In any linux system I have access to (a couple of Archlinuxes, an Ubuntu, a Debian Sid and a Gentoo) there are the following 4 files in
/etc/, all ending with a dash:
/etc/group- /etc/gshadow- /etc/passwd- /etc/shadow-
On the internet they say that these are just backup files, updated to the next to last change.
Now I'm wondering: who's creating those files? Is it my editor? Is it the application editing those files (gpasswd, useradd, groupadd and so on)? Is it something at a lower level (maybe even a kernel module)?