In any linux system I have access to (a couple of Archlinuxes, an Ubuntu, a Debian Sid and a Gentoo) there are the following 4 files in /etc/, all ending with a dash:


On the internet they say that these are just backup files, updated to the next to last change.

Now I'm wondering: who's creating those files? Is it my editor? Is it the application editing those files (gpasswd, useradd, groupadd and so on)? Is it something at a lower level (maybe even a kernel module)?


The backup files are created by the program that modifies your /etc/group or /etc/passwd files like useradd, groupadd and the like created as a safety precaution in case files get corrupted during edit. Kernel never touches those files.

  • 1
    It's strange, because shadow and gshadow files (with a dash), have different chmod, unlike 000 and can be read by other users? Is there a way to make backups with proper chmod keeping 000?
    – Ilia
    Nov 27 '13 at 9:49
  • @IliaRostovtsev As far as I know the shadow and gshadow files have permissions of 0400.
    – Karlson
    Nov 27 '13 at 13:17
  • No, on CentOS, Fedora/RedHat it's set to 0000. It's insecure to have it set to 0400, I believe because any user on your system could run cat /etc/shadow and get the output of it?
    – Ilia
    Nov 27 '13 at 15:43
  • @IliaRostovtsev First off I am looking at permissions on /etc/shadow on a RedHat system and if it actually is possible for non-root to view this file with permissions of 0400 it means that there a significant bug in permission processing unless the file is owned by some other user.
    – Karlson
    Nov 27 '13 at 16:31
  • 1
    Related @IliaRostovtsev: unix.stackexchange.com/q/549464/135943
    – Wildcard
    Oct 30 '19 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.