A peek inside your password file.

Using Linux you must, by design, log in as a user. It doesn't matter which user, it could be Tom, Dick or Harry but who ever you log in as you need to supply a password. Those users and passwords are kept in a special file(s) in your /etc directory where all configuration files should be kept.

The file(s) are really just a colon separated list of the users that are known by the system and is really easy to understand. So easy that although you normally use programs like useradd, userdel and usermod to add, remove and manipulate users respectively you can do the exact same thing with a plain old text editor. For now I am just going to talk about the "/etc/passwd" file which is the file that lists all the users of the system. Not just the users that actually use the computer but system users which some programs need to run. Lets have a quick look at an abridged /etc/passwd file.A classroom of crashed computers

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh

As you can see each line has seven colon separated fields. Once you know what each of these fields mean it is very easy to create your own user or use scripts or programs to manipulate the file. Generally your Linux distribution should have information on how this file is constructed but it may be hidden. If you were just to type "man passwd" you would receive a manual page on the passwd program which is not what we want. To find the manual page on the /etc/passwd file you would need to type "man 5 passwd" and there you will see in textual glory the inside info on the passwd file.

To add a new user you can very simply construct your own line and add it to the passwd file. The first field is of course the user or login name. The second field which usually has an "x" in it just means that the password for that user has been encrypted and is stored in another secret file :). If you leave that field blank then that user has no password for login. Useful to know when you have forgotten your root (or any others) password. The next two fields are the user and group id's. For new users they are generally the same but as you can see in the above example they don't need to be. The user and group id's must be unique unless you have special circumstances and if you know what those circumstances are then you don't need to be reading this :). The next field doesn't have to be filled out as it is just a comment field where you can put some descriptive information. Also every user (normally) needs a home so the following field is where the home directory resides and last but not least. Without a shell there would be nothing the new user could do so the final field is where the users preferred shell is identified.

So you see, to add a new user is incredibly easy. So easy in fact that I will just add one here right off of the top of my head and I bet it will work. This will be user donotdothis and will be part of the root group, will have no password and its home will be in the temp directory. Here goes.....

echo "donotdothis::10000:0:You are now p0wn3d:/tmp:/bin/bash" >> /etc/passwd

As you can see it is a simple one liner that you can do in a couple of seconds flat. Oh did I mention that you need to have write access to the /etc/passwd file? Normally only root has that access so if you can add users to the /etc/passwd file in the above manner then you basically own the machine anyway.