If you wish this to be easily scalable, use the tools the system supports or go with a real database.

In many server setups, the users are not listed in /etc/passwd or /etc/shadow at all. It is even more common for a user who doesn't have shell access to not have a home directory either.

Your system's getpwnam(), which Perl will call when you use the Perl function by the same name, knows how to get the info about your users whether you use /etc/passwd, an LDAP server, PAM through an SQL server backend, etc. If you don't want to use the system call, then store your user data in a real database -- or at least in a DBD::SQLite, DBD:CSV, or DBD::RAM database -- for future scalability and ease of changing the backend.

One advantage of using a DBI midend for this is that you can change from a plain file to MySQL, PostgreSQL, DBD:LDAP, Oracle, Sybase, etc. with little or no change to the code. One advantage to using getpwnam() is that you can change your system from using password files to using LDAP to using whatever other authentication backend your system supports with little or no change to the code.

Christopher E. Stith
use coffee;