What are the locations of the files that store the list of available users?
I know that list of users is present in the /etc/passwd
file, but are there any other files that have usernames stored in them?
Anonymization of the file system is the intended purpose.
The list of services that can supply user credentials is in nsswitch.conf:
grep passwd /etc/nsswitch.conf
for example
passwd: files systemd sss
These services correspond to:
-
files
: /etc/passwd -
sss
: The sssd daemon which pulls credentials from Active Directory, LDAP, IPA, Kerberos, possibly others -
systemd
: Database driven credentials in /etc/userdb/ instead of traditional flat files
Other services may be possible.
For anonymization rather than credentials, you need to check the above for credentials, and then check the whole system for files owned by any user with a uid >=1000 (or 500 on older systems or 100 on really older systems). This should catch most user data directories, but especially check /home
and things like /var/mail
and /var/spool/cron
but really all of /var/spool/
in general.
Also, you need to check /var for cached credentials.
You may want to carefully purge log files in /var/log which could contain user activity logs.
In addition to /etc/passwd
and /var/lib/AccountsService/users/
you and @UnKNOWn already mentioned usernames are stored in the following (but not limited to) files:
/etc/shadow
/etc/gshadow
/etc/gshadow-
/etc/group
/etc/group-
/etc/subgid