Every line in /etc/passwd on a healthy modern system has a lone `x` in its second field. What does that `x` mean?

LPIC-1 Exam 102-500, objective 107. Administrative tasks easy

Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.

Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

The options

Correct The account's password hash is stored in /etc/shadow rather than here.

Correct. The second field once held the hash itself. Shadow passwords moved the hash to the root-only /etc/shadow, and the placeholder x is what remains in the world-readable file.

Not correct The account's password has been locked and cannot be used to authenticate.

Wrong. Locking is expressed in /etc/shadow by prefixing the stored hash with an exclamation mark, which is what passwd -l and usermod -L write. Nothing in /etc/passwd records it.

Not correct The account has no password at all, so authentication succeeds with an empty string.

Wrong, and that case looks different: an empty second field, not an x, is what means no password. On a shadowed system the same state is an empty password field in /etc/shadow, which is what passwd -d leaves behind, and it is dangerous.

Not correct The field is unused and its content is ignored by every tool.

Wrong. The field is read: an x sends the lookup to /etc/shadow, an empty field means no password, and a literal hash there would still be honoured on a system without shadow passwords.

Why

The seven colon-separated fields of /etc/passwd are login name, password placeholder, UID, GID of the primary group, GECOS comment, home directory and login shell. The file must stay world readable because any process turning a UID into a name reads it, which is precisely why the hash was moved out to /etc/shadow, readable only by root and typically the shadow group. The x is the pointer that says so.

Where this comes from

Cited
manual page passwd(5)

Practise this

Reading one question is not practice. The trainer will draw a short set from objective 107 and space the ones you get wrong.

Practise LPIC-1 Exam 102-500

More questions on this objective

All questions on Administrative tasks

Practise LPIC-1 Exam 102-500