What are the locations of the files that store the list of available users?

I know that list of users is present in the /etc/passwd file, but are there any other files that have usernames stored in them?

Anonymization of the file system is the intended purpose.


The list of services that can supply user credentials is in nsswitch.conf:

grep passwd /etc/nsswitch.conf

for example

passwd:         files systemd sss

These services correspond to:

  • files: /etc/passwd
  • sss: The sssd daemon which pulls credentials from Active Directory, LDAP, IPA, Kerberos, possibly others
  • systemd: Database driven credentials in /etc/userdb/ instead of traditional flat files

Other services may be possible.

For anonymization rather than credentials, you need to check the above for credentials, and then check the whole system for files owned by any user with a uid >=1000 (or 500 on older systems or 100 on really older systems). This should catch most user data directories, but especially check /home and things like /var/mail and /var/spool/cron but really all of /var/spool/ in general.

Also, you need to check /var for cached credentials.

You may want to carefully purge log files in /var/log which could contain user activity logs.


In addition to /etc/passwd and /var/lib/AccountsService/users/ you and @UnKNOWn already mentioned usernames are stored in the following (but not limited to) files:

/etc/shadow
/etc/gshadow
/etc/gshadow-
/etc/group
/etc/group-
/etc/subgid