Read the registers

You saw your own line last chapter. Read it again, counting the separators.

learner:x:100:101:learner:/home/learner:/bin/sh

Split into seven by :.

A table separated by : — exactly the shape the cut -d: of chapter 5 fits.

/etc/passwd is a table made to be read with command line tools. Which is why the separator is one fixed character and each person fits on one line.

Look at the second field. It is named passwd, and what is in it is a single x.

Everybody has x. Let us check.

~ $ cut -d: -f2 /etc/passwd | sort -ux

Drop the duplicates with sort -u and one line is left. So the real passwords are not here.

They used to be, encrypted. But /etc/passwd is readable by anybody (it was -rw-r--r--), so people took it away and cracked it by brute force.

So the contents moved to /etc/shadow, leaving only a mark saying "it is somewhere else". That is the file you read as root last lesson.

Separate what may be shown from what must be hidden into different files and guard it with permissions. Chapter 6's knowledge is at work here.

Let us see the other eight.

~ $ cut -d: -f1 /etc/passwdrootdaemonbinsyssyncmailwww-dataoperatornobodylearner

www-data, mail, daemon — not people's names. They are users for programs.

Why would a program need a name? To narrow its permissions.

A web server takes traffic from outside, so it runs the greatest risk of being taken over. Were it running as root, whoever took it over could do anything.

So you make a user called www-data that can do almost nothing and run it under that standing, so that the damage stops there if it is taken over.

The "owner" of chapter 6 is being used here as a mechanism of defence.

Users for programs have another trick. Look at the shell in the seventh field.

~ $ cut -d: -f7 /etc/passwd | sort -u/bin/false/bin/sh/bin/sync

There is an odd one, /bin/false, a command that does nothing and ends in failure.

The seventh field was "the shell to run when you log in". With /bin/false there, an attempt to log in ends immediately, which means you cannot get in.

learner -> /bin/sh    can log inwww-data -> /bin/false  cannot get in

It runs as a program and cannot get in as a person. A neat arrangement.

Count them and /bin/false appears seven times. Seven of the ten cannot get in: everybody except you, root and sync.

Line up the numbers in the third field.

~ $ cut -d: -f3 /etc/passwd | sort -n012348333710065534

Clustered at the low end, with only 100 and 65534 away on their own. The territories are fixed.

The one that matters most is 0. Being root is decided by the number 0, not by the name.

So "delete the name root and it is safe" is not true, and conversely a user with number 0 under another name is also root.

That is useful for inspection. Two or more lines with number 0 means someone may have made a back door. Count them in the next question.

Groups have a register too, split into four.

~ $ grep learner /etc/grouplearner:x:101:

The empty fourth field is curious. You are in the learner group and your name is not written there.

There is a reason. Your main group is written in the fourth field of /etc/passwd, which is the 101 in learner:x:100:101:....

What lines up in the fourth field of /etc/group is only people added later. Add someone to a group next lesson and a name appears here.

Incidentally /etc/group runs to 27 lines. There is a group per device, like disk and audio.

Today's questions are all about pointing the tools you already know at the registers.

There is nothing new to learn. And still you come away able to inspect.

Towards the end there is a question that counts the users with number 0. That is an inspection people really do on real servers, and you already hold every tool it takes.