Every line in /etc/passwd on a healthy modern system has a lone `x` in its second field. What does that `x` mean?
LPIC-1 Exam 102-500, objective 107. Administrative tasks easy
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct The account's password hash is stored in /etc/shadow rather than here.
Correct. The second field once held the hash itself. Shadow passwords moved the hash to the root-only /etc/shadow, and the placeholder x is what remains in the world-readable file.
Not correct The account's password has been locked and cannot be used to authenticate.
Wrong. Locking is expressed in /etc/shadow by prefixing the stored hash with an exclamation mark, which is what passwd -l and usermod -L write. Nothing in /etc/passwd records it.
Not correct The account has no password at all, so authentication succeeds with an empty string.
Wrong, and that case looks different: an empty second field, not an x, is what means no password. On a shadowed system the same state is an empty password field in /etc/shadow, which is what passwd -d leaves behind, and it is dangerous.
Not correct The field is unused and its content is ignored by every tool.
Wrong. The field is read: an x sends the lookup to /etc/shadow, an empty field means no password, and a literal hash there would still be honoured on a system without shadow passwords.
Why
The seven colon-separated fields of /etc/passwd are login name, password placeholder, UID, GID of the primary group, GECOS comment, home directory and login shell. The file must stay world readable because any process turning a UID into a name reads it, which is precisely why the hash was moved out to /etc/shadow, readable only by root and typically the shadow group. The x is the pointer that says so.
Where this comes from
- Cited
- manual page passwd(5)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 107 and space the ones you get wrong.
More questions on this objective
- The account alice already belongs to the supplementary groups audio and video. You must additionally put her in the group developers while keeping her existing memberships. Which command does that? machine-checked
- A departing employee's account bob must be deleted together with his home directory and mail spool. Which command does all of that in one step? machine-checked
- You want every newly created account to start with a company-standard .bashrc already in its home directory. Where do you place that file? machine-checked
- On a host whose accounts come partly from local files and partly from a directory service, `grep alice /etc/passwd` returns nothing even though `id alice` works. Which command shows alice's account entry the way the system itself resolves it? machine-checked
- Policy says passwords must be changed at least every 90 days, and the account carol must comply. Which command sets that maximum password age? machine-checked
- A line in /etc/group reads `developers:x:1500:alice,bob`. What does the final field contain? machine-checked