Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am noticing a lot of weird files appearing in my router and on my various filesystems. Files in weird places or files that have to do with security with a - sign after them.

If I do ls -l /etc/shadow*, this is what I see.

-rw-r----- 1 root shadow 1163 Aug  9 15:48 shadow
-rw------- 1 root root   1163 Aug  8 21:11 shadow-

Does that look normal? What is the 2nd shadow file used for?

share|improve this question
up vote 10 down vote accepted

These files are perfectly normal.

From the shadow(5) manual page:

Backup file for /etc/shadow.

You may similarly see /etc/passwd-, /etc/group- and /etc/gshadow-.

These backup files are created all the tools in the Linux user database utility suite (shadow): both interactive tools such as vipw and automated tools such as passwd, useradd, etc. They let you easily revert the last change to the user database.

share|improve this answer
But I didn't use vipw, and no one else is supposed to know the root password but me. So isn't this suspicious? – PROXY NINJA Aug 11 '12 at 5:36
@awakeFromNib Diff them - see if you recognize the change. Apparently some of the other account modification tools do it too. – Random832 Aug 11 '12 at 5:43
@awakeFromNib It would be surprising not to see this file, unless you manually removed it recently. It would mean you never ever added or removed an account or changed a password since your initial system installation. Installing some packages that provide daemons creates a user to run the daemon, so this file can be created even if you didn't directly manipulate accounts. – Gilles Aug 11 '12 at 12:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.