vipw tips — authorized passwd-edit literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run vipw / vigr on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any write — never edit production passwd without change control.
3. Record short factual notes; quote short Evidence (which file, which non-secret fields — never hashes).
4. Optional: provisioning → useradd-tips / groupadd-tips.
5. Optional: password changes → passwd-tips.
6. Optional: integrity → pwck-tips.
7. Prefer vipw/vigr over raw vi /etc/passwd so locks and sanity checks stay intact.
8. Stop at literacy — no attack or unauthorized account-rewrite cookbooks.

Allowed framing

• Classroom labs reviewing locked edit workflows on authorized hosts.
• Binding short factual notes as Evidence (file path, field intent — no shadow hashes).
• Documenting expected vs observed shell/home changes for authorized inventory notes.
• Comparing vipw ↔ useradd / passwd / visudo peer tip pages under one binder.
• Testing vipw -s / vigr drills when the syllabus authorizes them on disposable VMs.

Scope we will not cover

• No crack/pirate/keygen via passwd edits.
• No intentional unauthorized account rewrites against foreign hosts.
• No secret-theft or shadow-hash dumping against hosts you do not own.
• No cookbooks that disable authentication / plant backdoor accounts without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with shadow-utils installed.
2. Prefer creating a throwaway account via useradd-tips before any vipw drill.
3. With authorization, open vipw briefly; document the lock behavior; abort without saving if the syllabus is read-only.
4. Optional: integrity check with pwck-tips after authorized edits.
5. Stop at literacy — no attack or unauthorized passwd-rewrite cookbooks.

Practical notes for authorized labs

• Prefer dedicated tools (useradd, usermod, passwd) for routine changes; reserve vipw for syllabus-approved edit drills.
• vipw locks reduce concurrent-edit corruption — quote lock success/fail as Evidence when relevant.
• Never commit /etc/passwd or /etc/shadow dumps to git — even for labs.
• Pair with visudo-tips when comparing locked-editor patterns (sudoers vs passwd).
• Label lab-only weak shells/homes clearly so they are not mistaken for production posture.
• If the editor opens unexpectedly, exit without writing unless the syllabus authorized the change.

FAQ-aligned refusals (quick)

• Foreign-host passwd rewrites → refuse.
• Sharing unredacted shadow hashes in public binders → refuse.
• Backdoor-account cookbooks → refuse.

For legal, authorized and educational use only.

FAQ

Sources