`passwd`

Change login password (UNIX)

Syntax:

passwd [name]

Options:

name: The username whose password is to be changed or for whom an account is to be created (root only).

Description:

The passwd utility allows a login password to be changed or a new username to be created.

If you are changing your password, passwd prompts for the old password and then for the new password. The new password must be entered twice, to avoid typing mistakes. Only the owner or the superuser may change a password.

The superuser (root) may use this utility to create a new user account by entering:

    passwd new_user_name

When creating a new user account, passwd will prompt for information, such as the user's group list, home directory, and shell.

The /etc/default/passwd file lets you modify passwd's behavior to suit local requirements.

The /etc/passwd file contains the following fields, separated by colons:

username:has_passwd:userid:groupid:misc:home_directory:initial_command

If the has_passwd field contains an x character, a password has been defined for this user. If no character is present, no password has been defined. Use of any other character is reserved and may cause side-effects for the user.

The groupid field contains a group number. Users may log in under the groupid listed in their /etc/passwd file entry without being listed as a member of that group in the /etc/group file.

The misc field stores supplemental information, with commas separating subfields. Usually, the first subfield contains the user's "real life" name. Some utilities use this information (e.g. finger).

The initial_command field contains the initial command to run after the user has successfully logged in. This command and any arguments it takes must be separated by tab or space characters. As the command is spawned directly (not run by a shell), no shell expansions will be performed. There is no mechanism for specifying command-line arguments that contain space or tab characters themselves. (Quoting is not supported.)

If no initial_command is specified, /bin/sh will be used.

Files:

/etc/.pwlock

This file is created by passwd to indicate to other instances of passwd that the password file is currently being modified. When passwd finishes, the file is removed. See "Caveats," below.

/etc/group

This file defines the known groups for the system. It associates group names with a numerical ID and a list of usernames who are members of the group.

Entries in this file appear in the following format:

groupname::groupid:user[,user]...

/etc/opasswd /etc/oshadow

When passwd modifies a password file, it first locks the password files with the /etc/.pwlock file, then copies the contents of the current /etc/passwd and /etc/shadow files to /etc/opasswd and /etc/oshadow, respectively. If passwd is killed before it finishes writing the updated file, the password files may be restored from these backup versions. See "Caveats," below.

/etc/default/passwd

Contains configuration variables for the passwd utility. At least the following items may be set in this file:

BASEDIR=dirname: This specifies the default base directory under which user directories will be created. (Default: /home)
SHELL=progname: Specifies the default shell to be used for the initial_command field in new password entries. (Default: /bin/sh)
UIDRANGE=low-[high]: Specifies the range of values which may be selected for new new user IDs. The high component of the range may be omitted, indicating no upper bound. The dash (-) is still required in this case. (Default: 100-)
GIDRANGE: Specifies the range of values which may be selected for group IDs. As with UIDRANGE, the absence of a high component indicates there is no upper bound. (Default: 100-)
DUPDIROK: If specified, passwd will allow the selection of an already existing directory as a new user's home directory. (Default: not allowed)
DUPUIDOK: If specified, passwd will allow the selection of an already existing user ID for a new user name. This is generally discouraged since it would mean allowing a many-to-one user name/ user ID relationship. (Default: not allowed)
NOPASSWORDOK: If specified, passwd will allow user accounts to be set up which do not require a password to log in. (Default: not allowed)
STRICTPASSWORD: If specified, passwd will require all passwords to contain at least two types of characters (e.g. alphabetic and punctuation) (Default: strict passwords not required)
INSISTANT=retries: Specifies the number of times passwd will ask a non-root user if they really want to set their account up with no password. Ignored if NOPASSWORDOK is set.
PROFILE=basename: Specifies the basename of the file in the user's home directory which will be used as the shell initialization file. The DEFPROFILE (below) file will be copied there when a new account is set up. (Default PROFILE=.profile)
DEFPROFILE=filename: Specifies the pathname to a default shell initialization file which will be copied to a new user's PROFILE when their account is set up.

/etc/passwd

Contains the user account entries. The format of entries in this file are as follows:

username:has_passwd:userid:groupid:misc:home_directory:initial_command

/etc/shadow

Contains encoded versions of the actual passwords for user accounts. The passwords themselves are not stored in the /etc/passwd file.

Caveats:

The passwd utility creates the /etc/.pwlock file during updates to the password database. If for some reason the system crashes at an inopportune moment and leaves this file present, passwd will refuse to work until the file is removed by the system administrator. If the password files are somehow left in an inconsistent state as a result of the crash, the system administrator should also copy /etc/oshadow to /etc/shadow and copy /etc/opasswd to /etc/passwd.