How do I block the /etc/passwd
file for all users except for root?
-
1Why do you want this?– lg.Jun 24, 2010 at 8:38
-
1The easiest method, is to simply not allow any other users have access to the system. I am sure I have seen several dups of this question, but they are not coming up in a search. This is the closest I could find. serverfault.com/questions/116281/…– ZoredacheJun 24, 2010 at 8:46
3 Answers
First, we should note that in modern systems, /etc/passwd doesn't actually contain any passwords, it just contains basic account information. On linux systems, the file that has the passwords is /etc/shadow, and it doesn't really contain the passwords, but cryptographically generated hashes of them (the file is /etc/master.passwd on FreeBSD based systems, including OSX).
By default both files should already have permissions that keep them safe, here is /etc/password on one of my linux systems:
jed@jed-bt:~$ ls -la /etc/passwd
-rw-r--r-- 1 root root 1797 Feb 11 13:13 /etc/passwd
Note that you need to keep /etc/passwd world readable or things will break, as mentioned by a previous answer. So to reset the read/write permissions to these, you can run the command
chmod 644 /etc/passwd
If the file is owned by anyone other than root, you can also run
chown root:root /etc/passwd
to reset it. Of course you either have to run the chown
and chmod
commands as root, or using sudo
.
As Dennis Williamson already stated: It must be readable. And all passwords are in "shadow" as hashed strings, so it's not really exploitable.
If you want even more security, consider using another authentication system like LDAP.