Understanding the /etc/shadow file is fundamental for anyone managing user authentication on a Unix or Linux system. This critical file stores the cryptographically hashed passwords for user accounts, acting as the final gatekeeper against unauthorized access. Its structure and security are paramount, as a compromise here can render every user account vulnerable to offline password cracking attacks.
What is the /etc/shadow File?
The /etc/shadow file is a text-based database that exists exclusively to securely store user password information. It was created as a direct response to the security weaknesses of its predecessor, the /etc/passwd file. In the early days of Unix, user account details, including passwords in a reversible format, were stored in the world-readable /etc/passwd file. This design was a significant security risk, as it allowed any user on the system to attempt to crack the passwords using brute-force methods. To mitigate this, the shadow password suite was developed, separating the user account information (stored in /etc/passwd) from the highly sensitive encrypted passwords (stored in /etc/shadow).
File Permissions and Security
The security of the shadow file is enforced at the filesystem level through strict file permissions. On a properly configured system, the /etc/shadow file is readable only by the root user. Regular user accounts and even standard system accounts have no read or write access to this file. This isolation is the primary mechanism that protects password hashes from being harvested by unauthorized users. If a regular user can read the contents of /etc/shadow, it indicates a severe misconfiguration that requires immediate administrative attention. The typical permissions for the file are 640 or 600 , owned by the root user and associated with the shadow group.
File Format and Structure
Each line in the /etc/shadow file corresponds to a single user account and is composed of nine distinct fields, separated by colons ( : ). This rigid structure allows system utilities to parse and manage password data predictably. The fields are as follows:
