View source for Passwd

{{short description|Tool to change passwords on Unix-like OSes}}
{{distinguish|text=the "passwd" key used in the [[Name Service Switch]], which can use <code>/etc/passwd</code> as a source}}
{{lowercase|title=passwd}}
{{Infobox software 
| name                   = passwd
| logo                   = 
| screenshot             = Passwd screenshot.png
| screenshot size        = 
| caption                = <code>passwd</code> on [[Linux]]
| author                 = [[AT&T Bell Laboratories]]
| developer              = Various [[open-source software|open-source]] and [[commercial software|commercial]] developers
| released               = 
| latest release version = 
| latest release date    = 
| operating system       = [[Unix]], [[Unix-like]], [[Plan 9 from Bell Labs|Plan 9]], [[Inferno (operating system)|Inferno]]
| platform               = [[Cross-platform]]
| genre                  = [[Command (computing)|Command]]
| license                = 
| website                = 
}}
'''passwd''' is a [[command (computing)|command]] on [[Unix]], [[Plan 9 from Bell Labs|Plan 9]], [[Inferno (operating system)|Inferno]], and most [[Unix-like]] [[operating system]]s used to change a user's [[password]]. The password entered by the user is run through a [[key derivation function]] to create a [[hash function|hashed version]] of the new password, which is saved. Only the hashed version is stored; the entered password is not saved for security reasons.

When the user logs on, the password entered by the user during the log on process is run through the same key derivation function and the resulting hashed version is compared with the saved version. If the hashes are identical, the entered password is considered to be correct, and the user is authenticated. In theory, it is possible for two different passwords to [[Collision resistance|produce the same hash]]. However, [[cryptographic hash function]]s are designed in such a way that finding any password that produces the same hash is very difficult and practically infeasible, so if the produced hash matches the stored one, the user can be authenticated. <ref>{{cite web |title=passwd(1) — Linux manual page |url=https://man7.org/linux/man-pages/man1/passwd.1.html |access-date=26 February 2025}}</ref>

The passwd command may be used to change passwords for local accounts, and on most systems, can also be used to change passwords managed in a distributed authentication mechanism such as [[Network Information Service|NIS]], [[Kerberos (protocol)|Kerberos]], or [[LDAP]].

== Password file ==
The <code>/etc/passwd</code> file is a text-based database of information about [[User (computing)|users]] that may [[login|log into]] the system or other operating system user identities that own running processes.

In many operating systems, this file is just one of many possible back-ends for the more general [[passwd (database)|passwd name service]].

The file's name originates from one of its initial functions as it contained the data used to verify [[password]]s of user accounts.  However, on modern [[Unix]] systems the security-sensitive password information is instead often stored in a different file using shadow passwords, or other database implementations.

The <code>/etc/passwd</code> file typically has [[file system permissions]] that allow it to be readable by all users of the system (''world-readable''), although it may only be modified by the [[superuser]] or by using a few special purpose privileged commands.

The <code>/etc/passwd</code> file is a [[text file]] with one record per [[Line (text file)|line]], each describing a [[User (computing)|user account]].
Each record consists of seven fields separated by [[Colon (punctuation)|colons]]. The ordering of the records within the file is generally unimportant.

An example record may be:
{{sxhl|
 jsmith:x:1001:1000:Joe Smith,Room 1007,(234)555-8910,(234)555-0044,email:/home/jsmith:/bin/sh
|unixconfig}}
The fields, in order from left to right, are:<ref>[http://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/ Understanding <code>/etc/passwd</code> File Format]</ref>
# {{code|jsmith}}: User name: the string a user would type in when logging into the operating system: the [[logname]].  Must be unique across users listed in the file.
# {{code|x}}: Information used to validate a user's [[password]]. The format is the same as that of the analogous field in the [[Passwd#Shadow file|shadow password]] file, with the additional convention that setting it to "x" means the actual password is found in the shadow file, a common occurrence on modern systems.<ref name=linuxman>{{cite web|url=http://man7.org/linux/man-pages/man5/passwd.5.html |title=passwd(5) - Linux manual page |publisher=Man7.org |access-date=2014-08-25}}</ref>
# {{code|1001}}: [[User identifier (Unix)|user identifier]] number, used by the operating system for internal purposes.  It must be unique as it identifies users uniquely.
# {{code|1000}}: [[Group identifier (Unix)|group identifier]] number, which identifies the primary group of the user; all files that are created by this user may initially be accessible to this group.
# {{code|Joe Smith,Room 1007...}}: [[Gecos field]], commentary that describes the person or account. Typically, this is a set of comma-separated values including the user's full name and contact details.<ref>{{Cite web|url=https://linuxhint.com/view-understand-etc-passwd-file-linux/|title=How to View and Understand the /etc/passwd file in Linux|first=David|last=Adams}}</ref>
# {{code|/home/jsmith}}: Path to the user's [[home directory]].
# {{code|/bin/sh}}: Program that is started every time the user logs into the system. For an interactive user, this is usually one of the system's [[command line interpreter]]s ([[Shell (computing)|shells]]).

== Shadow file ==
<code>/etc/shadow</code> is used to increase the security level of passwords by restricting all but highly privileged users' access to hashed password data. Typically, that data is kept in files owned by and accessible only by the [[superuser|super user]]. <ref>{{cite web |title=shadow(5) — Linux manual page |url=https://man7.org/linux/man-pages/man5/shadow.5.html |access-date=26 February 2025}}</ref>

Systems administrators can reduce the likelihood of brute-force attacks by making the list of hashed passwords unreadable by unprivileged users. The obvious way to do this is to make the <code>passwd</code> database itself readable only by the root user. However, this would restrict access to other data in the file such as username-to-userid mappings, which would break many existing utilities and provisions. One solution is a "shadow" password file to hold the password hashes separate from the other data in the world-readable ''passwd'' file. For local files, this is usually <code>/etc/shadow</code> on [[Linux]] and Unix systems, or <code>/etc/master.passwd</code> on [[BSD]] systems; each is readable only by ''root''. (Root access to the data is considered acceptable since on systems with the traditional "all-powerful root" security model, the root user would be able to obtain the information in other ways in any case). Virtually all recent [[Unix-like]] operating systems use shadowed passwords.

The shadow password file does not entirely solve the problem of attacker access to hashed passwords, as some network authentication schemes operate by transmitting the hashed password over the network (sometimes in [[cleartext]], e.g., [[Telnet]]<ref>RFC 2877: ''5250 Telnet Enhancements''</ref>), making it vulnerable to interception.  Copies of system data, such as system backups written to tape or optical media, can also become a means for illicitly obtaining hashed passwords. In addition, the functions used by legitimate password-checking programs need to be written in such a way that malicious programs cannot make rapid authentication checks.

Regardless of whether password shadowing is in effect on a given system, the passwd file is readable by all users so that various system utilities (e.g., [[grep]]) can work (e.g., to ensure that user names existing on the system can be found inside the file), while only the root user can write to it. Without password shadowing, this means that an attacker with unprivileged access to the system can obtain the hashed form of every user's password. Those values can be used to mount a [[brute force attack]] offline, testing possible passwords against the hashed passwords relatively quickly without alerting system security arrangements designed to detect an abnormal number of failed [[logging (computer security)|login]] attempts. Especially when the hash is not salted it is also possible to look up these hashed passwords in [[rainbow table]]s, databases specially made for giving back a password for a unique hash.

With a shadowed password scheme in use, the <code>/etc/passwd</code> file typically shows a character such as '<code>*</code>', or '<code>x</code>' in the password field for each user instead of the hashed password, and <code>/etc/shadow</code> usually contains the following user information:
* User login name
* [[Salt (cryptography)|salt]] and hashed password OR a status exception value e.g.:
** <code>$id$salt$hashed</code>, the printable form of a password hash as produced by [[crypt (C)]], where <code>$id</code> is the algorithm used. Other Unix-like systems may have different values, like [http://man.netbsd.org/crypt.3 NetBSD]. [[Key stretching]] is used to increase [[password cracking]] difficulty, using by default 1000 rounds of modified MD5,<ref>{{Cite web|url=https://www.vidarholen.net/contents/blog/?p=32|title=Password hashing with MD5-crypt in relation to MD5 – Vidar's Blog|date=9 August 2011 }}</ref> 64 rounds of Blowfish, 5000 rounds of SHA-256 or SHA-512.<ref>{{Cite web|url=https://www.vidarholen.net/contents/blog/?p=33|title=Implementation of SHA512-crypt vs MD5-crypt – Vidar's Blog|date=16 August 2011 }}</ref> The number of rounds may be varied for [http://man.netbsd.org/crypt.3 Blowfish], or for SHA-256 and SHA-512 by using <code>$A$rounds=X$</code>, where "A" and "X" are the algorithm IDs and the number of rounds.  Common id values include:<ref>{{Cite web|title=Modular Crypt Format|url=https://passlib.readthedocs.io/en/stable/modular_crypt_format.html|archive-url=https://web.archive.org/web/20220107084228/https://passlib.readthedocs.io/en/stable/modular_crypt_format.html|archive-date=2022-01-07|access-date=2022-01-29}}</ref>
***<code>$1$</code> – MD5
***<code>$2$</code>, <code>$2a$</code>, <code>$2b$</code> – [[bcrypt]]
***<code>$5$</code> – SHA-256
***<code>$6$</code> – SHA-512
***<code>$y$</code> – [[yescrypt]]
** [[Empty string]] – No password, the account has no password (reported by passwd on Solaris with "NP").<ref name="solaris - passwd (1)">{{cite web |title=solaris - passwd (1) |url=http://www.cs.bgu.ac.il/~arik/usail/man/solaris/passwd.1.html |archive-url=https://web.archive.org/web/20131217221941/http://www.cs.bgu.ac.il/~arik/usail/man/solaris/passwd.1.html |archive-date=2013-12-17 |url-status=dead |website=cs.bgu.ac.il}}</ref>
** "!", "*" – the account is password locked, user will be unable to log in via password authentication but other methods (e.g. ssh key, logging in as root) may be still allowed.
** "*LK*" – the account itself is locked, user will be unable to log in.
** "*NP*", "!!" – the password has never been set<ref>{{cite web|url=https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/3/html/Introduction_to_System_Administration/s1-acctsgrps-rhlspec.html |title=6.3. Red Hat Enterprise Linux-Specific Information |publisher=Access.redhat.com |access-date=2014-08-25}}</ref>
* Days since [[Unix time|epoch]] of last password change
* Days until change allowed
* Days before change required
* Days warning for expiration
* Days after no logins before account is locked
* Days since epoch when account expires
* Reserved and unused

The format of the shadow file is simple, and basically identical to that of the password file, to wit, one line per user, ordered fields on each line, and fields separated by colons. Many{{how many|date=July 2020}} systems require the order of user lines in the shadow file be identical to the order of the corresponding users in the password file.

== History ==

Prior to password shadowing, a Unix user's hashed password was stored in the second field of their record in the <code>/etc/passwd</code> file (within the seven-field format as outlined above).

Password shadowing first appeared in Unix systems with the development of [[SunOS]] in the mid-1980s,<ref>{{cite web |title=passwd.adjunct(5) |website=FreeBSD Manual Pages |date=1987-12-14 |url=https://man.freebsd.org/cgi/man.cgi?query=passwd.adjunct&sektion=5&manpath=SunOS+4.1.3 |archive-url=https://web.archive.org/web/20251007221730/https://man.freebsd.org/cgi/man.cgi?query=passwd.adjunct&sektion=5&manpath=SunOS+4.1.3 |archive-date=2025-10-07 |url-status=live |access-date=2025-10-07}}</ref> [[System V]] Release 3.2 in 1988 and [[BSD]]4.3 Reno in 1990.  But, vendors who had performed ports from earlier UNIX releases did not always include the new password shadowing features in their releases, leaving users of those systems exposed to password file attacks.

System administrators may also arrange for the storage of passwords in distributed databases such as [[Network Information Service|NIS]] and [[LDAP]], rather than in files on each connected system.  In the case of NIS, the shadow password mechanism is often still used on the NIS servers; in other distributed mechanisms the problem of access to the various user authentication components is handled by the security mechanisms of the underlying data repository.

In 1987, the author of the original ''Shadow Password Suite'', Julie Haugh, experienced a computer break-in and wrote the initial release of the Shadow Suite containing the <code>[[Logging (computer security)|login]]</code>, <code>passwd</code> and <code>[[su (Unix)|su]]</code> commands. The original release, written for the SCO [[Xenix]] operating system, quickly got ported to other platforms.  The Shadow Suite was ported to [[Linux]] in 1992 one year after the original announcement of the Linux project, and was included in many early distributions, and continues to be included in many current [[Linux]] distributions.

In the past, it was necessary to have different commands to change passwords in different authentication schemes.  For example, the command to change a NIS password was ''yppasswd''.  This required users to be aware of the different methods to change passwords for different systems, and also resulted in wasteful duplication of code in the various programs that performed the same functions with different [[Front and back ends|back ends]].  In most implementations, there is now a single passwd command, and the control of where the password is actually changed is handled transparently to the user via [[pluggable authentication module]]s (PAMs). For example, the type of hash used is dictated by the configuration of the <code>pam_unix.so</code> module. By default, the [[MD5]] hash has been used, while current modules are also capable of stronger hashes such as [[Blowfish (cipher)|blowfish]], [[SHA256]] and [[SHA512]].

== See also ==
* [[chsh]]
* [[Crypt (C)]] (the library function) and [[Crypt (Unix)]] (the utility)
* [[getent]]
* [[Security Account Manager]] (the [[Microsoft Windows]] equivalent of the password file)
* [[Unix security]]
* [[vipw]]

== References ==
{{Reflist}}

== External links ==
* [http://man.cat-v.org/unix-1st/5/passwd Manual page from Unix First Edition describing /etc/passwd]
* {{man|1|passwd|FreeBSD|update a user's authentication token(s)}}
* {{man|1|passwd|Plan 9}}
* {{man|1|passwd|Inferno}}
* [http://linux.die.net/man/8/authconfig authconfig], a command-line tool for controlling the use of shadow passwords

{{Unix commands}}

[[Category:Configuration files]]
[[Category:Password authentication]]
[[Category:Security databases]]
[[Category:Unix authentication-related software]]
[[Category:Unix user management and support-related utilities]]
[[Category:Plan 9 commands]]
[[Category:Inferno (operating system) commands]]