35

In any linux system I have access to (a couple of Archlinuxes, an Ubuntu, a Debian Sid and a Gentoo) there are the following 4 files in /etc/, all ending with a dash:

/etc/group-
/etc/gshadow-
/etc/passwd-
/etc/shadow-

On the internet they say that these are just backup files, updated to the next to last change.

Now I'm wondering: who's creating those files? Is it my editor? Is it the application editing those files (gpasswd, useradd, groupadd and so on)? Is it something at a lower level (maybe even a kernel module)?

Improve this question

1 Answer 1

Reset to default
29

The backup files are created by the program that modifies your /etc/group or /etc/passwd files like useradd, groupadd and the like created as a safety precaution in case files get corrupted during edit. Kernel never touches those files.

Improve this answer
10
  • 1
    It's strange, because shadow and gshadow files (with a dash), have different chmod, unlike 000 and can be read by other users? Is there a way to make backups with proper chmod keeping 000?
    – Ilia Ross
    Nov 27, 2013 at 9:49
  • @IliaRostovtsev As far as I know the shadow and gshadow files have permissions of 0400.
    – Karlson
    Nov 27, 2013 at 13:17
  • No, on CentOS, Fedora/RedHat it's set to 0000. It's insecure to have it set to 0400, I believe because any user on your system could run cat /etc/shadow and get the output of it?
    – Ilia Ross
    Nov 27, 2013 at 15:43
  • @IliaRostovtsev First off I am looking at permissions on /etc/shadow on a RedHat system and if it actually is possible for non-root to view this file with permissions of 0400 it means that there a significant bug in permission processing unless the file is owned by some other user.
    – Karlson
    Nov 27, 2013 at 16:31
  • 1
    Related @IliaRostovtsev: unix.stackexchange.com/q/549464/135943
    – Wildcard
    Oct 30, 2019 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .