topic Re: /etc/passwd permission in Operating System - HP-UX

/etc/passwd permission

James Odak — Thu, 07 Oct 2004 15:08:28 GMT

Is there any reason the /etc/passwd file must be 444?

-r--r--r-- 1 root root 10529 Oct 7 15:00 /etc/passwd

can i make it 440 (why would you want the world to be able to read the passwd file?)

-r--r----- 1 root root 10529 Oct 7 15:04 /etc/passwd

Re: /etc/passwd permission

Patrick Wallek — Thu, 07 Oct 2004 15:14:12 GMT

Errors can result if you make the passwd file permissions 440.

The biggest issue is that is you make the passwd file permissions 440, then a regular user will see the UID numbers instead of user ids when they do an ls -l.

Users must be able to read the passwd file in order for ls (and other things) to be able to translate UID numbers to the actual user id names.

Re: /etc/passwd permission

Patrick Wallek — Thu, 07 Oct 2004 15:15:06 GMT

By the way, if you are concerned about users seeing encrypted passwords in the /etc/passwd file, then you should convert your machine to trusted mode.

Re: /etc/passwd permission

Geoff Wild — Thu, 07 Oct 2004 15:18:13 GMT

Or, if you don't want trusted - install Shadow Password:

http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Rgds...Geoff

Re: /etc/passwd permission

John Poff — Thu, 07 Oct 2004 15:26:34 GMT

Hi,

One of the things that will break when /etc/passwd is set to 440 permissions is the 'whoami' command, which will return 'Intruder alert.' when issued.

It's kind of fun to change those permissions on a slow day and listen to our Oracle DBAs get excited when they login to a box and see that message. :)

JP

Re: /etc/passwd permission

Bill Hassell — Thu, 07 Oct 2004 15:27:32 GMT

440 will not allow users to use a number of commands like ls -l or ll. Every time you list a directory to show ownership, the passwd file must be read to decode the UID into a name. The passwd file must always be readable. The encrypted password cannot be decrypted but can be guessed which is the reason to enable Trusted System or use the new (11.11 only) Shadow Password feature.

Re: /etc/passwd permission

James Odak — Wed, 12 Jan 2005 16:32:13 GMT

Thanks