How do you block /etc/passwd file

Question

How do I block the /etc/passwd file for all users except for root?

Answer 1

First, we should note that in modern systems, /etc/passwd doesn't actually contain any passwords, it just contains basic account information. On linux systems, the file that has the passwords is /etc/shadow, and it doesn't really contain the passwords, but cryptographically generated hashes of them (the file is /etc/master.passwd on FreeBSD based systems, including OSX).

By default both files should already have permissions that keep them safe, here is /etc/password on one of my linux systems:

jed@jed-bt:~$ ls -la /etc/passwd 
-rw-r--r--  1 root  root  1797 Feb 11 13:13 /etc/passwd

Note that you need to keep /etc/passwd world readable or things will break, as mentioned by a previous answer. So to reset the read/write permissions to these, you can run the command

chmod 644 /etc/passwd

If the file is owned by anyone other than root, you can also run

chown root:root /etc/passwd

to reset it. Of course you either have to run the chown and chmod commands as root, or using sudo.

Answer 2

It must be world readable or the system will break.

Answer 3

As Dennis Williamson already stated: It must be readable. And all passwords are in "shadow" as hashed strings, so it's not really exploitable.

If you want even more security, consider using another authentication system like LDAP.