The passwd file contains a line for every user. Each line contains 7 fields, separated by colons:

The password field on modern systems contains an "x", telling the system that the password is stored inside the /etc/shadow file. Storing the passwords elsewhere is needed to improve the security of the system: the passwd file should be world readable because many tools rely on it. Storing the password (even when it is encrypted or hashed) in a publicly readable file is asking for troubles - tools exist that attempt to crack user account passwords given the encrypted / hashed password values.

For this reason, the hashed password is stored inside the /etc/shadow file which is only readable by the root user (system administrator). The tools that work with passwords are small in number and highly audited to decrease the chance that they contain any vulnerabilities. More about the shadow file later...

As you will see in the next section, a user can be a member of many groups. However, every user has a single, primary group: this is the active group at the moment that the user is logged on. The active group defines the group ownership of the resources the user creates while logged on (remember, resources are assigned three ownership groups: user, group and others).

The users' home directory is usually the directory where the user has full write access to (even more, it is most often the only directory where the user has write access to). If a user is logged on through the command line (not graphically), it is also the directory where the user starts to work from.

Finally, the default shell for this particular user is defined. We've talked about what a shell is before. Unix/Linux has several shells, each shell provides roughly the same functionality, but is manipulated differently. Gentoo Linux by default uses the bash shell (bourne again shell), a powerfull shell with lots of additional functions such as command autocompletion, output colouring and more. Smaller shells also exist, such as csh (c shell) or ksh (korn shell).

More information about shells is available online.

The shadow file contains all information regarding a users' password. The most important field for many is the (hashed) password itself, but other information is available as well. The shadow file, like the passwd file, has a single line for every user; fields are separated by colons.

If the last three fields are left empty (which is the default case), their enforcement isn't valid.

The password value is hashed, meaning that the password itself is not stored on the disk (nor in any encrypted form). Instead, a mathematical formula is used to create a unique number or string from a password. To verify if a password given by a user matches, the given password is passed through the same mathematical formula and the resulting number or string is matched against the stored string. Such method makes it harder for a user to find out the password even if he has access to the shadow file because he can't deduce the password from the hash value.

Account information can be stored elsewhere - any repository will do, as long as it provides at least the same information as the passwd (and shadow) file. This is important because in enterprise environments, you rather want to keep track of user accounts in a central repository rather than in the files on several hundreds of systems.

The /etc/nsswitch.conf file defines where the system can find this information. An excerpt from an nsswitch.conf file is given below. You notice that it defines services on every line followed by the repository (or repositories) that manages the information.

passwd: compat
shadow: compat
group: compat
hosts: files dns

In the example, the passwd, shadow and group services are managed by the "compat" implementation. Compat is the default implementation provided by glibc (GNU C Library) which offers access to the various /etc/* files. The hosts service (used to resolve host names to IP addresses and vice versa) is managed by two implementations:

Similar with the /etc/passwd file, group information is stored inside the /etc/group. Again, every line in this text file defines a group; the fields within a group definition are separated by a colon.

It might seem strange to have a password on a group. After all, a user logs on using his user name. However, there is a sane reason for this: you can add users to a different group and password-protect this group. If a user is logged on to the system (but doesn't use the particular group as primary group) and leaves his terminal, malicious users can't change to this particular group without knowing the password even if they have access to the users' terminal (and therefore logged on session).

Group passwords aren't used often though. The cases where group passwords can be used (privileged groups) are usually implemented differently (for instance using privilege escalation tools like sudo).

If you want to add a user to the system, you can use the useradd command (you'll need to be root to perform this action):

# useradd -D thomas

In the above example, a user account identified by "thomas" is created using the system default settings (which, for a Gentoo Linux system, means that the default shell is bash, the home directory is /home/thomas, etc) after which his password is set.

You can pass on additional arguments to the useradd command to alter the users' attributes (such as the user id, home directory, primary group ...). I encourage you to read the useradd manual page for more information.

If a user account needs to be removed from the system, you can use the userdel command.

# userdel -r thomas

With the -r option, userdel not only removes the user account from the system but also cleans and removes the users' home directory. If you omit this option, the users' home directory remains available on the system, allowing you to keep his (private or not) files for future use.

To manipulate an existing account, you can use the usermod command. For instance, to modify the primary group of the thomas account to the "localusers" group:

# usermod -g localusers thomas

First of all, if a group doesn't exist yet, you'll need to create it: the groupadd command does this for you. Similarly, to remove a group from the system, you can use groupdel.

# groupadd audio

Suppose you want to add or remove a user from a group, you can use the usermod tool (as seen before) or the gpasswd tool.

The gpasswd tool is the main tool used to manipulate the group file. For instance, to add a user to a particular group (in the example the "audio" group):

# gpasswd -a audio thomas

Most resources on a Unix system are protected by a particular group: you need to be a member of a particular group in order to access those resources. The following tables gives an overview of interesting groups.

Executable binaries (not shell scripts) can be marked so that the Unix/Linux kernel executes that command as a specific user, regardless of who started the command. This mark is the setuid bit. Once set (using the chmod command), the tool is always executed with the rights of the owner and not the rights of the executor:

# chmod +s /path/to/command

For instance, if the shutdown command is marked setuid, then every user is able to run the shutdown command as root (which is the commands' owner) and thus be able to shut down or reboot the system.

If you mark an executable using the setuid bit, every user can execute the command as the application owner (root). You usually don't want to allow this but rather assign the necessary rights on a per-user, per-command basis. Enter sudo.

The sudo tool allows the system administrator to grant a set of users (individually or through groups) the rights to execute one or more commands as a different user (such as root), with or without requiring their password (for the same reason as the passwd command which asks the users' password before continuing).

Once available, the system administrator can run the visudo command to edit the configuration file. In the next example, the following definitions are set:

%wheel    ALL=(ALL) ALL
%operator ALL=/sbin/shutdown
test      ALL=NOPASSWD: /usr/local/bin/webctl.ksh
%httpd    ALL=(ALL) sudoedit /etc/apache2/conf/httpd.conf

If sudo is set up, users can execute commands by prepending sudo to it. If allowed, some users can even obtain a root shell through the sudo -i command.

(Execute a single command as root)
$ sudo mount /media/usb
Enter password: (unless configured with NOPASSWD)
(Obtain a root shell)
$ sudo -i
Enter password: (unless configured with NOPASSWD)
#