4 ms·
> /etc/passwd is world-readable by design for some arcane reason The reason is actually very straightforward: if you can’t read /etc/password, you don’t know w
by wolfgang42 4y ago
> /etc/passwd is world-readable by design for some arcane reason
The reason is actually very straightforward: if you can’t read /etc/password, you don’t know who anyone is! Reading this file is (or was, prior to the introduction of nsswitch et al) the way you mapped a UID to a login name, so if you couldn’t read it then anything that needed to show a user (ps, who, ls -l, etc) would just show numbers instead.
Putting the actual password hash in it was, in hindsight, a mistake[1]; this was corrected pretty quickly with /etc/shadow but the file had to stick around with the same name because of all the things that were reading it already. (This is the same reason the “GECOS” field stuck around long after Bell Labs stopped using a GE computer for their print spooler.)
[1] I’m sure it made sense at the time—the fact that the password wasn’t just stored in plaintext was a novelty in its own right and nobody was going to spend that much CPU time trying to crack hashes when there were better things to do with the computer.
- bayindirh 4y agoAlso, one of the "cons" has been noted as it "works" on a single machine. You can "fix" that by enabling LDAP on the hosts and authenticating everything via that thing called an LDAP server. We're doing this for a very long time on 500+ machines, and it just works. If you want to sync configs, you can do this with another "femtoservice" running somewhere. I understand the concerns, but just badmouthing things because they're evolving for decades instead of built from top to bottom every three years is bad to put it mildly.
- kazinator 4y agoThe problem of cross-machine passwd was solved before LDAP by something called NIS, also from Sun Microsystems. NIS was called Yellow Pages originally, so it has program names like ypbind.
- bayindirh 4y agoI remember the name ypbind, but didn't know what it was. Thanks for the info, greatly appreciated.
- kazinator 4y ago> this was corrected pretty quickly with /etc/shadow Not sure about "pretty quickly". If we peg the start of Unix at 1975, we then have Julie Hugh writing the Shadow Password Suite in 1987, thirteen years into the game, and the adoption of shadow didn't take place overnight.