[techtalk] Seeming inconsistency between /etc/passwd and "real" password data

[JamesA.Sutherland]

On Thu, 12 Apr 2001 15:56:31 -0700 (PDT), you wrote:

>I have noticed something strange on my system.   
>
>I no longer have an enty in the file /etc/passwd for
>my usual login.  I am able to log out and log back in
>using this login name.  So,it seems as though the data
>in the passwd file is present somewhere, but it is not
>visible in the passwd file.   I could not believe this
>so I wrote a progam to retrieve the information in
>/etc/passwd using struct passwd (pw.h).  All goes well
>when I access the information that is usually in my
>password file using the pointer returned by
>getpwnam(username).
>
>What do I not understand about how linux stores the
>info in /etc/passwd.  I had thought the system
>referred to the passwd file when I logged in.  Will I
>find that I will not be able to login if I reboot?  

Quite a few systems "cache" the plaintext /etc/passwd into a proper
structured database - it's possible you've been delected from the text
file, but not the corresponding database where your system does the
real user lookups.

Take a look at how PAM is set up, that should tell you where the
password info is really coming from. Also investigate carefully, since
someone deleting your user account from your system without your
knowledge is .. bad :-)


James.