Validating ownership against /etc/passwd and /etc/group

Looking for ideas for how to validate ownerships against /etc/passwd and /etc/group.

I had to rebuild a server and then restore selected files from backups. All went well.

Except I noticed the /etc/passwd and /etc/group files no longer match the other similar servers or the same files from backups. Makes some sense because the rebuild was performed with a more recent ISO of the system.

For example:

Old /etc/passwd:
sshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin

New /etc/passwd:
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin

Because of the selective backups, I want to validate that the ownerships of all restored files match the newer /etc/passwd|group files. I could restore those same files from backups, but I don't know what will break.

I am not noticing anything in the logs, but I would be more comfortable with some kind of validation.

Thanks again.

Selectively update the contents of /etc/passwd, /etc/shadow and /etc/group from the backups to the new server.

That is, make the passwd, shadow and group files match...don't try to tweak the files themselves.

I typically do that as early in the build as possible.

That is, make the passwd, shadow and group files match...don't try to tweak the files themselves.

Hmm. I'm feeling a bit dense and am not followwing you.

Originally Posted by upnort Hmm. I'm feeling a bit dense and am not followwing you.

You set up new server, user sshd is UID 106, was UID 105 in backup data.
Change UID to 105 in /etc/passwd on the new server to match the backup data.
Repeat for all non-matching UIDs on new server.

OK.

My focus though is discovering whether there are any files/directories created from within the new install that are using the new UIDs/GIDs. I suppose I could run 'find / -user $NewUID', 'find / -group $NewGID', etc. That way I would know what files/directories are affected before restoring the old UIDs/GIDs.

Perhaps also the reverse -- using the old UIDs/GIDs. Then there is discovering any files/directories that are not using the installed or backed up UIDs/GIDs. I was hoping for some kind of automated method, but I can manually run one command at a time. Time consuming but doable.

If this is an rpm based system, see https://linux.die.net/man/8/rpm (rpm -V) & https://www.cyberciti.biz/tips/reset...ermission.html