How do you read the output of ls -l /etc/passwd, for example -rw-r--r-- 1 root root 1820 … /etc/passwd?

The first character is the file type, the next nine are the rwx triplets for user, group and others, then come the link count, owner, group, size, date and name.

* One file-type character, then three rwx triplets; each triplet is one octal digit. *

Reading -rw-r--r-- 1 root root 1820 …:

1. - is the file type: - a regular file, d a directory, l a symbolic link (others: c/b devices, s socket, p named pipe).
2. rw- is the owner's rights: read and write.
3. r-- is the group's rights: read only.
4. r-- is what others get: read only.
5. 1 is the number of hard links, root root the owner and group, 1820 the size in bytes, then the modification time and the name.

A - in a permission position means that right is not set. This form is the symbolic notation. The same rights in octal are 644.

So /etc/passwd is a regular file that only root can change and that every user can read. That is intended: programs need to turn UIDs into names for everyone.

Go deeper:

• man7.org: ls(1) — the long listing format and all file-type letters.