This is why cfengine wiped out all the passwd files.

        passwd_file = open(filename, 'w')
        if not options.pretend:
            passwd_file.write(passwd)
            logging.info("Wrote %s to disk." % filename)
        else:
            logging.info("Would have wrote %s to disk." % filename)
        passwd_file.close()