0

How do I block the /etc/passwd file for all users except for root?

2
  • 1
    Why do you want this?
    – lg.
    Jun 24, 2010 at 8:38
  • 1
    The easiest method, is to simply not allow any other users have access to the system. I am sure I have seen several dups of this question, but they are not coming up in a search. This is the closest I could find. serverfault.com/questions/116281/…
    – Zoredache
    Jun 24, 2010 at 8:46

3 Answers 3

6

First, we should note that in modern systems, /etc/passwd doesn't actually contain any passwords, it just contains basic account information. On linux systems, the file that has the passwords is /etc/shadow, and it doesn't really contain the passwords, but cryptographically generated hashes of them (the file is /etc/master.passwd on FreeBSD based systems, including OSX).

By default both files should already have permissions that keep them safe, here is /etc/password on one of my linux systems:

jed@jed-bt:~$ ls -la /etc/passwd 
-rw-r--r--  1 root  root  1797 Feb 11 13:13 /etc/passwd

Note that you need to keep /etc/passwd world readable or things will break, as mentioned by a previous answer. So to reset the read/write permissions to these, you can run the command

chmod 644 /etc/passwd

If the file is owned by anyone other than root, you can also run

chown root:root /etc/passwd

to reset it. Of course you either have to run the chown and chmod commands as root, or using sudo.

1

It must be world readable or the system will break.

0

As Dennis Williamson already stated: It must be readable. And all passwords are in "shadow" as hashed strings, so it's not really exploitable.

If you want even more security, consider using another authentication system like LDAP.

You must log in to answer this question.