1 .\" $NetBSD: passwd.5,v 1.12.2.2 1999/12/17 23:14:50 he Exp $
3 .\" Copyright (c) 1988, 1991, 1993
4 .\" The Regents of the University of California. All rights reserved.
5 .\" Portions Copyright (c) 1994, Jason Downs. All rights reserved.
7 .\" Redistribution and use in source and binary forms, with or without
8 .\" modification, are permitted provided that the following conditions
10 .\" 1. Redistributions of source code must retain the above copyright
11 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\" 3. Neither the name of the University nor the names of its contributors
16 .\" may be used to endorse or promote products derived from this software
17 .\" without specific prior written permission.
19 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 .\" From: @(#)passwd.5 8.1 (Berkeley) 6/5/93
32 .\" $FreeBSD: src/share/man/man5/passwd.5,v 1.50 2007/05/08 11:00:07 yar Exp $
33 .\" $DragonFly: src/share/man/man5/passwd.5,v 1.9 2008/05/02 02:05:06 swildner Exp $
41 .Nd format of the password file
45 files are the local source of password information.
46 They can be used in conjunction with the Hesiod domains
53 .Sq Li passwd.byname ,
55 .Sq Li master.passwd.byname ,
57 .Sq Li master.passwd.byuid ,
61 For consistency, none of these files should ever be modified
66 file is readable only by root, and consists of newline separated
67 records, one per user, containing ten colon
71 These fields are as follows:
72 .Bl -tag -width ".Ar password" -offset indent
82 User's login group id.
88 Account expiration time.
90 General information about the user.
92 User's home directory.
99 file is generated from the
108 fields removed, and the
116 field is the login used to access the computer account, and the
118 field is the number associated with it.
119 They should both be unique
120 across the system (and often across a group of systems) since they
123 While it is possible to have multiple entries with identical login names
124 and/or identical user id's, it is usually a mistake to do so.
126 that manipulate these files will often return only one of the multiple
127 entries, and that one by random selection.
129 The login name must never begin with a hyphen
132 suggested that neither upper-case characters or dots
135 of the name, as this tends to confuse mailers.
136 No field may contain a
139 as this has been used historically to separate the fields
140 in the user database.
149 form of the password, see
153 field is empty, no password will be required to gain access to the
155 This is almost invariably a mistake, so authentication components
156 such as PAM can forcibly disallow remote access to passwordless accounts.
157 Because this file contains the encrypted user passwords, it should
158 not be readable by anyone without appropriate privileges.
163 password authentication is disabled for that account
164 (logins through other forms of
165 authentication, e.g., using
167 keys, will still work).
168 The field only contains encrypted passwords, and
170 can never be the result of encrypting a password.
172 An encrypted password prefixed by
174 means that the account is temporarily locked out
175 and no one can log into it using any authentication.
176 For a convenient command-line interface to account locking, see
181 field is the group that the user will be placed in upon login.
182 Since this system supports multiple groups (see
184 this field currently has little special meaning.
188 field is a key for a user's login class.
194 style database of user attributes, accounting, resource,
195 and environment settings.
199 field is the number of seconds from the epoch,
202 password for the account must be changed.
203 This field may be left empty to turn off the password aging feature.
207 field is the number of seconds from the epoch,
211 This field may be left empty to turn off the account aging feature.
215 field normally contains comma
217 separated subfields as follows:
219 .Bl -tag -width ".Ar office" -offset indent -compact
225 user's work phone number
227 user's home phone number
232 may contain an ampersand
234 which will be replaced by
235 the capitalized login
239 field is displayed or used
240 by various programs such as
247 and phone number subfields are used by the
249 program, and possibly other applications.
251 The user's home directory,
255 path name where the user
256 will be placed on login.
260 field is the command interpreter the user prefers.
261 If there is nothing in the
263 field, the Bourne shell
266 The conventional way to disable logging into an account once and for all,
267 as it is done for system accounts,
278 .Xr nsswitch.conf 5 ,
281 lookups occur from the
290 .Xr nsswitch.conf 5 ,
293 lookups occur from the
294 .Sq Li passwd.byname ,
295 .Sq Li passwd.byuid ,
296 .Sq Li master.passwd.byname ,
298 .Sq Li master.passwd.byuid
313 .Xr nsswitch.conf 5 ,
316 file also supports standard
317 .Sq Li + Ns / Ns Li -
318 exclusions and inclusions, based on user names and netgroups.
320 Lines beginning with a
322 (minus sign) are entries marked as being excluded
323 from any following inclusions, which are marked with a
327 If the second character of the line is a
329 (at sign), the operation
330 involves the user fields of all entries in the netgroup specified by the
331 remaining characters of the
334 Otherwise, the remainder of the
336 field is assumed to be a specific user name.
340 token may also be alone in the
342 field, which causes all users from either the Hesiod domain
345 .Sq Li passwd_compat: dns )
352 .Sq Li passwd_compat: nis )
355 If the entry contains non-empty
359 fields, the specified numbers will override the information retrieved
360 from the Hesiod domain or the
368 entries contain text, it will override the information included via
373 field may also be overridden.
375 .Bl -tag -width ".Pa /etc/master.passwd" -compact
378 password file, with passwords removed
381 password database, with passwords removed
382 .It Pa /etc/master.passwd
384 password file, with passwords intact
387 password database, with passwords intact
390 The password file format has changed since
392 The following awk script can be used to convert your old-style password
393 file into a new style password file.
394 The additional fields
399 are added, but are turned off by default.
400 Class is currently not implemented, but change and expire are; to set them,
401 use the current day in seconds from the epoch + whatever number of seconds
403 .Bd -literal -offset indent
405 { print $1 ":" $2 ":" $3 ":" $4 "::0:0:" $5 ":" $6 ":" $7 }
415 .Xr nsswitch.conf 5 ,
423 .%T "Managing NFS and NIS"
424 (O'Reilly & Associates)
428 file format appeared in
434 file format first appeared in SunOS.
436 The Hesiod support first appeared in
438 It was imported from the
440 Project, where it first appeared in
443 User information should (and eventually will) be stored elsewhere.
447 exclusions in the file after any inclusions will have