I created a hard link for the shadow file. For removing the passwd of the user I opened the shadow file in vi editor and removed the encrypted passwd and then saved. The inode value of the shadow file was changed. Then I updated the passwd of the user and again the inode value of the shadow file changed. Why the inode of the shadow file changes when it is edited/updated?


The usual implementation of password changing involves hardlinking /etc/shadow to /etc/stmp (or some similar name; link() being atomic on local filesystems, this constitutes a kind of lock file mechanism), writing out a new one to a temporary file, then renaming the original /etc/shadow to /etc/shadow- or similar and renaming the temporary to /etc/shadow. This is done for robustness: at all times the original shadow file, unmodified, still exists and can be recovered easily even if the power fails at just the wrong time or something equally bad (unless it destroys the entire disk).

  • On my Fedora system, which uses the passwd package, it creates /etc/.pwd.lock as the lock file, writes the new contents to /etc/nshadow, and then renames the files. And with shadow-utils, it seems the lock file would be /etc/passwd.lock and write the temporary file to /etc/shadow+, but the idea is the same. – Mikel Apr 11 '12 at 2:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.