-1

What is the major difference between /etc/shadow and /etc/passwd

In /etc/shadow we have the same data as in /etc/passwd.

closed as off-topic by dr01, msp9011, Jeff Schaller, Thomas, jimmij Aug 7 '18 at 19:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Requests for learning materials (tutorials, how-tos etc.) are off topic. The only exception is questions about where to find official documentation (e.g. POSIX specifications). See the Help Center and our Community Meta for more information." – dr01, msp9011, Thomas, jimmij
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I can't comment but you can find informations there : askubuntu.com/questions/445361/… – Romain Aug 7 '18 at 9:39
  • This question is predicated upon two false premises. First: We don't necessarily have /etc/shadow in the first place, although some of us might have an /etc/spwd.db. Second: They do not have the same data. – JdeBP Aug 7 '18 at 13:37
  • 1
    There is no request for learning materials in this question, as three people have so far flagged it. That is an abuse of that closure reason. – JdeBP Aug 7 '18 at 13:39
2

Historically /etc/passwd had all of the user data, there was no shadow. However it was discovered that a dictionary attack could be done on the file, to discover passwords (if they are in the dictionary).

Therefore it was decided to remove the passwords from /etc/passwd, the rest of the file remained, as it was used my many programs e.g. ls. The passwords were moved to /etc/shadow, and this file was made so that only root can read it.

/etc/passwd now has an x for the password field. /etc/shadow only shares the first field (the key-field / the user name). /etc/shadow has been expanded to contain other password management fields.

2

The existence of the two files is a consequence of that /etc/passwd is a text file that can be read by other applications (as finger, ident or ls for example), so an attacker could gain access to the information of the file that included the hashed password.

To increase security, the hashed password that used to be in the file was moved to other file called /etc/shadow that is accessible only by root

1

The major difference is that they contain different pieces of data.

passwd contains the users' public information (UID, full name, home directory), while shadow contains the hashed password and the password expiry data. The reasons for the division are partly historical.

See the man pages: passwd(1) and shadow(1)

Not the answer you're looking for? Browse other questions tagged or ask your own question.