Arch linux root password

Reset lost root password

This guide will show you how to reset a forgotten root password. Several methods are listed to help you accomplish this.

Contents

Using sudo

If you have installed sudo and have configured permissions for either the wheel group or a user whose password you recall, you can change the root password by running sudo passwd root .

Using the debug shell

1. Append systemd.debug_shell to the kernel parameters.
2. This will do a normal boot but start debug-shell.service which runs a root shell ( /bin/sh ) on tty9 . Press Ctrl+Alt+F9 to access it.
3. Use the passwd command to create a new password for the root user.
4. When done, stop debug-shell.service .

Using bash as init

1. Append the init=/bin/bash kernel parameter to your boot loader’s boot entry.
2. Your root file system is mounted as read-only now, so remount it as read/write: mount -n -o remount,rw / .
3. Use the passwd command to create a new password for the root user.
4. Reboot by typing reboot -f and do not lose your password again!

Using a LiveCD

With a LiveCD a couple methods are available: change root and use the passwd command, or erase the password field entry directly editing the password file. Any Linux capable LiveCD can be used, albeit to change root it must match your installed architecture type. Here we only describe how to reset your password with chroot, since manual editing the password file is significantly more risky.

Источник

Reset lost root password

This guide will show you how to reset a forgotten root password. Several methods are listed to help you accomplish this.

Contents

Using sudo

If you have installed sudo and have configured permissions for either the wheel group or a user whose password you recall, you can change the root password by running sudo passwd root .

Using the debug shell

1. Append systemd.debug_shell to the kernel parameters.
2. This will do a normal boot but start debug-shell.service which runs a root shell ( /bin/sh ) on tty9 . Press Ctrl+Alt+F9 to access it.
3. Use the passwd command to create a new password for the root user.
4. When done, stop debug-shell.service .

Using bash as init

1. Append the init=/bin/bash kernel parameter to your boot loader’s boot entry.
2. Your root file system is mounted as read-only now, so remount it as read/write: mount -n -o remount,rw / .
3. Use the passwd command to create a new password for the root user.
4. Reboot by typing reboot -f and do not lose your password again!

Using a LiveCD

With a LiveCD a couple methods are available: change root and use the passwd command, or erase the password field entry directly editing the password file. Any Linux capable LiveCD can be used, albeit to change root it must match your installed architecture type. Here we only describe how to reset your password with chroot, since manual editing the password file is significantly more risky.

Источник

Installation guide

This document is a guide for installing Arch Linux using the live system booted from an installation medium made from an official installation image. The installation medium provides accessibility features which are described on the page Install Arch Linux with accessibility options. For alternative means of installation, see Category:Installation process.

Before installing, it would be advised to view the FAQ. For conventions used in this document, see Help:Reading. In particular, code examples may contain placeholders (formatted in italics ) that must be replaced manually.

For more detailed instructions, see the respective ArchWiki articles or the various programs’ man pages, both linked from this guide. For interactive help, the IRC channel and the forums are also available.

Arch Linux should run on any x86_64-compatible machine with a minimum of 512 MiB RAM, though more memory is needed to boot the live system for installation.[1] A basic installation should take less than 2 GiB of disk space. As the installation process needs to retrieve packages from a remote repository, this guide assumes a working internet connection is available.

Contents

Pre-installation

Acquire an installation image

Visit the Download page and, depending on how you want to boot, acquire the ISO file or a netboot image, and the respective GnuPG signature.

Verify signature

It is recommended to verify the image signature before use, especially when downloading from an HTTP mirror, where downloads are generally prone to be intercepted to serve malicious images.

On a system with GnuPG installed, do this by downloading the PGP signature (under Checksums in the Download page) to the ISO directory, and verifying it with:

Alternatively, from an existing Arch Linux installation run:

Prepare an installation medium

The installation image can be supplied to the target machine via a USB flash drive, an optical disc or a network with PXE: follow the appropriate article to prepare yourself an installation medium from the chosen image.

Boot the live environment

1. Point the current boot device to the one which has the Arch Linux installation medium. Typically it is achieved by pressing a key during the POST phase, as indicated on the splash screen. Refer to your motherboard’s manual for details.
2. When the installation medium’s boot loader menu appears, select Arch Linux install medium and press Enter to enter the installation environment.

To switch to a different console—for example, to view this guide with Lynx alongside the installation—use the Alt+arrow shortcut. To edit configuration files, mcedit(1) , nano and vim are available. See packages.x86_64 for a list of the packages included in the installation medium.

Set the console keyboard layout

The default console keymap is US. Available layouts can be listed with:

To modify the layout, append a corresponding file name to loadkeys(1) , omitting path and file extension. For example, to set a German keyboard layout:

Console fonts are located in /usr/share/kbd/consolefonts/ and can likewise be set with setfont(8) .

Verify the boot mode

To verify the boot mode, list the efivars directory:

If the command shows the directory without error, then the system is booted in UEFI mode. If the directory does not exist, the system may be booted in BIOS (or CSM) mode. If the system did not boot in the mode you desired, refer to your motherboard’s manual.

Connect to the internet

To set up a network connection in the live environment, go through the following steps:

• Ensure your network interface is listed and enabled, for example with ip-link(8) :
• For wireless and WWAN, make sure the card is not blocked with rfkill.
• Connect to the network:
  • Ethernet—plug in the cable.
  • Wi-Fi—authenticate to the wireless network using iwctl.
  • Mobile broadband modem—connect to the mobile network with the mmcli utility.
• Configure your network connection:
  • DHCP: dynamic IP address and DNS server assignment (provided by systemd-networkd and systemd-resolved) should work out of the box for Ethernet, WLAN and WWAN network interfaces.
  • Static IP address: follow Network configuration#Static IP address.
• The connection may be verified with ping:

Update the system clock

Use timedatectl(1) to ensure the system clock is accurate:

To check the service status, use timedatectl status .

Partition the disks

When recognized by the live system, disks are assigned to a block device such as /dev/sda , /dev/nvme0n1 or /dev/mmcblk0 . To identify these devices, use lsblk or fdisk.

Results ending in rom , loop or airoot may be ignored.

The following partitions are required for a chosen device:

If you want to create any stacked block devices for LVM, system encryption or RAID, do it now.

Use fdisk or parted to modify partition tables. For example:

Example layouts

BIOS with MBR

Mount point	Partition	Partition type	Suggested size
[SWAP]	/dev/swap_partition	Linux swap	More than 512 MiB
/mnt	/dev/root_partition	Linux	Remainder of the device

UEFI with GPT

Mount point	Partition	Partition type	Suggested size
/mnt/boot or /mnt/efi 1	/dev/efi_system_partition	EFI system partition	At least 260 MiB
[SWAP]	/dev/swap_partition	Linux swap	More than 512 MiB
/mnt	/dev/root_partition	Linux x86-64 root (/)	Remainder of the device

1. /mnt/efi should only be considered if the used boot loader is capable of loading the kernel and initramfs images from the root volume. See the warning in Arch boot process#Boot loader.

Format the partitions

Once the partitions have been created, each newly created partition must be formatted with an appropriate file system. For example, to create an Ext4 file system on /dev/root_partition , run:

If you created a partition for swap, initialize it with mkswap(8) :

Mount the file systems

Mount the root volume to /mnt . For example, if the root volume is /dev/root_partition :

Create any remaining mount points (such as /mnt/efi ) using mkdir(1) and mount their corresponding volumes.

If you created a swap volume, enable it with swapon(8) :

genfstab(8) will later detect mounted file systems and swap space.

Installation

Select the mirrors

Packages to be installed must be downloaded from mirror servers, which are defined in /etc/pacman.d/mirrorlist . On the live system, after connecting to the internet, reflector updates the mirror list by choosing 20 most recently synchronized HTTPS mirrors and sorting them by download rate.[2]

The higher a mirror is placed in the list, the more priority it is given when downloading a package. You may want to inspect the file to see if it is satisfactory. If it is not, edit the file accordingly, and move the geographically closest mirrors to the top of the list, although other criteria should be taken into account.

This file will later be copied to the new system by pacstrap, so it is worth getting right.

Install essential packages

Use the pacstrap(8) script to install the base package, Linux kernel and firmware for common hardware:

The base package does not include all tools from the live installation, so installing other packages may be necessary for a fully functional base system. In particular, consider installing:

• userspace utilities for the management of file systems that will be used on the system,
• utilities for accessing RAID or LVM partitions,
• specific firmware for other devices not included in linux-firmware (e.g. sof-firmware for sound cards),
• software necessary for networking,
• a text editor,
• packages for accessing documentation in man and info pages: man-db , man-pages and texinfo .

To install other packages or package groups, append the names to the pacstrap command above (space separated) or use pacman while chrooted into the new system. For comparison, packages available in the live system can be found in packages.x86_64.

Configure the system

Fstab

Generate an fstab file (use -U or -L to define by UUID or labels, respectively):

Check the resulting /mnt/etc/fstab file, and edit it in case of errors.

Chroot

Change root into the new system:

Time zone

Run hwclock(8) to generate /etc/adjtime :

This command assumes the hardware clock is set to UTC. See System time#Time standard for details.

Localization

Edit /etc/locale.gen and uncomment en_US.UTF-8 UTF-8 and other needed locales. Generate the locales by running:

Network configuration

Add matching entries to hosts(5) :

If the system has a permanent IP address or a fully qualified domain name, see the example in Network configuration#Local hostname resolution.

Complete the network configuration for the newly installed environment, that may include installing suitable network management software.

Initramfs

Creating a new initramfs is usually not required, because mkinitcpio was run on installation of the kernel package with pacstrap.

For LVM, system encryption or RAID, modify mkinitcpio.conf(5) and recreate the initramfs image:

Root password

Boot loader

Choose and install a Linux-capable boot loader. If you have an Intel or AMD CPU, enable microcode updates in addition.

Reboot

Exit the chroot environment by typing exit or pressing Ctrl+d .

Optionally manually unmount all the partitions with umount -R /mnt : this allows noticing any «busy» partitions, and finding the cause with fuser(1) .

Finally, restart the machine by typing reboot : any partitions still mounted will be automatically unmounted by systemd. Remember to remove the installation medium and then login into the new system with the root account.

Post-installation

See General recommendations for system management directions and post-installation tutorials (like creating unprivileged user accounts, setting up a graphical user interface, sound or a touchpad).

For a list of applications that may be of interest, see List of applications.

Источник

Users and groups

Users and groups are used on GNU/Linux for access control—that is, to control access to the system’s files, directories, and peripherals. Linux offers relatively simple/coarse access control mechanisms by default. For more advanced options, see ACL, Capabilities and PAM#Configuration How-Tos.

Contents

Overview

A user is anyone who uses a computer. In this case, we are describing the names which represent those users. It may be Mary or Bill, and they may use the names Dragonlady or Pirate in place of their real name. All that matters is that the computer has a name for each account it creates, and it is this name by which a person gains access to use the computer. Some system services also run using restricted or privileged user accounts.

Managing users is done for the purpose of security by limiting access in certain specific ways. The superuser (root) has complete access to the operating system and its configuration; it is intended for administrative use only. Unprivileged users can use the su and sudo programs for controlled privilege elevation.

Any individual may have more than one account as long as they use a different name for each account they create. Further, there are some reserved names which may not be used such as «root».

Users may be grouped together into a «group», and users may be added to an existing group to utilize the privileged access it grants.

Permissions and ownership

The UNIX operating system crystallizes a couple of unifying ideas and concepts that shaped its design, user interface, culture and evolution. One of the most important of these is probably the mantra: «everything is a file,» widely regarded as one of the defining points of UNIX. This key design principle consists of providing a unified paradigm for accessing a wide range of input/output resources: documents, directories, hard-drives, CD-ROMs, modems, keyboards, printers, monitors, terminals and even some inter-process and network communications. The trick is to provide a common abstraction for all of these resources, each of which the UNIX fathers called a «file.» Since every «file» is exposed through the same API, you can use the same set of basic commands to read/write to a disk, keyboard, document or network device.

A fundamental and very powerful, consistent abstraction provided in UNIX and compatible operating systems is the file abstraction. Many OS services and device interfaces are implemented to provide a file or file system metaphor to applications. This enables new uses for, and greatly increases the power of, existing applications — simple tools designed with specific uses in mind can, with UNIX file abstractions, be used in novel ways. A simple tool, such as cat, designed to read one or more files and output the contents to standard output, can be used to read from I/O devices through special device files, typically found under the /dev directory. On many systems, audio recording and playback can be done simply with the commands, » cat /dev/audio > myfile » and » cat myfile > /dev/audio ,» respectively.

Every file on a GNU/Linux system is owned by a user and a group. In addition, there are three types of access permissions: read, write, and execute. Different access permissions can be applied to a file’s owning user, owning group, and others (those without ownership). One can determine a file’s owners and permissions by viewing the long listing format of the ls command:

The first column displays the file’s permissions (for example, the file initramfs-linux.img has permissions -rw-r—r— ). The third and fourth columns display the file’s owning user and group, respectively. In this example, all files are owned by the root user and the root group.

In this example, the sf_Shared directory is owned by the root user and the vboxsf group. It is also possible to determine a file’s owners and permissions using the stat command:

Access permissions are displayed in three groups of characters, representing the permissions of the owning user, owning group, and others, respectively. For example, the characters -rw-r—r— indicate that the file’s owner has read and write permission, but not execute ( rw- ), whilst users belonging to the owning group and other users have only read permission ( r— and r— ). Meanwhile, the characters drwxrwx— indicate that the file’s owner and users belonging to the owning group all have read, write, and execute permissions ( rwx and rwx ), whilst other users are denied access ( — ). The first character represents the file’s type.

List files owned by a user or group with the find utility:

A file’s owning user and group can be changed with the chown (change owner) command. A file’s access permissions can be changed with the chmod (change mode) command.

Shadow

The user, group and password management tools on Arch Linux come from the shadow package, which is a dependency of the base meta package.

File list

File	Purpose
/etc/shadow	Secure user account information
/etc/passwd	User account information
/etc/gshadow	Contains the shadowed information for group accounts
/etc/group	Defines the groups to which users belong

User management

To list users currently logged on the system, the who command can be used. To list all existing user accounts including their properties stored in the user database, run passwd -Sa as root. See passwd(1) for the description of the output format.

To add a new user, use the useradd command:

-m / —create-home the user’s home directory is created as /home/username . The directory is populated by the files in the skeleton directory. The created files are owned by the new user. -G / —groups a comma separated list of supplementary groups which the user is also a member of. The default is for the user to belong only to the initial group. -s / —shell a path to the user’s login shell. Ensure the chosen shell is installed if choosing something other than Bash.

If an initial login group is specified by name or number, it must refer to an already existing group. If not specified, the behaviour of useradd will depend on the USERGROUPS_ENAB variable contained in /etc/login.defs . The default behaviour ( USERGROUPS_ENAB yes ) is to create a group with the same name as the username.

When the login shell is intended to be non-functional, for example when the user account is created for a specific service, /usr/bin/nologin may be specified in place of a regular shell to politely refuse a login (see nologin(8) ).

See useradd(8) for other supported options.

Example adding a user

To add a new user named archie , creating its home directory and otherwise using all the defaults in terms of groups, folder names, shell used and various other parameters:

Although it is not required to protect the newly created user archie with a password, it is highly recommended to do so:

The above useradd command will also automatically create a group called archie and makes this the default group for the user archie . Making each user have their own group (with the group name same as the user name) is the preferred way to add users.

You could also make the default group something else using the -g option, but note that, in multi-user systems, using a single default group (e.g. users ) for every user is not recommended. The reason is that typically, the method for facilitating shared write access for specific groups of users is setting user umask value to 002 , which means that the default group will by default always have write access to any file you create. See also User Private Groups. If a user must be a member of a specific group specify that group as a supplementary group when creating the user.

In the recommended scenario, where the default group has the same name as the user name, all files are by default writeable only for the user who created them. To allow write access to a specific group, shared files/folders can be made writeable by default for everyone in this group and the owning group can be automatically fixed to the group which owns the parent directory by setting the setgid bit on this directory:

Otherwise the file creator’s default group (usually the same as the user name) is used.

If a GID change is required temporarily you can also use the newgrp command to change the user’s default GID to another GID at runtime. For example, after executing newgrp groupname files created by the user will be associated with the groupname GID, without requiring a re-login. To change back to the default GID, execute newgrp without a groupname.

Example adding a system user

System users can be used to run processes/daemons under a different user, protecting (e.g. with chown) files and/or directories and more examples of computer hardening.

With the following command a system user without shell access and without a home directory is created (optionally append the -U parameter to create a group with the same name as the user, and add the user to this group):

If the system user requires a specific user and group ID, specify them with the -u / —uid and -g / —gid options when creating the user:

Change a user’s login name or home directory

To change a user’s home directory:

The -m option also automatically creates the new directory and moves the content there.

Make sure there is no trailing / on /my/old/home .

To change a user’s login name:

Changing a username is safe and easy when done properly, just use the usermod command. If the user is associated to a group with the same name, you can rename this with the groupmod command.

Alternatively, the /etc/passwd file can be edited directly, see #User database for an introduction to its format.

Also keep in mind the following notes:

• If you are using sudo make sure you update your /etc/sudoers to reflect the new username(s) (via the visudo command as root).
• Personal crontabs need to be adjusted by renaming the user’s file in /var/spool/cron from the old to the new name, and then opening crontab -e to change any relevant paths and have it adjust the file permissions accordingly.
• Wine’s personal folders/files’ contents in

/.local/share/applications/wine/Programs and possibly more need to be manually renamed/edited.

Certain Thunderbird addons, like Enigmail, may need to be reinstalled.

Anything on your system (desktop shortcuts, shell scripts, etc.) that uses an absolute path to your home dir (i.e. /home/oldname ) will need to be changed to reflect your new name. To avoid these problems in shell scripts, simply use the

or $HOME variables for home directories.

Also do not forget to edit accordingly the configuration files in /etc/ that relies on your absolute path (e.g. Samba, CUPS, so on). A nice way to learn what files you need to update involves using the grep command this way: grep -r old_user *

Other examples of user management

To enter user information for the GECOS comment (e.g. the full user name), type:

(this way chfn runs in interactive mode).

Alternatively the GECOS comment can be set more liberally with:

To mark a user’s password as expired, requiring them to create a new password the first time they log in, type:

User accounts may be deleted with the userdel command:

The -r option specifies that the user’s home directory and mail spool should also be deleted.

To change the user’s login shell:

User database

Local user information is stored in the plain-text /etc/passwd file: each of its lines represents a user account, and has seven fields delimited by colons.

• account is the user name. This field can not be blank. Standard *NIX naming rules apply.
• password is the user password.

Broken down, this means: user jack , whose password is in /etc/shadow , whose UID is 1001 and whose primary group is 1003. Jack Smith is his full name and there is a comment associated to his account; his home directory is /home/jack and he is using Bash.

The pwck command can be used to verify the integrity of the user database. It can sort the user list by GID at the same time, which can be helpful for comparison:

Automatic integrity checks

Instead of running pwck / grpck manually, the systemd timer shadow.timer , which is part of, and is enabled by, installation of the shadow package, will start shadow.service daily. shadow.service will run pwck(8) and grpck(8) to verify the integrity of both password and group files.

If discrepancies are reported, group can be edited with the vigr(8) command and users with vipw(8) . This provides an extra margin of protection in that these commands lock the databases for editing. Note that the default text editor is vi, but an alternative editor will be used if the EDITOR environment variable is set, then that editor will be used instead.

Group management

/etc/group is the file that defines the groups on the system (see group(5) for details). There is also its companion gshadow which is rarely used. Its details are at gshadow(5) .

Display group membership with the groups command:

If user is omitted, the current user’s group names are displayed.

The id command provides additional detail, such as the user’s UID and associated GIDs:

To list all groups on the system:

Create new groups with the groupadd command:

Add users to a group with the gpasswd command (see FS#58262 regarding errors):

Alternatively, add a user to additional groups with usermod (replace additional_groups with a comma-separated list):

Modify an existing group with the groupmod command, e.g. to rename the old_group group to new_group :

To delete existing groups:

To remove users from a group:

The grpck command can be used to verify the integrity of the system’s group files.

Group list

This section explains the purpose of the essential groups from the filesystem package. There are many other groups, which will be created with correct GID when the relevant package is installed. See the main page for the software for details.

User groups

Non-root workstation/desktop users often need to be added to some of following groups to allow access to hardware peripherals and facilitate system administration:

Group	Affected files	Purpose
adm	Administration group, commonly used to give read access to protected logs. It has full read access to journal files.
ftp	/srv/ftp/	Access to files served by FTP servers.
games	/var/games	Access to some game software.
http	/srv/http/	Access to files served by HTTP servers.
log	Access to log files in /var/log/ created by syslog-ng.
rfkill	/dev/rfkill	Right to control wireless devices power state (used by rfkill).
sys	Right to administer printers in CUPS.
systemd-journal	/var/log/journal/*	Can be used to provide read-only access to the systemd logs, as an alternative to adm and wheel [1]. Otherwise, only user generated messages are displayed.
uucp	/dev/ttyS4+ , /dev/tts/9+ , /dev/ttyUSB1+ , /dev/ttyACM6+ , /dev/rfcomm6+	RS-232 serial ports and devices connected to them.
wheel	Administration group, commonly used to give privileges to perform administrative actions. It has full read access to journal files and the right to administer printers in CUPS. Can also be used to give access to the sudo and su utilities (neither uses it by default).

System groups

The following groups are used for system purposes, an assignment to users is only required for dedicated purposes:

Group	Affected files	Purpose
dbus	used internally by dbus
kmem	/dev/port , /dev/mem , /dev/kmem
locate	/usr/bin/locate , /var/lib/locate , /var/lib/mlocate , /var/lib/slocate	See Locate.
lp	/dev/lp7* , /dev/parport6*	Access to parallel port devices (printers and others).
mail	/usr/bin/mail
nobody	Unprivileged group.
proc	/proc/pid/	A group authorized to learn processes information otherwise prohibited by hidepid= mount option of the proc file system. The group must be explicitly set with the gid= mount option.
root	/*	Complete system administration and control (root, admin).
smmsp	sendmail group.
tty	/dev/tty , /dev/vcc , /dev/vc , /dev/ptmx
utmp	/run/utmp , /var/log/btmp , /var/log/wtmp

Pre-systemd groups

Before arch migrated to systemd, users had to be manually added to these groups in order to be able to access the corresponding devices. This way has been deprecated in favour of udev marking the devices with a uaccess tag and logind assigning the permissions to users dynamically via ACLs according to which session is currently active. Note that the session must not be broken for this to work (see General troubleshooting#Session permissions to check it).

There are some notable exceptions which require adding a user to some of these groups: for example if you want to allow users to access the device even when they are not logged in. However, note that adding users to the groups can even cause some functionality to break (for example, the audio group will break fast user switching and allows applications to block software mixing).

Group	Affected files	Purpose
audio	/dev/audio , /dev/snd/* , /dev/rtc0	Direct access to sound hardware, for all sessions. It is still required to make ALSA and OSS work in remote sessions, see ALSA#User privileges. Also used in JACK to give users realtime processing permissions.
disk	/dev/sd[a-zA-Z]*5*	Access to block devices not affected by other groups such as optical , floppy , and storage .
floppy	/dev/fd2*	Access to floppy drives.
input	/dev/input/event6* , /dev/input/mouse4*	Access to input devices. Introduced in systemd 215 [2].
kvm	/dev/kvm	Access to virtual machines using KVM.
optical	/dev/sr7 , /dev/sg2	Access to optical devices such as CD and DVD drives.
scanner	/var/lock/sane	Access to scanner hardware.
storage	/dev/st4*[lma]* , /dev/nst9*[lma]*	Used to gain access to removable drives such as USB hard drives, flash/jump drives, MP3 players; enables the user to mount storage devices.[3] Now solely for direct access to tapes if no custom udev rules is involved.[4][5][6][7]
video	/dev/fb/0 , /dev/misc/agpgart	Access to video capture devices, 2D/3D hardware acceleration, framebuffer (X can be used without belonging to this group).

Unused groups

The following groups are currently not used for any purpose:

Group	Affected files	Purpose
bin	none	Historical
daemon
lock	Used for lockfile access. Required by e.g. gnokii AUR .
mem
network	Unused by default. Can be used e.g. for granting access to NetworkManager (see NetworkManager#Set up PolicyKit permissions).
power
uuidd
users	The primary group for users when user private groups are not used (generally not recommended), e.g. when creating users with USERGROUPS_ENAB no in /etc/login.defs or the -N / —no-user-group option of useradd.

Other tools related to these databases

This article or section is a candidate for merging with #Shadow.

The factual accuracy of this article or section is disputed.

getent(1) can be used to read a particular record.

As warned in #User database, using specific utilities such as passwd and chfn , is a better way to change the databases. Nevertheless, there are times when editing them directly is looked after. For those times, vipw , vigr are provided. It is strongly recommended to use these tailored editors over using a general text editor as they lock the databases against concurrent editing. They also help prevent invalid entries and/or syntax errors. Note that Arch Linux prefers usage of specific tools, such as chage, for modifying the shadow database over using vipw -s and vigr -s from util-linux . See also FS#31414.

Источник