7

Yes, yes I know there are no real passwords or even hashes in that file on modern systems. However, I am quite curious if this is a good, easy way to totally lock down a system from everyone and what would break first. I don't have a spare system, but it sure sounds like a fun experiment. Has anyone tried this?

2
  • This is pretty interesting from the point of view where you might want to build a system where your users are unable to lookup the usernames of other users.
    – pacey
    Nov 9, 2010 at 17:44
  • And according to pacey (below) also unable to lookup their own names as well!
    – Allen
    Nov 9, 2010 at 19:48

2 Answers 2

7

Just for you I tried it :-)

Any user will be able to login like normal. This is because login runs with root privileges. After being logged in the user won't have access to /etc/passwd which might cause problems with userland applications.

The first thing you might notice is that the shell cannot read your username which produce a prompt like

I have no name!@vs245042:~$
4
  • +1 just for trying it for me. I'm surprised that your system wasn't totally borked. Does it really say "I have no name!" or are you just paraphrasing? Which distro/version did you try?
    – User1
    Nov 9, 2010 at 19:47
  • I tried this on a Debian 4.0 machine with bash as login shell. It is not paraphrased it's copied from terminal.
    – pacey
    Nov 9, 2010 at 20:27
  • 1
    Also, ls will only show UID and GID in numeric form. ~<username> won't expand either. Nov 10, 2010 at 3:11
  • Wow. If you didn't know that someone did a chmod, how would you ever figure out what happened?
    – User1
    Nov 10, 2010 at 15:49
5

Setup an auditctl on /etc/passwd and see what tries to access it:
auditctl -w /etc/passwd -p war

Then afterwards analyse the output of:
ausearch -f /etc/passwd

See what's trying to access it, if it's all root processes then you're fine.

1
  • 1
    That's a cool idea. Is there a way to config auditctl to only log non-root users?
    – User1
    Nov 9, 2010 at 21:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .