4

Checking the two files /etc/passwd and /etc/shadow on a standard Linux distro, it appears all entries are duplicated in both files:

  • in /etc/passwd, all entries are duplicated (2 lines for each entry, including for root and the user name)
  • in /etc/shadow, all entries are similarly duplicated.

Any thoughts as to why and how does that happen? And remediation if need be?

Cheers.

Improve this question
5
  • 1
    what do you mean duplicate ? you must have an entry in both file for each user. or do you mean a user is duplicate within, say /etc/shadow (e.g. 2 root entry) ? Commented Apr 10, 2023 at 12:00
  • Just edited my initial post with further detail : in each file, all entries are actually duplicated. Commented Apr 10, 2023 at 13:30
  • 1
    You may find the pwck utility helpful to validate + correct the files Commented Apr 10, 2023 at 13:35
  • Cheers for the comment - I tried that one, but actually got a segmentation fault. Commented Apr 10, 2023 at 13:44
  • Are the userid and groupid values also duplicated, or is it just that the names are duplicated? Commented Apr 10, 2023 at 14:44

2 Answers 2

Reset to default
9

This is unexpected and non standard. Each username should have exactly one entry in /etc/passwd and no more than one entry in /etc/shadow.

Remediation should be handled with care. For starters I'd get a root shell up and running, and I wouldn't log out of it until I was sure I could safely log in after my editing. Second, I'd take a copy of both files (and note permissions and ownerships) in case I had to revert.

Then I'd use something like sort -u /etc/passwd and check visually to see if that resolved the duplication. Same for /etc/shadow.

If not, I'd take an account for which I knew the login details, and I'd discard the second of each duplicate. For both files. Trying to login, if it worked I'd apply the same logic to all entries in both files.

Otherwise I'd need to see some concrete example entries.

Basically, you will need to fix the problem by visual inspection.

Improve this answer
3
  • Many thanks, that's very clear and thanks for confirming that this is unexpected: it was my gutfeel but I couldn't find out if there weren't cases when this can be a 'legitimate' situation. I have actually used sort to check if it was just a few of those entries that were duplicated, but actually, this showed that all entries were duplicated, in both configuration files. Could I still ask please if you would have any idea as to the cause of such situation, or seen any kind of events that may trigger that ? And again, many thanks for your response. Commented Apr 10, 2023 at 16:45
  • I've never seen this except when editing the file "by hand" and accidentally read in (another instance of) the file while still editing it. You could conceivably get it with poor custom coding; I would guess it would be a grep searching for a username and then copying through the remainder, but forgetting that certain patterns match everywhere (. for example, or even something as silly as matching a username om wrongly against all users' /home/... directories) Commented Apr 10, 2023 at 17:18
  • OK, many thanks for this additional info. So, I don't know how that could have happened then - as I haven't tried any coding experiments :). but will do the steps you suggested. Many thanks again for your help! Commented Apr 10, 2023 at 19:22
-4

The major difference is that they contain different pieces of data. passwd contains the users' public information (UID, full name, home directory), while shadow contains the hashed password and the password expiry data. The reasons for the division are partly historical.

https://unix.stackexchange.com/a/461055/568212

passwd stores general user info and shadow stores user passwd info. Somewhat longer answer: passwd is the file where the user information (like username, user ID, group ID, location of home directory, login shell, ...) is stored when a new user is created. shadow is the file where important information (like an encrypted form of the password of a user, the day the password expires, whether or not the passwd has to be changed, the minimum and maximum time between password changes, ...) is stored when a new user is created.

https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd

https://man7.org/linux/man-pages/man5/passwd.5.html

https://man7.org/linux/man-pages/man5/shadow.5.html

First question is where are these duplicate user IDs? If they are in /etc/passwd then it is a sure sign that the system has not been maintained properly. AIX keeps user information in files other than /etc/passwd and /etc/shadow, which are only there for compatibility reasons. You need to use tools like rmuser to remove users, and I would recommend that you remove all instances of usernames which are duplicated and then re-create the required user IDs using mkuser to ensure that the correct information is present in files other than /etc/passwd. Make sure you document the attributes of each duplicated user before proceeding with the initial deletions. If you have entries in ODM which are not present in the /etc/passwd file, then you will have to look into using the ODM commands like odmdelete, but I will caution you with a big warning that if used incorrectly you could render your system unusable. If the userIDs are not in /etc/passwd then you can use the 'sort -u' command to sort the list, but please ensure that this isn't used on /etc/passwd. There are free passwd parsers out there which perform the correct manipulations if required.

https://community.spiceworks.com/topic/2405340-to-remove-duplicate-entries-from-list-if-userids

Find all the shell used among all the duplicate users in etc/passwd file

Improve this answer
1
  • Thanks everyone for comments - just edited my initial post with more details to be more specific about the question : I know the content and use of /etc/passwd & /ettc/shadow and how they relate to each other, the question was really about duplicate entrie as, in both file, each entry is written twice. Commented Apr 10, 2023 at 13:31

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.