Understanding /etc/passwd File Format

Originally published at: https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/

Can you explain /etc/passwd file format for Linux and Unix-like operating systems?

Have a look here: https://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/

Why are there two versions of /etc/passwd and /etc/shadow in /etc/ directory, one of each with a trailing hyphen - and one without in a machine where i have deleted admin and one user account in error?

That is a backup file created by the system. Applicable when you delete or remove /etc/passwd or /etc/shadow by accident. None of the system utilities use files (/etc/{passwd,shadow} ending with ‘-’.

While adding a new user (or modifying existing user), the original /etc/passwd file will be saved as /etc/passwd-.

This event applies to following files too:

  1. /etc/shadow
  2. /etc/gshadow
  3. /etc/group

When these files are changed, the old file will be saved ending with a dash “-”. They are backups.

1 Like

Thank you so much! Can I simply rename them (in the console with the rename command,) to recover the originals as they are, in a live session booted up from a USB? This is how I managed to find these files in the first place while trying to get everything back.
I still have Ubuntu installed, but it wants me to restart all the time with the installation screen as a new user/admin account when I boot up normally without the USB live session. I was wondering whether I can do this, because the encryption password has already been accepted when getting to this restarting screen. i.e will I recover the /home folder with my original name and original password, if I use these as a new user?

Thank you very much. I have replied to Monk relating to this and find this forum generally to be very helpful in trying to understand how to regain /home and files having mistakenly deleted the admin and a second useraccount on the GUI screen, no doubt because I was in a hurry and didn’t look at the screen properly!

Deleted files can only be recovered if you have a working backup. Otherwise not possible.

1 Like

Many thanks for the advice: I was just hoping that the backups of the passwd file etc would indicate that they could be restored and with them working again, the rest of the /home/… directory would be restored. I can still see and read the files all there on the HDD in /home- I just can’t log into them with the live thumb drive Ubuntu. I have a backup of /home on dejaDup as well still.


Linux sysadmin blog - Linux/Unix Howtos and Tutorials - Linux bash shell scripting wiki