So I'm migrating from FreeBSD 5.2.1 to Debian (Lenny). I think I can handle the conversion of the data itself with a simple script by replacing everything after the password hash with :13872:0:99999:7:::

However, I'm unsure of how Debian uses its files. It has:

passwd
passwd-
shadow
shadow-
group
group-
gshadow
gshadow-

What are those files with the - at the end for? What's the best/proper way to manually edit these files and lock the changes in (if any such step is needed)?

I'd already manually edited the passwd file while installing sendmail and the system seems to be using that file (while the passwd- file has an extra entry in it that I had deleted). Apparently that was a mistake as the two files mismatch now (though it hasn't caused any obvious problems yet).

Ok, I think I figured it out myself. That's what I got for going to the forum before fiddling around. Confirmation is still good though. Maybe someone else can benefit in the future. It looks like the "dash" files are created by the vipw editor by moving the old passwd file into passwd- before writing any changes (etc.)

To finish moving the accounts, I will need to do what I said to master.passwd above to convert it to a shadow file, but I'll also need to replace the * with x in the passwd file (where the password hash goes if a shadow file isn't used) and change all of the shell scripts which are in a different location on the BSD machine. I tested this with one account where I know the password and it works fine once I replaced * with x.

Thanks for being sounding board LQ. Makes me feel more confident to figure things out myself