/etc/passwd permission

[James Odak]

Is there any reason the /etc/passwd file must be 444?

-r--r--r-- 1 root root 10529 Oct 7 15:00 /etc/passwd


can i make it 440 (why would you want the world to be able to read the passwd file?)

-r--r----- 1 root root 10529 Oct 7 15:04 /etc/passwd

[Patrick Wallek · Accepted solution]

Errors can result if you make the passwd file permissions 440.

The biggest issue is that is you make the passwd file permissions 440, then a regular user will see the UID numbers instead of user ids when they do an ls -l.

Users must be able to read the passwd file in order for ls (and other things) to be able to translate UID numbers to the actual user id names.

[Patrick Wallek]

By the way, if you are concerned about users seeing encrypted passwords in the /etc/passwd file, then you should convert your machine to trusted mode.

[Geoff Wild]

Or, if you don't want trusted - install Shadow Password:

http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Rgds...Geoff

[John Poff]

Hi,

One of the things that will break when /etc/passwd is set to 440 permissions is the 'whoami' command, which will return 'Intruder alert.' when issued.

It's kind of fun to change those permissions on a slow day and listen to our Oracle DBAs get excited when they login to a box and see that message. :)

JP

[Bill Hassell]

440 will not allow users to use a number of commands like ls -l or ll. Every time you list a directory to show ownership, the passwd file must be read to decode the UID into a name. The passwd file must always be readable. The encrypted password cannot be decrypted but can be guessed which is the reason to enable Trusted System or use the new (11.11 only) Shadow Password feature.

[James Odak]

Thanks