`/etc`

Overview

/etc is the home of system-wide configuration on Linux. If you want to change how the system or its services behave, the answer is almost always a file in /etc. This lesson explains what /etc contains and why it is central to administration and security.

Learning objectives

• Describe the purpose of /etc.
• Identify important configuration files that live there.
• Explain why /etc is security-sensitive.

Core concept

/etc holds text-based configuration files for the system and its installed services — settings that apply system-wide rather than to a single user. Because these are plain text, they can be read and edited with ordinary tools. Notable examples:

• /etc/passwd — user account information (not passwords themselves in modern systems).
• /etc/shadow — hashed user passwords (readable only by root).
• /etc/hosts — static hostname-to-IP mappings.
• /etc/ssh/sshd_config — SSH server configuration.
• /etc/fstab — filesystem mount definitions.

How it works

Services and the system read their settings from /etc at startup (and often on reload). Editing the relevant file and restarting or reloading the service applies the change. Because these files govern authentication, networking, and service behavior for everyone on the system, most require root privileges to modify, and some (like /etc/shadow) are readable only by root to protect their contents.

Practical example

To see configured static host mappings you might read /etc/hosts; to review who can log in, /etc/passwd lists accounts. Hardening an SSH server means editing /etc/ssh/sshd_config (e.g. to disable root login) and reloading the SSH service. Each change is a text edit to a file under /etc, applied by the relevant service.

Cybersecurity relevance

/etc is a prime focus in both hardening and assessment. Configuration files reveal how a system authenticates users, what services run, and how they are secured — making /etc a first stop for enumeration and for spotting misconfigurations. Files like /etc/shadow (password hashes) and /etc/ssh/sshd_config (remote access policy) are high-value and must have correct permissions; weak settings here are common, serious findings.

Common mistakes

• Thinking /etc/passwd stores passwords — hashes live in /etc/shadow (root-only), not /etc/passwd.
• Editing /etc files without privileges or backups, risking broken services.
• Overlooking /etc during enumeration/hardening, where key security settings reside.

Key takeaways

• /etc stores system-wide, text-based configuration for the OS and services.
• Key files include /etc/passwd (accounts), /etc/shadow (root-only password hashes), /etc/hosts, /etc/ssh/sshd_config, and /etc/fstab.
• /etc governs authentication, networking, and services for all users, so it is privilege-protected and central to hardening and assessment.

Check your understanding

• Where are hashed passwords actually stored, and how does that differ from /etc/passwd?
• Why is /etc typically the first place to look when hardening or enumerating a Linux system?