I'm playing with a rather old, heavily customized Linux installation (based on Debian etch, running on a Netgear ReadyNAS device).

Recently I've switched from /etc/passwd to /etc/shadow via pwconv.

Now I'd like to switch back due to authentication problems with the Apache server, because mod_auth_shadow is not installed and I'm hesitant to install it.

As an additional complication: pwunconv does not exist either.

I have a backup, but it's old and I have been installing a lot of packages since it was taken. I also have the option of doing a factory reset, but that will mean I lose the RAID configuration which I do not want.

What steps would I need to take to go back to regular passwd-based password authentication rather than shadow passwords?

  • Have a look in /etc/pam and friends. Chances are there's a call to the shadow password authentication module there that might need to be replaced.
    – user
    Nov 11 '13 at 10:02
  • Are we to assume that you don't have a useful backup to restore from, or are you just wondering which files to restore?
    – user
    Nov 11 '13 at 10:02
  • 1
    @Michael I do have a backup, albeit an older one, made at the time before I started installing all kinds of libs and packages. There also is the option of factory-resetting the box, but that's scary because I would lose the RAID. I prefer poking the right files, but currently I lack the necessary understanding.
    – Tomalak
    Nov 11 '13 at 10:18

The pwconv command automagically backups the /etc/passwd in a file called /etc/passwd-.

Try to restore this file and rename /etc/shadow to /etc/shadow-.

  • You mean passwd and passwd-? Yes, that file exists. But how do I configure the system to stop using shadow?
    – Tomalak
    Nov 11 '13 at 9:11
  • 2
    @Tomalak, remove or rename it. Nov 11 '13 at 13:04
  • Okay, sounds reasonable enough, I just wanted a confirmation. I'll try and report back.
    – Tomalak
    Nov 11 '13 at 13:20
  • I've renamed /etc/shadow to /etc/shadow_ and /etc/passwd- to /etc/passwd. So far this had no ill-effects, I can still log in normally. (Apache still does not let me in though, apparently that's a disconnected problem.)
    – Tomalak
    Nov 13 '13 at 7:28

Instead of going back manually you could try if you have the apache PAM authentication module available "libapache2-mod-auth-pam" as a distribution supported package.

I have no test boxes that old but the pam_unix module supports both shadow and regular passwd, so I would think that merging the encrypted passwords back into your etc/passwd file and renaming the /etc/shadow* files should be sufficient. You may need to add the option broken_shadow to pam configuration files in /etc/pam.d/* referencing the pam_unix module.

  • Yes, I've tried installing that module (apt-get), but for some reason it wouldn't install. I did not want to break apache by meddling with it unless I also had a way to back out. I'll try merging/renaming as soon as I understand what makes the system use shadow in the first place.
    – Tomalak
    Nov 11 '13 at 10:13
  • It's a single user system anyway, so having all stuff in /etc/passwd is not a real drawback. I'm also hesitant of changing stuff in /etc/pam.d for fear shutting myself out of the system. I have set up ssh with public key authentication, is there a chance that changing pam_unix options breaks this?
    – Tomalak
    Nov 11 '13 at 10:14
  • Changing pam settings typically doesn't break existing sessions...
    – HBruijn
    Nov 11 '13 at 10:20
  • Now that I know I can easily switch between shadow and passwd I can try to make authentication work in apache.
    – Tomalak
    Nov 13 '13 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.