PWACCESSD(8)

✨ PWACCESSD(8) ✨

okay bestie, sit down, grab a strawberry 🍓, because today we're talking about pwaccessd — that's the manual section 8 girlies, system administration territory, so put your big-girl sudo hat on. She comes with two friends too: pwaccessd.service and pwaccessd.socket, and together the three of them manage passwd and shadow information. no cap. 💅

---

🦋 SYNOPSIS 🦋

pwaccessd.service

pwaccessd.socket

/usr/libexec/pwaccessd [OPTIONS]

---

🌸 DESCRIPTION 🌸

so pwaccessd is a systemd(1) socket-activated service that hands out account info in struct passwd and struct shadow format. she's literally the friend who knows everyone's business (in the most responsible way possible). she can check if a password or an account has expired, and she verifies passwords too. main character energy fr fr. ✨

here's the tea on who gets to see what, and it matters: by default, normal users only have access to their own passwd and shadow entries. the root user gets access to all accounts, no questions asked, that's just the rules. and if you want to give specific users extended access? you can, via configuration. iykyk. 🎀

---

💅 OPTIONS 💅

• -s, --socket — activation through socket. this is the standard mode when you're running under systemd, so if you're in the systemd girlie ecosystem, this is your default vibe.
• -d, --debug — enable debug mode. turn this on when you want all the receipts. 👀
• -v, --verbose — enable verbose logging. she'll talk more. we love a chatty queen.
• -?, --help — give the help list. she'll tell you what's up.
• --version — print program version. classic.

---

🧚 VARLINK INTERFACES 🧚

the pwaccessd daemon exposes all of this functionality through Varlink interfaces, so here's the menu, bestie:

• GetAccountName — provides the user name corresponding to a given UID. you give her a UID, she gives you a name. iconic.
• GetUserRecord — provides the passwd and shadow entry for a given UID or account name. yes, both. she's thorough. 💖
• GetGroupRecord — provides the group entry for a given GID or group name. groups get love too.
• VerifyPassword — validates a password for a specific user. the bouncer at the club. 🫶
• ExpiredCheck — checks if a user account or password is expired. she will absolutely tell you if your account is giving expired milk energy. 💀

---

🌈 CONFIGURATION 🌈

pwaccessd reads her configuration from pwaccessd.conf. she follows the UAPI Configuration Files Specification, which basically means she goes shopping for config files in directories like /usr/share/account-utils/, /run/account-utils/, and /etc/account-utils/. and listen — files in /etc/account-utils/ take precedence. that's the VIP section, okay? 👑

the config format is INI-style. the primary configuration key is allow, and this key accepts a list of user accounts that are allowed to read all passwd and shadow entries — in addition to root, obviously. root was always invited.

the allow key can be defined within specific sections (groups) that correspond to the Varlink interface methods:

• [GetUserRecord]
• [VerifyPassword]
• [ExpiredCheck]

and if the key isn't found in the specific section? she doesn't panic. pwaccessd falls back to looking in the [global] section. flexible queen. 🦋

⭐ Example 1. Example pwaccessd.conf

[global]
# Allow user 'admin' to perform all actions
allow = admin

[VerifyPassword]
# Allow 'auth-service' to verify passwords, overriding global
allow = auth-service

---

🎀 FILES 🎀

• /usr/libexec/pwaccessd — the daemon binary. that's her, that's the girl.
• /etc/account-utils/pwaccessd.conf — the main configuration file. where you write down the rules.

---

🔥 SEE ALSO 🔥

systemd(1), expiry(1), passwd(1), passwd(5), shadow(5), pam_unix_ng(8)

---

and that's the whole page, bestie! this gorgeous piece of documentation is brought to you by account-utils 1.4.0, dated 07/17/2026 — so go forth, manage those passwd and shadow entries, and remember: you're lowkey a systems administrator now. slay. 💖✨🦋