Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I block the /etc/passwd file for all users except for root?

share|improve this question
1  
Why do you want this? –  lg. Jun 24 '10 at 8:38
1  
The easiest method, is to simply not allow any other users have access to the system. I am sure I have seen several dups of this question, but they are not coming up in a search. This is the closest I could find. serverfault.com/questions/116281/… –  Zoredache Jun 24 '10 at 8:46
add comment

3 Answers 3

First, we should note that in modern systems, /etc/passwd doesn't actually contain any passwords, it just contains basic account information. On linux systems, the file that has the passwords is /etc/shadow, and it doesn't really contain the passwords, but cryptographically generated hashes of them (the file is /etc/master.passwd on FreeBSD based systems, including OSX).

By default both files should already have permissions that keep them safe, here is /etc/password on one of my linux systems:

jed@jed-bt:~$ ls -la /etc/passwd 
-rw-r--r--  1 root  root  1797 Feb 11 13:13 /etc/passwd

Note that you need to keep /etc/passwd world readable or things will break, as mentioned by a previous answer. So to reset the read/write permissions to these, you can run the command

chmod 644 /etc/passwd

If the file is owned by anyone other than root, you can also run

chown root:root /etc/passwd

to reset it. Of course you either have to run the chown and chmod commands as root, or using sudo.

share|improve this answer
add comment

It must be world readable or the system will break.

share|improve this answer
add comment

As Dennis Williamson already stated: It must be readable. And all passwords are in "shadow" as hashed strings, so it's not really exploitable.

If you want even more security, consider using another authentication system like LDAP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.