PASSWD(5)		   Linux Programmer's Manual		     PASSWD(5)



NAME
       passwd - password file

DESCRIPTION
       The  /etc/passwd file is a text file that describes user login accounts
       for the system.	It should have read permission allowed for  all	 users
       (many  utilities,  like ls(1) use it to map user IDs to usernames), but
       write access only for the superuser.

       In the good old days there was no great problem with this general  read
       permission.   Everybody	could  read  the  encrypted passwords, but the
       hardware was too slow to crack a well-chosen password, and moreover the
       basic  assumption  used to be that of a friendly user-community.	 These
       days many people run some version of the shadow password	 suite,	 where
       /etc/passwd  has	 an  'x'  character  in	 the  password	field, and the
       encrypted passwords are in /etc/shadow, which is readable by the	 supe-
       ruser only.

       If the encrypted password, whether in /etc/passwd or in /etc/shadow, is
       an empty string, login is allowed without even asking for  a  password.
       Note  that this functionality may be intentionally disabled in applica-
       tions, or configurable (for example  using  the	"nullok"  or  "nonull"
       arguments to pam_unix.so).

       If  the	encrypted  password  in	 /etc/passwd  is  "*NP*"  (without the
       quotes), the shadow record should be obtained from an NIS+ server.

       Regardless of whether shadow passwords are used, many  system  adminis-
       trators	use  an	 asterisk  (*) in the encrypted password field to make
       sure that this user can not authenticate him- or herself using a	 pass-
       word.  (But see NOTES below.)

       If  you	create	a new login, first put an asterisk (*) in the password
       field, then use passwd(1) to set it.

       Each line of the file describes	a  single  user,  and  contains	 seven
       colon-separated fields:

	      name:password:UID:GID:GECOS:directory:shell

       The field are as follows:

       name	   This is the user's login name.  It should not contain capi-
		   tal letters.

       password	   This is either the encrypted	 user  password,  an  asterisk
		   (*),	 or the letter 'x'.  (See pwconv(8) for an explanation
		   of 'x'.)

       UID	   The privileged root login account (superuser) has the  user
		   ID 0.

       GID	   This is the numeric primary group ID for this user.	(Addi-
		   tional groups for the user are defined in the system	 group
		   file; see group(5)).

       GECOS	   This	 field	(sometimes  called  the	 "comment  field")  is
		   optional and used only for  informational  purposes.	  Usu-
		   ally,  it  contains	the full username.  Some programs (for
		   example, finger(1)) display information from this field.

		   GECOS stands for "General Electric Comprehensive  Operating
		   System",  which was renamed to GCOS when GE's large systems
		   division  was  sold	to  Honeywell.	 Dennis	 Ritchie   has
		   reported:  "Sometimes  we sent printer output or batch jobs
		   to the GCOS machine.	 The gcos field in the	password  file
		   was	a  place  to stash the information for the $IDENTcard.
		   Not elegant."

       directory   This is the user's home directory:  the  initial  directory
		   where  the  user  is placed after logging in.  The value in
		   this field is used to set the HOME environment variable.

       shell	   This is  the	 program  to  run  at  login  (if  empty,  use
		   /bin/sh).   If  set	to  a nonexistent executable, the user
		   will be unable to login through  login(1).	The  value  in
		   this field is used to set the SHELL environment variable.

FILES
       /etc/passwd

NOTES
       If  you	want  to  create  user	groups,	 there	must  be  an  entry in
       /etc/group, or no group will exist.

       If the encrypted password is set to an asterisk (*), the user  will  be
       unable  to  login  using login(1), but may still login using rlogin(1),
       run existing processes and initiate new ones through  rsh(1),  cron(8),
       at(1),  or  mail	 filters,  etc.	  Trying  to lock an account by simply
       changing the shell field yields the same result and additionally allows
       the use of su(1).

SEE ALSO
       chfn(1),	 chsh(1),  login(1),  passwd(1), su(1), crypt(3), getpwent(3),
       getpwnam(3), group(5), shadow(5)

COLOPHON
       This page is part of release 4.10 of the Linux  man-pages  project.   A
       description  of	the project, information about reporting bugs, and the
       latest	 version    of	  this	  page,	   can	   be	  found	    at
       https://www.kernel.org/doc/man-pages/.



Linux				  2015-02-01			     PASSWD(5)