While managing users, you need to manage user properties, and these user properties are
mostly managed in etcPaaSWD, but also in etcShadow.
Here are the important properties.
It starts with the name, which is the name of the account.
Now we have the password, which is the secret that is used for authentication, which may
be disabled, and which is not stored in etcPaaSWD for security reasons.
It is in etcShadow.
Then there is a UID.
Every user has a unique identifier, and that's stored in the third field of etcPaaSWD.
We have the GID, which is the ID of the primary group of the user.
I'll tell you later what that is about.
And we have the GCOS, the General Electric Common Object Subscription.
Yes, that is something that goes back to the early 1970s when the field was invented by
General Electric to store additional non-mandatory information about the user.
We have the home directory, which is the environment where a user creates personal files, and it's
one of the few environments where users have write permissions by default.
And there is a shell, which is a program that will be started after successful authentication.
Let's check out these properties.
So let me use a TIL-5 on etcPaaSWD, and there we can see user Linda, for instance.
So here we have the username, the X, which is a placeholder for the password, which since
a long time is not stored in this file anymore, the user ID, the group ID, colon, colon, which
means that we don't have anything in the GCOS field, and a reference to the home directory
and the default shell that should be executed.
Another example is here, crony.
Crony is used by the crony time service.
There you can see that the GCOS field is used to provide some information about the user.
And also interesting, crony is a system user.
It's used by a service account, and you can recognize that because it has a user ID lower
than 1,000, and these system users shouldn't be able to log in.
And that is why user crony has been no login as the default shell.
Kind of funny, user crony has been no login.
DNS mask on the next line is user has been no login, but we already know that because
of the symbolic link that's pointing to the exact same file.
Now, let's also have a look at the last five lines in ETC's shadow, where I'm mainly
interested in what we see here.
This is the hash of the encrypted password.
With some expiration information about the password, we'll talk about that later.
Now, my normal users do have a password.
Here, the TCP dump user, for instance, that's a system user, again, as an exclamation mark.
An exclamation mark means that login for this specific user account is disabled.