manage passwd file via pillar (no defaults)