3

I would like to know how the password verification in Linux works.

I know that the passwords are stored as a hash in /etc/shadow file and user information is in /etc/passwd file. My understanding is this:

  1. Selecting what user you want to login as decides what user name the system should check.
  2. When you enter the password and hit enter, the system goes to the /etc/shadow file and finds the line corresponding to the user name.
  3. From step 2 it gets the hash of the actual password. It then generates the hash of the entered password and compares both of them. If a match is found, voilà. Else, error message.

Is my understanding correct?

  • Linux in a kernel found on many very different operating systems, it doesn't deal with user passwords. Please specify the Linux-based operating system you're talking about (Debian, Android, ChromeOS, Fedora, OpenWRT...). Only some systems (and only in some deployments) use /etc/passwd,shadow to store user information – Stéphane Chazelas Aug 5 '14 at 16:33
  • It's often the PAM security module. – HalosGhost Aug 5 '14 at 17:24
4

Yes. You're correct. Each steps can be split in minor tasks as well, but you describe the overall algorithm.

Follow a couple of articles describing in details the login process. [1] [2]

Note that this is only about the plain password, not mentioning PAM system. [3]

  • and which script does this verification? The name of the script I mean :) – Little Child Aug 5 '14 at 15:40
  • @LittleChild I doubt it's a script. It's an application which provides login prompt /sbin/mingetty or /sbin/agetty mostly. – UVV Aug 5 '14 at 15:51
  • 1
    @UVV No, not getty. Getty is basically a loop running forever on a terminal. For each login prompt, getty runs login, and that's the program that performs the authentication (for a text mode console login). – Gilles Aug 5 '14 at 22:35
  • @Gilles Thanks for the correction. It's not a script anyway ;) – UVV Aug 6 '14 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.