xref: /freebsd/share/man/man5/passwd.5 (revision 17ee9d00bc1ae1e598c38f25826f861e4bc6c3ce)
1.\" Copyright (c) 1988, 1991, 1993
2.\"	The Regents of the University of California.  All rights reserved.
3.\"
4.\" Redistribution and use in source and binary forms, with or without
5.\" modification, are permitted provided that the following conditions
6.\" are met:
7.\" 1. Redistributions of source code must retain the above copyright
8.\"    notice, this list of conditions and the following disclaimer.
9.\" 2. Redistributions in binary form must reproduce the above copyright
10.\"    notice, this list of conditions and the following disclaimer in the
11.\"    documentation and/or other materials provided with the distribution.
12.\" 3. All advertising materials mentioning features or use of this software
13.\"    must display the following acknowledgement:
14.\"	This product includes software developed by the University of
15.\"	California, Berkeley and its contributors.
16.\" 4. Neither the name of the University nor the names of its contributors
17.\"    may be used to endorse or promote products derived from this software
18.\"    without specific prior written permission.
19.\"
20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30.\" SUCH DAMAGE.
31.\"
32.\"     From: @(#)passwd.5	8.1 (Berkeley) 6/5/93
33.\"	$Id$
34.\"
35.Dd September 29, 1994
36.Dt PASSWD 5
37.Os
38.Sh NAME
39.Nm passwd
40.Nd format of the password file
41.Sh DESCRIPTION
42The
43.Nm passwd
44files are files consisting of newline separated records, one per user,
45containing ten colon (``:'') separated fields.  These fields are as
46follows:
47.Pp
48.Bl -tag -width password -offset indent
49.It name
50User's login name.
51.It password
52User's
53.Em encrypted
54password.
55.It uid
56User's id.
57.It gid
58User's login group id.
59.It class
60User's general classification (unused).
61.It change
62Password change time.
63.It expire
64Account expiration time.
65.It gecos
66General information about the user.
67.It home_dir
68User's home directory.
69.It shell
70User's login shell.
71.El
72.Pp
73The
74.Ar name
75field is the login used to access the computer account, and the
76.Ar uid
77field is the number associated with it.  They should both be unique
78across the system (and often across a group of systems) since they
79control file access.
80.Pp
81While it is possible to have multiple entries with identical login names
82and/or identical user id's, it is usually a mistake to do so.  Routines
83that manipulate these files will often return only one of the multiple
84entries, and that one by random selection.
85.Pp
86The login name must never begin with a hyphen (``-''); also, it is strongly
87suggested that neither upper-case characters or dots (``.'') be part
88of the name, as this tends to confuse mailers.  No field may contain a
89colon (``:'') as this has been used historically to separate the fields
90in the user database.
91.Pp
92The password field is the
93.Em encrypted
94form of the password.
95If the
96.Ar password
97field is empty, no password will be required to gain access to the
98machine.  This is almost invariably a mistake.
99Because these files contain the encrypted user passwords, they should
100not be readable by anyone without appropriate privileges.
101.Pp
102The group field is the group that the user will be placed in upon login.
103Since this system supports multiple groups (see
104.Xr groups 1 )
105this field currently has little special meaning.
106.Pp
107The
108.Ar class
109field is currently unused.  In the near future it will be a key to
110a
111.Xr termcap 5
112style database of user attributes.
113.Pp
114The
115.Ar change
116field is the number in seconds,
117.Dv GMT ,
118from the epoch, until the
119password for the account must be changed.
120This field may be left empty to turn off the password aging feature.
121.Pp
122The
123.Ar expire
124field is the number in seconds,
125.Dv GMT ,
126from the epoch, until the
127account expires.
128This field may be left empty to turn off the account aging feature.
129.Pp
130The
131.Ar gecos
132field normally contains comma (``,'') separated subfields as follows:
133.Pp
134.Bd -unfilled -offset indent
135name		user's full name
136office		user's office number
137wphone		user's work phone number
138hphone		user's home phone number
139.Ed
140.Pp
141This information is used by the
142.Xr finger 1
143program.
144.Pp
145The user's home directory is the full
146.Tn UNIX
147path name where the user
148will be placed on login.
149.Pp
150The shell field is the command interpreter the user prefers.
151If there is nothing in the
152.Ar shell
153field, the Bourne shell
154.Pq Pa /bin/sh
155is assumed.
156.Sh YP/NIS INTERACTION
157The
158.Pa /etc/passwd
159file can be configured to enable the YP/NIS group database.
160An entry whose
161.Ar name
162field consists of a plus sign (`+') followed by a login name, will be
163replaced internally to the C library with the YP/NIS password entry for the
164named group.  An entry whose
165.Ar name
166field consists of a single plus sign with no login name following,
167will be replaced with the entire YP/NIS
168.Dq Li passwd.byname
169map.
170.Pp
171If any fields other than the login name are left empty, they
172will be used to override the YP/NIS database's values.  So, for
173example, an
174.Pa /etc/master.passwd
175entry of:
176.Bd -literal -offset indent
177+:::::::::/etc/noaccess
178
179.Ed
180would use the entire contents of the YP/NIS password database, but
181each entry would have its designated shell replaced by
182.Pa /etc/noaccess
183(presumably, a program to tell those users that they are not allowed to
184access the machine).
185This is the only way to specify values for the fields which are not
186present in the Sixth Edition format used by YP/NIS.
187.Pp
188If the YP/NIS password database is enabled for any reason, all reverse
189lookups (i.e.,
190.Fn getpwuid )
191will use the entire database, even if only a few logins are enabled.
192Thus, the login name returned by
193.Fn getpwuid
194is not guaranteed to have a valid forward mapping.
195.Sh FILES
196.Bl -tag -width /etc/master.passwd -compact
197.It Pa /etc/passwd
198ASCII password file, with passwords removed
199.It Pa /etc/pwd.db
200.Xr db 3 -format
201password database, with passwords removed
202.It Pa /etc/master.passwd
203ASCII password file, with passwords intact
204.It Pa /etc/spwd.db
205.Xr db 3 -format
206password database, with passwords intact
207.El
208.Sh SEE ALSO
209.Xr adduser 8 ,
210.Xr chpass 1 ,
211.Xr getpwent 3 ,
212.Xr login 1 ,
213.Xr passwd 1 ,
214.Xr pwd_mkdb 8 ,
215.Xr vipw 8 ,
216.Xr yp 4
217.Sh BUGS
218User information should (and eventually will) be stored elsewhere.
219.Pp
220The YP/NIS password database makes encrypted passwords visible to
221ordinary users, thus making password cracking easier.
222.Pp
223The YP/NIS password database is in old-style (Sixth Edition) format,
224and so cannot specify site-wide values for user login class, password
225expiration date, and other fields present in the current format and
226not in the old.
227.Sh COMPATIBILITY
228The password file format has changed since 4.3BSD.
229The following awk script can be used to convert your old-style password
230file into a new style password file.
231The additional fields
232.Dq class ,
233.Dq change
234and
235.Dq expire
236are added, but are turned off by default.
237Class is currently not implemented, but change and expire are; to set them,
238use the current day in seconds from the epoch + whatever number of seconds
239of offset you want.
240.Bd -literal -offset indent
241BEGIN { FS = ":"}
242{ print $1 ":" $2 ":" $3 ":" $4 "::0:0:" $5 ":" $6 ":" $7 }
243.Ed
244.Sh HISTORY
245A
246.Nm
247file format appeared in
248.At v6 .
249The YP/NIS functionality is modeled after
250.Tn SunOS
251and first appeared in
252.Tn FreeBSD
2531.1.  The override capability is new in
254.Tn FreeBSD
2552.0.
256