Edit /etc/passwd Safely and Verify Every Field

One wrong colon in /etc/passwd and account tools stop working, or logins fail outright, so this is not a file for a quick manual edit. You'll inspect an account, understand all seven fields, make a controlled change with the shadow-utils locking tool, and verify the result. Allow about fifteen minutes: a shell and sudo for the edit and integrity check, though reading an account with getent is unprivileged.

The examples match shadow-utils 4.13, installed here as Debian package passwd version 1:4.13+dfsg1-4ubuntu3.2. Make a backup before changing anything.

1. Confirm the account source and inspect one record

Use getent rather than reading only the local file. Name-service configuration can combine local accounts with other sources, so this shows the record the system lookup actually returns:

$ getent passwd "$USER"
alice:x:1000:1000:Alice Example:/home/alice:/bin/bash

Your login name, numeric IDs, comment, home directory and shell will differ. It's one colon-delimited record; treat the password field as sensitive even when it's only a marker.

$ command -v vipw
/usr/sbin/vipw
$ dpkg-query -W -f='${Package} ${Version}\n' passwd
passwd 1:4.13+dfsg1-4ubuntu3.2

2. Read the seven fields without exposing password data

Every local /etc/passwd line has exactly seven fields, in order:

To review the non-password fields for the current account:

$ getent passwd "$USER" | awk -F: '{printf "login=%s uid=%s gid=%s gecos=%s home=%s shell=%s\n", $1, $3, $4, $5, $6, $7}'
login=alice uid=1000 gid=1000 gecos=Alice Example home=/home/alice shell=/bin/bash

• Don't read x as a password. It's a pointer to shadowed storage, and the manual requires a matching entry in /etc/shadow.
• A blank password field means none is required by the file format, though some applications refuse all access to such an account anyway.
• A field starting with ! is locked; a value like ! or * blocks Unix-password login while other authentication methods may still work.

3. Take a recoverable backup

Changing /etc/passwd is security-sensitive. Before opening the editor, make a separate backup with the same metadata:

$ sudo cp --preserve=all /etc/passwd /etc/passwd.before-edit
$ sudo ls -l /etc/passwd /etc/passwd.before-edit

Don't edit the backup, and keep it until the lookup and integrity check succeed. The shadow tools also keep /etc/passwd- as a backup, but the manual warns that not every account-management tool uses that file, so don't assume it's the one you just made.

4. Edit with vipw and preserve the record shape

Run the editor through vipw. It applies the appropriate lock while the file is open, cutting the odds of another account tool writing over your change:

$ sudo vipw

Change only the field you have a clear reason to touch. A valid synthetic record has this shape:

login:x:1001:1001:Example User:/home/login:/bin/bash

• Keep all seven fields and their colons. Never put a colon inside the login name.
• Don't invent a UID or GID that duplicates an existing identity. Changing a UID changes which files that numeric identity owns; it does not rename ownership on disk for you.
• Changing the home directory or shell can break the next login.
• Don't type a password hash into this file. Use passwd or another account tool to change a password.

If your preferred editor isn't the default, set VISUAL or EDITOR first. vipw checks VISUAL, then EDITOR, then falls back to vi:

$ sudo env VISUAL=nano vipw

5. Verify the lookup and file integrity

Ask the name-service lookup for the account again. It's a normal command, but it reads the live configuration:

$ getent passwd login
login:x:1001:1001:Example User:/home/login:/bin/bash

Replace login with the account you changed. Then run the shadow-utils checker in read-only mode. It checks field counts, names, IDs, primary groups, home directories, shells and, when /etc/shadow exists, the correspondence between the two files:

$ sudo pwck --read-only
$ printf 'exit status: %s\n' "$?"
exit status: 0

No output and exit status 0 is the clean result. Warnings need investigating even when the file still parses fine.

6. Recover if the edit was wrong

Stop before attempting a second edit if getent can't find the account, pwck reports the wrong field count, or the shell and home directory are clearly wrong. Restore the backup from step 3:

$ sudo cp --preserve=all /etc/passwd.before-edit /etc/passwd
$ sudo pwck --read-only