How the Linux passwd File Stores User Accounts

In the Linux operating system, the /etc/passwd file serves as a core configuration file containing essential account attributes for every registered user. This article explains the format and structure of the /etc/passwd file, breaks down its seven colon-delimited fields, and outlines how the operating system reads this information to manage user access and system permissions.

File Format and Permissions

The /etc/passwd file is a plain-text database where each line represents a single user account. Because many system utilities need to map User IDs (UIDs) to human-readable usernames, the file is readable by all users on the system (file permissions are typically set to 644 or -rw-r--r--), while write permissions are restricted exclusively to the root user.

Each entry in the file consists of seven fields separated by colons (:):

username:password:UID:GID:GECOS:home_directory:shell

The Seven Fields of /etc/passwd

The first field contains the user's login name. This is the identifier entered during the authentication process. It must be unique across the system and typically consists of lowercase alphanumeric characters.

2. Password Placeholder

Historically, this field stored the user's encrypted password hash. Because the /etc/passwd file is world-readable, storing password hashes here exposed the system to offline dictionary and brute-force attacks. Modern Linux distributions replace this field with an x or an asterisk (*), indicating that the real encrypted hash is stored securely in /etc/shadow, which can only be read by the root user.

3. User ID (UID)

The UID is a unique numerical identifier assigned by the operating system to manage access controls:

0: Reserved for the root administrative account.
1–999: Reserved for system accounts and service daemons (e.g., daemon, sys, apache).
1000+: Assigned to regular interactive human users.

4. Group ID (GID)

The GID is the numerical identifier of the user's primary group. When the user creates a file or directory, it is automatically assigned this group ownership. Detailed information about this group and any secondary groups is stored separately in the /etc/group file.

5. User Information (GECOS)

The fifth field, historically named after the General Electric Comprehensive Operating Supervisor (GECOS), contains supplementary administrative information about the user. It often includes the user's full name, office room number, work phone, and home phone, separated by commas. This field is optional and frequently left blank or used strictly for the full name.

6. Home Directory

This field defines the absolute path to the user's home directory (e.g., /home/username). When the user logs in, the system automatically sets their current working directory to this path. If this directory does not exist or cannot be accessed, the system defaults to the root directory (/).

The final field specifies the absolute path of the command interpreter executed automatically when the user logs into the system (e.g., /bin/bash or /bin/zsh). For service or system accounts that do not require interactive access, this field is commonly set to /sbin/nologin or /usr/bin/false to prevent interactive shell logins.