I would like to know how the password verification in Linux works.
I know that the passwords are stored as a hash in
/etc/shadow file and user information is in
/etc/passwd file. My understanding is this:
- Selecting what user you want to login as decides what user name the system should check.
- When you enter the password and hit enter, the system goes to the
/etc/shadowfile and finds the line corresponding to the user name.
- From step 2 it gets the hash of the actual password. It then generates the hash of the entered password and compares both of them. If a match is found, voilà. Else, error message.
Is my understanding correct?