory (mail delivery agents, etc) look that information up in /etc/passwd, and inet miniservers like fingerd look up your details in /etc/passwd.

As has been pointed out elsewhere, there is no particularly sensitive data in the file, as modern systems put the password hashes in a shadow password file, which is readable only by root.

share|improve this answer
4  
Then, is it for historical reasons it is called passwd when in fact this name does not reflect what is in the file? – Emanuel Berg Aug 6 '12 at 15:07
6  
Yes, I think so. In very early versions of UNIX, the passwords were indeed stored in /etc/passwd (unencrypted at first!). By the time password hashes were moved out to a shadow file, many utilities already existed that relied on other pieces of information in /etc/passwd, so the name stuck. – D_Bye Aug 6 '12 at 15:22
up vote 5 down vote

/etc/passwd does not contain password hashes (So it is not a big issue). /etc/shadow contains password hashes and it is only readable by root (& shadow group)

share|improve this answer
On some setups the passwords aren't even in that file because they are in LDAP or some other secured backend! – Tim Aug 6 '12 at 19:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.