Tutorial

How To Use passwd and adduser to Manage Passwords on a Linux VPS

Published on September 4, 2013
How To Use passwd and adduser to Manage Passwords on a Linux VPS

Introduction

Passwords and authentication are concepts that every user must deal with when working in a Linux environment. These topics span a number of different configuration files and tools.

In this guide, we will explore some basic files, like "/etc/passwd" and "/etc/shadow", as well as tools for configuring authentication, like the aptly-named "passwd" command and "adduser".

We will be using an Ubuntu 12.04 VPS to discuss these topics, but any modern Linux distribution should function in a similar way.

What Is the "/etc/passwd" File?

The first file we will look at, called the "/etc/passwd" file, does not actually store passwords.

At one time, this file stored the hashed passwords of every user on the system. However, this responsibility has been moved to a separate file for security reasons.

Let's look at what is in the "/etc/passwd" file:

less /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
. . .

The first thing to note is that this file is accessible by unprivileged users.

Everyone on the system has read privileges to this file. This is why password information was moved out of this file.

Let's look at the format of the file.

How To Read the "/etc/passwd" File

Each line in the file contains the login information of a single user on the system. Some of these users might be created for use by daemons and background services.

Take a look at a single line to see what information it contains:

root:x:0:0:root:/root:/bin/bash

The fields of information are separated by a colon (:) character. There are seven fields on each line in a typical Linux "/etc/passwd" file:

  1. root: Account username.
  2. <li><strong>x</strong>: Placeholder for password information.  The password is obtained from the "/etc/shadow" file.</li>
    
    <li><strong>0</strong>: User ID.  Each user has a unique ID that identifies them on the system.  The root user is always referenced by user ID 0.</li>
    
    <li><strong>0</strong>: Group ID.  Each group has a unique group ID.  Each user has a "primary" group that is used as the group by default.  Again, the root group's ID is always 0.</li>
    
    <li><strong>root</strong>: Comment field.  This field can be used to describe the user or user's function.  This can be anything from contact information for the user, to descriptions of the service the account was made for.</li>
    
    <li><strong>/root</strong>: Home directory.  For regular users, this would usually be "/home/<span class="highlight">username</span>".  For root, this is "/root".</li>
    
    <li><strong>/bin/bash</strong>: User shell. This field contains the shell that will be spawned or the command that will be run when the user logs in.</li>	
    

As you add user accounts using commands like "adduser" and "useradd", or as you install more services, this file will grow. New username information will be added to the bottom of this file.

In most cases, you should not have to edit this file by hand. There are tools that manipulate this file and ensure that the proper syntax is maintained.

What Is the "/etc/shadow" File?

The actual password data is stored in a file called "/etc/shadow".

This doesn't actually contain passwords in plain text. Instead, it uses a key derivation function to create a hash. This is what it stores in the file.

A key derivation function is basically an algorithm that will always create a certain hash when given the same input. The same algorithm is run on the password that is given during authentication and this value is compared to the value in this file.

Note that this file, unlike the "/etc/passwd" file, is not readable by unprivileged users.

The root user has read and write permissions, and the "shadow" group, which contains users needed for authentication, has read permissions.

How To Read the "/etc/shadow" File

Open the "/etc/shadow" file by typing:

sudo less /etc/shadow
root:$6$mJD3Rsj4$xUa7jru6EEGTXnhwTfTT26/j8M5XiQvUl6UH32cfAWT/6W9iSI5IuIw5OOw4khwrsOHPyMwfCLyayfYiVdhAq0:15952:0:99999:7:::
daemon:*:15455:0:99999:7:::
bin:*:15455:0:99999:7:::
sys:*:15455:0:99999:7:::
sync:*:15455:0:99999:7:::
games:*:15455:0:99999:7:::
man:*:15455:0:99999:7:::
. . .

Like the "/etc/passwd" file, each line defines a user's information and each field is delimited by a colon (:) character.

Note: The asterisk (*) value in the second field on some of the above lines means that the account cannot log in. This is mainly used for services and is intended behavior.

Let's take a look at a single line again:

daemon:*:15455:0:99999:7:::

These are fields defined in the "/etc/shadow" file:

  1. daemon: Account username.
  2. <li><strong>*</strong>: Salt and hashed password.  You can see what this looks like with the root entry above.
    
    	As noted above, the asterisk signifies that this account cannot be used to log in.</li>
    
    <li><strong>15455</strong>: Last password change.  This value is measured in days from the Unix "epoch", which is January 1, 1970.</li>
    
    <li><strong>0</strong>: Days until password change permitted.  0 in this field means there are no restrictions.</li>
    
    <li><strong>99999</strong>: Days until password change required.  99999 means that there is no limit to how long the current password is valid.</li>
    
    <li><strong>7</strong>: Days of warning prior to expiration.  If there is a password change requirement, this will warn the user to change their password this many days in advance.</li>
    
    <li><strong>[blank]</strong>The last three fields are used to denote days before the account is made inactive, days since the Epoch when the account expires.  The last field is unused.</li>	
    

How Do You Change Passwords?

Users' passwords can be modified by issuing the "passwd" command.

By default, this command changes the current user's password and does not require special permissions.

passwd

If you would like to change another user's password, you will need administrative privileges. The following syntax can be used:

sudo passwd username

You will be prompted for your password for the "sudo" command, and then you will be told to enter and confirm the new password you would like to use.

If you compare the hashed value in the "/etc/shadow" file, you will see that it changes after you issue the passwd command.

How Do You Create New Users?

Users can be created using a few different commands.

The easiest method is probably with the "adduser" command, which we will cover here. On Ubuntu systems, this is linked to a perl script that handles appropriate user creation.

You can call it like so:

adduser demo
Adding user `demo' ...
Adding new group `demo' (1000) ...
Adding new user `demo' (1000) with group `demo' ...
Creating home directory `/home/demo' ...
Copying files from `/etc/skel' ...
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
Changing the user information for demo
Enter the new value, or press ENTER for the default
	Full Name []: test
	Room Number []: room
	Work Phone []: work phone
	Home Phone []: home phone
	Other []: other
Is the information correct? [Y/n]

You will be asked a series of questions that will help fill in the information in the "/etc/passwd" file and the "/etc/shadow" file.

We can see what entry it added to the "/etc/passwd" file by entering:

tail -1 /etc/passwd
demo:x:1000:1000:test,room,work phoneme phone,other:/home/demo:/bin/bash

You can see that this takes great advantage of the comments field. The other fields are filled in as expected.

We can run a similar command to see the modifications made to the "/etc/shadow" file:

sudo tail -1 /etc/shadow
demo:$6$XvPCmWr4$HXWmaGSeU5SrKwK2ouAjc68SxbJgUQkQ.Fco9eTOex8232S7weBfr/CMHQkullQRLyJtCAD6rw5TVOXk39NAo/:15952:0:99999:7:::

Conclusion

Using these simple tools, you can change the login information on your system.

It is important to test your ability to log in after making any changes. It is also essential to keep the permissions on the authentication files the same to maintain functionality and security.

By Justin Ellingwood

Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.

Learn more about us


About the authors

Still looking for an answer?

Ask a questionSearch for more help

Was this helpful?
 
7 Comments


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Justin Ellingwood
DigitalOcean Employee
DigitalOcean Employee badge
September 30, 2013

wpg4665: You are completely right. I’ve updated the article. Thanks for keeping an eye out!

You may want to update the line reading: The actual password data is stored in a file called “/etc/passwd”.

I believe it should be “/etc/shadow”

I like your site dudes. Get some.

Hello, Thank you for the great information. I have a linux VPN server and I would like to let users to change their passwords and I don’t want to give them permission to ssh to my server. I developed an application in C# and SSH.NET I can run ssh commands but I am not able to run a command to change users password.

I have tried all the command below: ID_NewPass = txt1.Text.Trim(); using (SshClient ssh1 = new SshClient(ID_ServerID, ID_Username, ID_Pass)) { try { string cp = "passwd " + ID_Uname + " "; ssh1.Connect();

//the command below works with out any issue //I use it to check if the user has any account on the server //if there is not any account Program shows an appropriate message and close //the checking section is somewhere else, I repeat the command to be sure that there is not any //problem in the ssh connection var result_1 = ssh1.RunCommand(“grep -c '^” + ID_Uname + ":’ /etc/passwd ");

                   cp = "Echo -e \"" + ID_NewPass + "\" | passwd --stdin " + ID_Uname;
                    cp = "echo -e '" + ID_NewPass + "' | passwd " + ID_Uname;
                    cp = "echo -e " + ID_NewPass + " | passwd AH3";
                    cp = "echo user:" + ID_NewPass + " | passwd AH3";
                    var result = ssh1.RunCommand(cp);
                }
                finally
                {
                    ssh1.Disconnect();
                    ssh1.Dispose();
                }

none of them work. Any recommendation?

Thanks for that article. I am setting up a small mail server with dovecot and was using virtual user for it and needed to understand how /etc/passwd work. The explanation is simple and easy to understand and I was able to grab what I was looking for very fast and very easy. By the way, “adducer” should be “adduser” at the top. For a moment I thought this was a new command that I had to search. Keep up the good work

Kobiglay

This comment has been deleted

    Try DigitalOcean for free

    Click below to sign up and get $200 of credit to try our products over 60 days!

    Sign up

    Join the Tech Talk
    Success! Thank you! Please check your email for further details.

    Please complete your information!

    Get our biweekly newsletter

    Sign up for Infrastructure as a Newsletter.

    Hollie's Hub for Good

    Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

    Become a contributor

    Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

    Welcome to the developer cloud

    DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

    Learn more
    DigitalOcean Cloud Control Panel