Hawson: Initial version

2007-05-14T19:31:15Z

Initial version

New page

Shadow passwords are an extension to storing all account information in the <code>/etc/passwd</code> file. Originally, the encrypted passwords for all accounts were kept in the 2nd field of <code>/etc/passwd</code>. Since this file needs to be world-readable in order to obtain information about accounts (including the username, [[UID]], primary [[GID]], [[GECOS]] information, home directory, and user shell), it meant that the encrypted passwords were also viewable. This provided a very nice known-ciphertext attack vector.

An extenstion was developed that addressed this insecurity, and added password and account aging abilities as well. All modern *nix distributions support shadow passwords, in addition to original method.

Aside from re-writing the [[PAM]] code, the main userspace change is the addition of <code>/etc/shadow</code>, and several tools for manipulating this file. Unlike <code>/etc/passwd</code>, the <code>/etc/shadow</code> file must not be world-readable (suggested mode is 600). Of course, this means that all programs that read and write this file must be either [[setuid]], or run by the root user; this includes common "user" programs such as "passwd".

This file stores the data for the following struct:

<pre>struct spwd {
char *sp_namp; /* user login name */
char *sp_pwdp; /* encrypted password */
long sp_lstchg; /* last password change */
int sp_min; /* days until change allowed. */
int sp_max; /* days before change required */
int sp_warn; /* days warning for expiration */
int sp_inact; /* days before account inactive */
int sp_expire; /* date when account expires */
int sp_flag; /* reserved for future use */
}</pre>

The timing of the dates and times stored here can cause some confusion. The following timeline should help show when things occur:

[[image:Shadow_pw.png|Shadow password timeline]]

'''N.B.: The "account expire" date can occur anywhere, including before the password expiration, password last-change, and account inactive dates.'''

Shadow passwords - Revision history

Hawson: Initial version