I'm playing with a rather old, heavily customized Linux installation (based on Debian etch, running on a Netgear ReadyNAS device).

Recently I've switched from /etc/passwd to /etc/shadow via pwconv.

Now I'd like to switch back due to authentication problems with the Apache server, because mod_auth_shadow is not installed and I'm hesitant to install it.

As an additional complication: pwunconv does not exist either.

I have a backup, but it's old and I have been installing a lot of packages since it was taken. I also have the option of doing a factory reset, but that will mean I lose the RAID configuration which I do not want.

What steps would I need to take to go back to regular passwd-based password authentication rather than shadow passwords?

  • Have a look in /etc/pam and friends. Chances are there's a call to the shadow password authentication module there that might need to be replaced.
    – user
    Nov 11, 2013 at 10:02
  • Are we to assume that you don't have a useful backup to restore from, or are you just wondering which files to restore?
    – user
    Nov 11, 2013 at 10:02
  • 1
    @Michael I do have a backup, albeit an older one, made at the time before I started installing all kinds of libs and packages. There also is the option of factory-resetting the box, but that's scary because I would lose the RAID. I prefer poking the right files, but currently I lack the necessary understanding.
    – Tomalak
    Nov 11, 2013 at 10:18

2 Answers 2


The pwconv command automagically backups the /etc/passwd in a file called /etc/passwd-.

Try to restore this file and rename /etc/shadow to /etc/shadow-.

  • You mean passwd and passwd-? Yes, that file exists. But how do I configure the system to stop using shadow?
    – Tomalak
    Nov 11, 2013 at 9:11
  • 2
    @Tomalak, remove or rename it. Nov 11, 2013 at 13:04
  • Okay, sounds reasonable enough, I just wanted a confirmation. I'll try and report back.
    – Tomalak
    Nov 11, 2013 at 13:20
  • I've renamed /etc/shadow to /etc/shadow_ and /etc/passwd- to /etc/passwd. So far this had no ill-effects, I can still log in normally. (Apache still does not let me in though, apparently that's a disconnected problem.)
    – Tomalak
    Nov 13, 2013 at 7:28

Instead of going back manually you could try if you have the apache PAM authentication module available "libapache2-mod-auth-pam" as a distribution supported package.

I have no test boxes that old but the pam_unix module supports both shadow and regular passwd, so I would think that merging the encrypted passwords back into your etc/passwd file and renaming the /etc/shadow* files should be sufficient. You may need to add the option broken_shadow to pam configuration files in /etc/pam.d/* referencing the pam_unix module.

  • Yes, I've tried installing that module (apt-get), but for some reason it wouldn't install. I did not want to break apache by meddling with it unless I also had a way to back out. I'll try merging/renaming as soon as I understand what makes the system use shadow in the first place.
    – Tomalak
    Nov 11, 2013 at 10:13
  • It's a single user system anyway, so having all stuff in /etc/passwd is not a real drawback. I'm also hesitant of changing stuff in /etc/pam.d for fear shutting myself out of the system. I have set up ssh with public key authentication, is there a chance that changing pam_unix options breaks this?
    – Tomalak
    Nov 11, 2013 at 10:14
  • Changing pam settings typically doesn't break existing sessions...
    – HBruijn
    Nov 11, 2013 at 10:20
  • Now that I know I can easily switch between shadow and passwd I can try to make authentication work in apache.
    – Tomalak
    Nov 13, 2013 at 7:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .