I created a hard link for the shadow file. For removing the passwd of the user I opened the shadow file in vi editor and removed the encrypted passwd and then saved. The inode value of the shadow file was changed. Then I updated the passwd of the user and again the inode value of the shadow file changed. Why the inode of the shadow file changes when it is edited/updated?
The usual implementation of password changing involves hardlinking /etc/shadow to /etc/stmp (or some similar name; link() being atomic on local filesystems, this constitutes a kind of lock file mechanism), writing out a new one to a temporary file, then renaming the original /etc/shadow to /etc/shadow- or similar and renaming the temporary to /etc/shadow. This is done for robustness: at all times the original shadow file, unmodified, still exists and can be recovered easily even if the power fails at just the wrong time or something equally bad (unless it destroys the entire disk).
-
On my Fedora system, which uses the
passwdpackage, it creates/etc/.pwd.lockas the lock file, writes the new contents to/etc/nshadow, and then renames the files. And withshadow-utils, it seems the lock file would be/etc/passwd.lockand write the temporary file to/etc/shadow+, but the idea is the same. – Mikel Apr 11 '12 at 2:42
shadow? – Ignacio Vazquez-Abrams Apr 10 '12 at 19:00