/etc/passwd Permission

[morganelan]

What do the impacts if I do:
#chmod 000 /etc/passwd

What permission of /etc/passwd should be applied?

[Arunvijai_4]

You can't login to that host. It should be atleast 400.

-Arun

[RAC_1]

If your really want to try it, try. Make sure you have two open sessions (as root) before doing this.

Absolutely not acceptable perms. At least 444. Lots of programs/apps make calls for uid look up, password looks. So it has to be at least read to all.

[Muthukumar_5]

Leave it as 444. It is keeping only userinformation and editable by the corresponding user with passwd command or with root user.

It is good to keep default permission for system files.

hth.

[Joseph Loo]

hi,

no. 444 will do.

maybe u like to refer to this guide:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

regards.

[morganelan]

I have done that RAC suggested above, but I still confuse why if I set permission /etc/passwd to 400, I still could login even if I used ordinary user.Please unix gurus shed light on my head...thanks in advance...

[morganelan]

Sorry I did chmod 000 not 400 as above mention..

[Arunvijai_4]

May be this link will give more information,
http://archives.neohapsis.com/archives/sf/sun/2001-q2/0225.html

-Arun

[Stephen Keane]

Even with 000 permissions, root can read a file, the passwd command runs as root (see /usr/bin/passwd it has SUID bit set and is owned by root). But more than the passwd command reads /etc/passwd and /etc/group. e.g. ls

[Bill Hassell · Accepted solution]

/etc/passwd is set to 444 for a lot of reqasons. If the passwd file cannot be read by ordinary users, many, many commands will fail. There are a lot of commands that raed the passwd file. For example: ls -l or ll. Change the passwd file so it's not readable and now these commands can only show numbers for usernames and groupnames. Other commands like finger, id and top and bascially any program that reports a username will fail. You'll also break your scripts that compare the output of id -un with "root" or other usernames will break.

It is really common to read Unix 101 books that warn about the vulnerability of the passwd file and not realize that this was solved decades ago with the shadow passwd file or the more secure method used by HP-UX, the TCB (Trusted Computing Base) design.

So your system won't crash and because login is a setUID program, it can log anyone into the system, but a lot of things won't work quite right--not something a system administrator needs to worry about. If security is a concern, convert to Trusted.

[morganelan]

thanks you all ........