I saw some abnormal thing after changing root password in linux. When I typed ls -al /etc/ | grep shadow after changing root password, the result is as below.

-r--------  1 root root   653 Mar  9  2018 gshadow
-r--------  1 root root   800 Jul 25 06:43 shadow
-r--------  1 root root   796 Jul 25 06:43 shadow-

But sometimes the result is different with the above.

-r--------  1 root root   653 Mar  9  2018 gshadow
-r--------  1 root root   ?   Jul 25 06:43 nshadow
-r--------  1 root root   ?   Jul 25 06:43 shadow
-r--------  1 root root   ?   Jul 25 06:43 shadow-

I'm just showing an example and don't remember exact size of those files (nshadow, shadow, shadow-).

As my research, the /etc/nshadow is written by passwd when changing password, and then passwd just renames /etc/nshadow to /etc/shadow. But I don't know it is correct.

Anyway, what is the /etc/nshadow?? and why this file is generated?? Please let me know the reason :(

1 Answer 1


Yes, the passwd command first writes the modified contents of the /etc/shadow file in full to /etc/nshadow, runs fsync() to ensure the nshadow file is actually written to the disk, and then renames /etc/nshadow to /etc/shadow.

This is done to eliminate the possibility of ever having an incomplete file in place as /etc/shadow, even for the briefest time. POSIX specifications say that file rename operations within a single filesystem must be atomic, i.e. any other operations must only be able to see the rename operation as either "not started yet" or "fully completed", never in any kind of "in progress" half-way state.

The pwconv command will also produce /etc/npasswd and /etc/nshadow when you use it to convert an archaic non-shadowed password file to the shadowed format. Some versions of pwconv may require the system administrator to move those files into place manually.

If /etc/nshadow exists on your system, it might be a remnant of a pwconv command run at some time in the past... or it might be there because the rename("/etc/nshadow", "/etc/shadow") system call at the end of some password change operation failed. Such a failure would suggest possible filesystem corruption, or other problems.

If the timestamp of the nshadow file is Jul 25 06:43, then you might want to find out what happened on the system at that time. Was there a problem of some sort that has since then been fixed, or did someone run the pwconv command for any reason?

If the root password was changed using some sort of automation tool, you might want to find out exactly what that automation tool will actually do. Perhaps it will run pwconv for whatever reason.

  • Thanks for your answer. It's very helpful to me :). The change of the root password in my system is triggered by uart command from others. After receiving command, my system use echo -e "password\npassword" | passwd root command to change root password. When I use this command, is the pwconv also used??
    – John
    Aug 7, 2020 at 4:00
  • Also, if all three files related shadow (nshadow, shadow, shadow-) are remaining, can I understand as below?? nshadow : the file saved a new password / shadow : the file saved an original password / shadow- : the backup file of shadow
    – John
    Aug 7, 2020 at 4:23
  • No, it shouldn't use pwconv. If /etc/nshadow, /etc/shadow and /etc/shadow- all have the same timestamp, it suggests something caused at least two successful password changes within the same minute, and possibly failed a third change attempt. And your method means the root password is stored unencrypted somewhere, which is generally not a good idea. There is a chpasswd command which accepts username:password pairs (one per line) from standard input; that would be a better choice for automated password changes. With the -e option it can accept encrypted passwords.
    – telcoM
    Aug 7, 2020 at 6:16
  • Thanks for confirming :). But I'm confused why the /etc/nshadow is generated again when I change root password. I removed /etc/nshadow so that only remains /etc/shadow and /etc/shadow- before test. After I change the root password to another using echo -e "password\npassword" | passwd root, /etc/nshadow is generated and only /etc/shadow is updated and /etc/shadow- is not updated. I'm so confusing :(
    – John
    Aug 7, 2020 at 7:00
  • If you run type passwd, it will tell you where the actual command is located; does it say /usr/bin/passwd or something else? You might also use rpm -qf $(which passwd) to find out the name and version of the RPM package the command comes from, if your distribution is RPM-based. For .deb-based distributions, the equivalent command would be dpkg-query -S $(which passwd). With the name of the Linux distribution and the name & version of the package, it might be possible to find out if it's a known bug/quirk, or something else.
    – telcoM
    Aug 7, 2020 at 7:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .