linuxpasswd

How to check if the /etc/passwd file in Linux contains invalid entry?


I am trying to determine if the passwd file present in the location /etc/passwd in Linux contains any invalid data entries with the pwck command.

For example:
1) If my file contains this entry which is invalid due to the extra colon in the end - user1:x:1000:1000:user1,,,:/home/user1:/bin/bash:

sudo pwck -r /etc/passwd

This takes a no by default if invalid entries exist and shows other output as well

2) If my passwd file is correct syntactically but has user that does not have corresponding directories

sudo pwck -r /etc/passwd

user 'user1': directory '/var/xyz' does not exist

The exit values of both commands is 2 so I cannot distinguish if the user entry is invalid or there are directories for users that are non existent

I only want to identify an invalid entry in passwd file i.e if there is some extra character or syntactically wrongly added entry in the file


Solution

  • If you want only the "syntatic" correctness, just write a regex to match it. Reading from wikipedia and shadow sources to match the user name right, I wrote this for GNU sed:

    sed -r '/^[a-z_][a-z0-9_-]*[$]?:[^:]*:[0-9]+:[0-9]+:[^:]*:[^:]*:[^:]*$/!q1'
    

    But there are many other checks that pwck does.

    So I think the best way would be to take pwck sources and hand-pick the checks you are interested in and remove the checks you are not interested in.

    so I cannot distinguish

    Sure you can distinguish - as the program outputs what is wrong with the file.

    if ! out=$(sudo pwck -r /etc/passwd 2>&1); then
       if <<<"$out" grep -q 'invalid user name\|invalid user ID\|invalid password file entry'; then
           echo "File is syntactically wrong"
       else
            echo "Something else is wrong with the file"
       fi
    fi