/etc/passwd is a Unix account file that stores basic user information such as usernames, user IDs and login shells. It is readable by all users so system tools can map identities, but it should not contain password hashes on modern systems. Defenders check it for unexpected accounts, UID changes and misconfigured shells.
What /etc/passwd Is Used For
/etc/passwd is the basic account directory for a Unix-like system. It gives operating system tools a readable map from usernames to user IDs, home directories and login shells, which is why many utilities can consult it without elevated access.
Because it is designed to be world-readable, its security value comes from structure and accuracy rather than secrecy. That makes it a control file as much as a data file: defenders use it to understand which accounts exist, how they are mapped, and whether any entries look unexpected.
Why Readability Matters
The file’s open readability supports login and account lookup, but it also means the contents can be enumerated by any local user and by many low-privilege processes. On hardened systems, the sensitive material is split out so /etc/passwd does not need to hold password hashes.
That separation is important because the file still influences authentication decisions indirectly. If an attacker can alter account metadata, change a shell, or introduce a new UID mapping, they may affect how tools interpret identity and execution context even without touching the password store itself.
Common Integrity Checks
Administrators typically review /etc/passwd for accounts that should not exist, unexpected UID or GID assignments, duplicate identities, and shells that should be disabled or restricted. These checks are a fast way to spot drift in a system’s local account state.
It is also worth comparing the file against authorised user management sources, because a legitimate account can become suspicious if its login shell changes, its home directory shifts, or its numeric identity no longer matches policy. The file is simple, but it is often a useful signal of broader host compromise or misconfiguration.
For a broader host-hardening baseline that covers account hygiene, shell restrictions and related Linux controls, Linux Server Hardening Guide is the natural companion resource.
How /etc/passwd Relates to Credentials and Access
/etc/passwd does not normally carry password hashes on modern Unix systems, but it still participates in the access chain by defining who can log in and what shell they receive. If the file is inconsistent with the shadow password database or with directory service data, account handling can break in ways that are both operational and security-relevant.
Defenders should treat unexpected changes as evidence to investigate account creation, privilege boundaries and possible persistence. When a local account is compromised, the most important follow-up is often not the passwd entry itself, but the surrounding access paths, scheduled jobs and shell access that the entry enables.
For attack patterns that include credentials hidden in system files and related local artefacts, Credential Dumping Guide provides a useful detection and response lens.
Risk and Threat Considerations
/etc/passwd is low sensitivity by design, but it is high value for integrity. Attackers target it when they want to create or disguise local access, preserve a foothold, or make a compromised host look normal to basic tooling.
Failure mechanism: A malicious or misconfigured change can add an account, alter a UID, or assign an unexpected shell, which may enable persistence, masquerading or accidental privilege overlap.
Impact: The system may continue to function while access control assumptions silently drift, making compromise harder to notice and recovery harder to trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | /etc/passwd is a local account inventory and access mapping file. |
| Recommendation — Review local accounts regularly and remove or disable unauthorized entries. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | The file records local accounts whose creation and review must be governed. |
| IA-5 — Authenticator Management | Modern systems keep password material out of /etc/passwd and rely on separate credential handling. | |
| Recommendation — Authorize, review, and disable local accounts through a defined account lifecycle process. Store and manage credential material separately from account identity records. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | The file is part of local identity administration and account mapping. |
| A.8.2 — Privileged access rights | Unexpected UID or shell changes can affect privileged local access paths. | |
| Recommendation — Maintain controlled identity records for local Unix accounts and their attributes. Restrict and review privileged local account attributes and access paths. | ||
| MITRE ATT&CK | T1136 — Create Account | Attackers may use local account creation or modification for persistence on Unix systems. |
| T1098 — Account Manipulation | Changing passwd entries can alter how a local account behaves and persists. | |
| Recommendation — Hunt for unauthorized local account creation and persistence changes on hosts. Monitor for account attribute changes that could enable persistence or concealment. | ||
Practitioner Guidance
What to watch for: Treat local account changes as security events, not routine text edits. Unexpected entries, duplicate numeric IDs, shell changes such as a login shell that should be disabled, and passwd updates that do not match your normal account-management process all deserve review.
Governance implication: Make /etc/passwd checks part of host baseline validation and change control, then compare it with the shadow file, directory services and approved local-account inventory so discrepancies are investigated quickly.