User and Group Management Files

1. The User Database: /etc/passwd

The /etc/passwd file is the original user database in Unix and Linux systems. It's a plain text file that contains an entry for every user account on the system, including regular users, system users for running services, and the root user.

Because many system processes need to look up user information (like a user's ID number or home directory), this file is "world-readable"—any user on the system can view its contents.

As you read, you'll see that each line in /etc/passwd has seven fields separated by colons (:). Let's visualize this structure.

The two most important takeaways here are:

1. The second field, which historically held the password, now just contains an x. This indicates that the real password hash is stored securely elsewhere.
2. The last field specifies the user's default shell. For system accounts used by services (like a web server), you will often see /sbin/nologin or /bin/false. This is a security measure that prevents anyone from logging in as that user.

2. The Group Database: /etc/group

Similarly to /etc/passwd, the /etc/group file defines all the user groups on the system. It's also world-readable.

Here's a quick summary of the fields in /etc/group:

1. Group Name: The name of the group (e.g., wheel, developers).
2. Group Password: Almost always an x, as group passwords are rarely used and handled by a separate file (/etc/gshadow).
3. Group ID (GID): The unique numeric ID for the group.
4. Member List: A comma-separated list of users who are members of this group, but only if it's not their primary group. If a user's primary group is this one, their name won't be listed here; the system knows from their entry in /etc/passwd.

3. The Secure Database: /etc/shadow

This is where the real secrets are kept. The /etc/shadow file stores the encrypted password for each user, along with the password aging policies you configured in the last lesson.

Because this file contains sensitive information, it has very strict permissions. It can only be read by the root user. This is why it's called a "shadow" file—it shadows the public information in /etc/passwd with private, secure data.

The fields in /etc/shadow directly map to the settings you managed with chage.

Notice how the fields for password age, warning period, and account expiration are just numbers. These represent the number of days since the "Unix Epoch" (January 1st, 1970). This is why commands like chage are so useful—they handle the date conversions for you.

4. Do-It-Yourself: Reading the Files

Time to apply this theory. In this exercise, you'll act as a system administrator and inspect the configuration files to verify user and group settings on your own Fedora system.

Open your terminal and follow these steps.

Task 1: Inspect Your Own User Account

1. Find your entry in the /etc/passwd file. Replace your_username with your actual username.

   grep your_username /etc/passwd
   

   • Can you identify your UID, primary GID, home directory, and default shell from the output?

2. Find your primary group's entry in /etc/group. Use the GID you found in the previous step.

   
   
   
   # Replace GID with your actual group ID number
   grep ':GID:' /etc/group
   

3. Now, look at your secure information in /etc/shadow. You'll need sudo for this.

   sudo grep your_username /etc/shadow
   

4. Finally, compare the output from /etc/shadow with the output of the chage command. They should match!

   sudo chage -l your_username
   

   • This confirms that chage is just a friendly way to read and write to the /etc/shadow file.

Task 2: Inspect a System Account

1. Let's examine the sshd user, which is used by the SSH service for secure remote logins.

   grep sshd /etc/passwd
   

   • What is its UID? Notice it's below 1000.
   • What is its login shell? You should see /sbin/nologin, preventing direct login.

2. Check its shadow entry.

   sudo grep sshd /etc/shadow
   

   • What do you see in the password field? It's likely !! or *, indicating the account is locked and has no valid password for a human to use.

Task 3: Guided Interpretation Exercise

This final task will test your ability to interpret these files from a raw text dump, a common scenario when analyzing logs or system reports.

This exercise is a perfect way to solidify your new knowledge and practice thinking like a sysadmin.

Conclusion

Excellent work! You've successfully peeled back a layer of abstraction and learned how Linux stores the fundamental data for user and group management. This is a significant step up from simply knowing the commands; you now understand the data structures they manipulate.

Key Takeaways:

• /etc/passwd: A world-readable file containing basic user information like UID, GID, home directory, and shell.
• /etc/group: A world-readable file defining groups, their GIDs, and their members.
• /etc/shadow: A root-readable-only file that securely stores encrypted passwords and password aging policies, corresponding directly to the settings managed by chage.
• System accounts are distinct from user accounts, often having low UIDs, no-login shells, and locked passwords.

In the previous lessons, you've created and managed standard, unprivileged users. The only truly powerful user we've seen in these files is root. In our next lesson, we will cover the modern, secure way to perform administrative tasks: granting a user administrative privileges by adding them to the wheel group for sudo access.