Configuration files are often Berkeley DB

Unix has always had non‐text databases, since the days of Ken Thompson writing dbm for 7th Edition AT&T Unix. The Berkeley DB system only exists because BSD people couldn't re‐distribute the Unix DBM system under their new open BSD copyright licence.

The GNU world actually has GDBM for much the same reason, but the idea of speeding up access to frequently used system data by using an actual indexed binary database system never really took off in the GNU world. There's a libnss_db module for NSS, but it's a rarely used (or even installed) optional extra rather than a base part of the operating system as on the BSDs.

The Berkeley DB simple database system came from BSD, and (to use a colourful computing metaphor) BSD has eaten its own dogfood. A lot of what on other systems, and indeed on Unix before BSD, were configuration files with lines of text; are actual binary database files on BSD. This makes them a lot faster to look things up in.

So in many cases if you have edited a system or a per‐user configuration file, that is human‐readable text, you have to do an extra step to turn it into the fast Berkeley DB file that the system expects and actually uses.

Capabilities files

Some configuration files are structured like the termcap file was: as a list of (sometimes multiple‐line) records comprising individual capabilities. These need to be turned into a Berkeley DB file using the cap_mkdb command.

The most obvious example of such a file is the old /etc/termcap file itself, which is turned into /etc/termcap.db, but this has not been a good example for decades, since every BSD apart from FreeBSD has dropped the termcap system in favour of terminfo. But other capability‐based configuration files include /etc/login.conf and ~/.login_conf.

Accounts database files

The user account database, which is searched quite a lot in the normal course of running a Unix or Unix‐like system, is actually two Berkeley DB files. The /etc/passwd file is not intended to be used and really is just for show, or for very old programs indeed, given that the library functions for reading the user account database date back to 7th Edition AT&T Unix. The system administrator modifies /etc/master.passwd and that gets turned into Berkeley DB files for everything to use.

/etc/pwd.db is world‐readable and does not contain sensitive data about accounts, and /etc/spwd.db is readable only by the superuser and contains sensitive things like hashed passwords. Whenever you manually update /etc/master.passwd you need to re‐build these with the pwd_mkdb command. Operating system tools like NetBSD's useradd or FreeBSD's pw useradd do this automatically. So does vipw, an older tool that dates from the times when there was just the single BSD.

Further reading

And of course always look in the manual:

© Copyright 2026 Jonathan de Boyne Pollard. "Moral" rights asserted.
Permission is hereby granted to copy and to distribute this web page in its original, unmodified form as long as its last modification datestamp is preserved.